PlayStation 4 emulator for Windows, Linux, macOS and FreeBSD written in C++
This report summarizes scanner evidence for shadps4-emu/shadPS4, a C++ project with 33,988 GitHub stars. SynthScan examined 333,636 lines of code across 1006 source files, recording 598 pattern matches distributed across 10 syntactic categories. The legacy adjusted pattern signal is 1.8 (Low pattern signal); it is not an authorship estimate.
Use the findings to ask whether maintainers can explain intent, verify dependencies, simplify unnecessary scaffolding, and focus review effort. Risk Payload v1 adds ownership, supply-chain, over-engineering, and review-effort vectors when available. These are prompts for human verification, not probabilities, security findings, or measured maintenance costs.
Use each vector to guide manual verification of the underlying findings.
Payload schema: 1.0.0 · Engine: 2.0.0 · Scoring: heuristic-density-v1 · Scan date: 2026-10-31.
Can maintainers explain intent, assumptions, and trade-offs? 577 finding(s).
Are imports declared and package/API names verified? 6 finding(s).
Are wrappers, guards, and repeated structures necessary? 15 finding(s).
Which changes need focused human review? 598 finding(s).
This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.
Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.
This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.
The scanner identified 598 distinct pattern matches across 10 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.
Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | CONTRIBUTING.md | 41 | // STD includes first | COMMENT |
| LOW | externals/stb/stb_image_write.h | 201 | #ifdef _WIN32 | COMMENT |
| LOW | externals/stb/stb_image_write.h | 221 | #elif !defined(STBIW_MALLOC) && !defined(STBIW_FREE) && !defined(STBIW_REALLOC) && !defined(STBIW_REALLOC_SIZED) | COMMENT |
| LOW | externals/stb/stb_image_write.h | 801 | } else | COMMENT |
| LOW | externals/stb/stb_image_write.h | 881 | (bitbuf |= (code) << bitcount, bitcount += (codebits), stbiw__zlib_flush()) | COMMENT |
| LOW | externals/stb/stb_image.h | 121 | COMMENT | |
| LOW | externals/stb/stb_image.h | 141 | // unsigned char *data = stbi_load(filename, &x, &y, &n, 0); | COMMENT |
| LOW | externals/stb/stb_image.h | 161 | // *channels_in_file otherwise. If desired_channels is non-zero, | COMMENT |
| LOW | externals/stb/stb_image.h | 181 | // more user-friendly ones. | COMMENT |
| LOW | externals/stb/stb_image.h | 201 | // Additionally, stb_image will reject image files that have any of their | COMMENT |
| LOW | externals/stb/stb_image.h | 221 | // =========================================================================== | COMMENT |
| LOW | externals/stb/stb_image.h | 241 | // - Small source code footprint ("easy to maintain") | COMMENT |
| LOW | externals/stb/stb_image.h | 261 | // supported by the compiler. For ARM Neon support, you must explicitly | COMMENT |
| LOW | externals/stb/stb_image.h | 281 | // stb_image supports loading HDR images in general, and currently the Radiance | COMMENT |
| LOW | externals/stb/stb_image.h | 301 | // | COMMENT |
| LOW | externals/stb/stb_image.h | 321 | // Call stbi_set_unpremultiply_on_load(1) as well to force a divide per | COMMENT |
| LOW | externals/stb/stb_image.h | 341 | // STBI_NO_PIC | COMMENT |
| LOW | externals/stb/stb_image.h | 361 | // - If you define STBI_MAX_DIMENSIONS, stb_image will reject images greater | COMMENT |
| LOW | externals/stb/stb_image.h | 541 | COMMENT | |
| LOW | externals/stb/stb_image.h | 561 | #endif | COMMENT |
| LOW | externals/stb/stb_image.h | 581 | COMMENT | |
| LOW | externals/stb/stb_image.h | 601 | #ifndef STBI_ASSERT | COMMENT |
| LOW | externals/stb/stb_image.h | 621 | #endif | COMMENT |
| LOW | externals/stb/stb_image.h | 661 | #endif | COMMENT |
| LOW | externals/stb/stb_image.h | 681 | #ifndef STBI_MALLOC | COMMENT |
| LOW | externals/stb/stb_image.h | 701 | // but previous attempts to provide the SSE2 functions with runtime | COMMENT |
| LOW | externals/stb/stb_image.h | 761 | #else // assume GCC-style if not VC++ | COMMENT |
| LOW | externals/stb/stb_image.h | 781 | COMMENT | |
| LOW | externals/stb/stb_image.h | 981 | return 0; | COMMENT |
| LOW | externals/stb/stb_image.h | 1081 | if ((a >= 0) == (b >= 0)) return a <= SHRT_MAX/b; // product is positive, so similar to mul2sizes_valid | COMMENT |
| LOW | externals/stb/stb_image.h | 1141 | ri->channel_order = STBI_ORDER_RGB; // all current input & output are this, but this is here so we can add BGR order | COMMENT |
| LOW | externals/stb/stb_image.h | 1721 | #ifndef STBI_NO_BMP | COMMENT |
| LOW | externals/stb/stb_image.h | 1921 | // - still fast on x86 (copying globals into locals doesn't help x86) | COMMENT |
| LOW | externals/stb/stb_image.h | 2901 | #undef dct_trn8_32 | COMMENT |
| LOW | externals/stb/stb_image.h | 4081 | // public domain zlib decode v0.2 Sean Barrett 2006-11-18 | COMMENT |
| LOW | externals/stb/stb_image.h | 6161 | if (bitdepth != 8 && bitdepth != 16) | COMMENT |
| LOW | externals/stb/stb_image.h | 7481 | // ************************************************************************************************* | COMMENT |
| LOW | externals/renderdoc/renderdoc_app.h | 21 | * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN | COMMENT |
| LOW | externals/renderdoc/renderdoc_app.h | 41 | #define RENDERDOC_CC | COMMENT |
| LOW | externals/renderdoc/renderdoc_app.h | 61 | COMMENT | |
| LOW | externals/renderdoc/renderdoc_app.h | 81 | // 1 - The application can enable or disable vsync at will | COMMENT |
| LOW | externals/renderdoc/renderdoc_app.h | 101 | eRENDERDOC_Option_DebugDeviceMode = 2, // deprecated name of this enum | COMMENT |
| LOW | externals/renderdoc/renderdoc_app.h | 121 | COMMENT | |
| LOW | externals/renderdoc/renderdoc_app.h | 141 | // 0 - No verification is performed, and overwriting bounds may cause crashes or corruption in | COMMENT |
| LOW | externals/renderdoc/renderdoc_app.h | 161 | // | COMMENT |
| LOW | externals/renderdoc/renderdoc_app.h | 181 | // 0 - unless a read is detected, initial contents will not be saved and will | COMMENT |
| LOW | externals/renderdoc/renderdoc_app.h | 201 | // Mute API debugging output when the API validation mode option is enabled | COMMENT |
| LOW | externals/renderdoc/renderdoc_app.h | 221 | // This will cause increased disk space use (which may cause a capture to fail if disk space is | COMMENT |
| LOW | externals/renderdoc/renderdoc_app.h | 381 | // This function will unload RenderDoc's crash handler. | COMMENT |
| LOW | externals/renderdoc/renderdoc_app.h | 401 | // SetCaptureFilePathTemplate("my_captures/example"); | COMMENT |
| LOW | externals/renderdoc/renderdoc_app.h | 421 | // pathlength will be written with the length in bytes of the filename string | COMMENT |
| LOW | externals/renderdoc/renderdoc_app.h | 441 | // Any existing comments will be overwritten. | COMMENT |
| LOW | externals/renderdoc/renderdoc_app.h | 461 | // | COMMENT |
| LOW | externals/renderdoc/renderdoc_app.h | 481 | // Capturing functions | COMMENT |
| LOW | externals/renderdoc/renderdoc_app.h | 501 | #define RENDERDOC_DEVICEPOINTER_FROM_VKINSTANCE(inst) (*((void **)(inst))) | COMMENT |
| LOW | externals/renderdoc/renderdoc_app.h | 521 | // | COMMENT |
| LOW | externals/renderdoc/renderdoc_app.h | 541 | // | COMMENT |
| LOW | externals/renderdoc/renderdoc_app.h | 561 | typedef void(RENDERDOC_CC *pRENDERDOC_SetCaptureTitle)(const char *title); | COMMENT |
| LOW | externals/renderdoc/renderdoc_app.h | 601 | // 1.1.1 - Refactor: Renamed remote access to target control (to better disambiguate from remote | COMMENT |
| LOW | externals/renderdoc/renderdoc_app.h | 721 | // | COMMENT |
| 502 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | tests/CMakeLists.txt | 256 | # =========================================================================== | COMMENT |
| MEDIUM | tests/CMakeLists.txt | 258 | # =========================================================================== | COMMENT |
| MEDIUM | tests/CMakeLists.txt | 350 | # =========================================================================== | COMMENT |
| MEDIUM | tests/CMakeLists.txt | 352 | # =========================================================================== | COMMENT |
| MEDIUM | tests/CMakeLists.txt | 441 | # =========================================================================== | COMMENT |
| MEDIUM | tests/CMakeLists.txt | 443 | # =========================================================================== | COMMENT |
| MEDIUM | src/core/emulator_settings.cpp | 21 | // ── Singleton storage ───────────────────────────────────────────────── | COMMENT |
| MEDIUM | src/core/emulator_settings.cpp | 25 | // ── nlohmann helpers for std::filesystem::path ─────────────────────── | COMMENT |
| MEDIUM | src/core/emulator_settings.cpp | 89 | // ── Helpers ─────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | src/core/emulator_settings.cpp | 100 | // ── Singleton ──────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | src/core/emulator_settings.cpp | 223 | // ── Game-specific override management ──────────────────────────────── | COMMENT |
| MEDIUM | src/core/emulator_settings.cpp | 286 | // ── Global config.json ───────────────────────────────────── | COMMENT |
| MEDIUM | src/core/emulator_settings.cpp | 353 | // ── Load ────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | src/core/emulator_settings.cpp | 361 | // ── Global config ────────────────────────────────────────── | COMMENT |
| MEDIUM | src/core/emulator_settings.cpp | 428 | // ── Per-game override file ───────────────────────────────── | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | documents/building-docker.md | 23 | ## Step 1: Prepare the Docker Environment | COMMENT |
| LOW | documents/building-docker.md | 41 | ## Step 2: Clone shadPS4 Source | COMMENT |
| LOW | documents/building-docker.md | 57 | ## Step 3: Build with CMake Tools (GUI) | COMMENT |
| LOW | documents/building-docker.md | 90 | ## Step 4: VSCode Integration | COMMENT |
| LOW⚡ | src/core/file_format/trp.cpp | 15 | // Step 1: Encrypt NPcommID | COMMENT |
| LOW⚡ | src/core/file_format/trp.cpp | 22 | // Step 2: Decrypt EFSM | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | externals/dr_flac/dr_flac.h | 5997 | /* We found a FLAC frame. We need to check if it contains the sample we're looking for. */ | COMMENT |
| LOW⚡ | src/core/file_format/trp.cpp | 15 | // Step 1: Encrypt NPcommID | COMMENT |
| LOW⚡ | src/core/file_format/trp.cpp | 22 | // Step 2: Decrypt EFSM | COMMENT |
| LOW | src/core/libraries/sysmodule/sysmodule_internal.cpp | 191 | // Now we need to check if the requested library is allowed to LLE. | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | src/video_core/texture_cache/texture_cache.cpp | 285 | // In this case we need to convert Rx float to a Dx[S8] as requested | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | src/core/memory.h | 225 | // If size is zero and boundary checks succeed, then skip more robust checking | COMMENT |
| MEDIUM | …hader_recompiler/ir/passes/phi_simplification_pass.cpp | 12 | // Essentially two SCCs are in same group if they have same number of Phis, in same blocks and | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | tests/network/test_http_uri.cpp | 224 | src.path = const_cast<char*>("user@example.com"); | CODE |
| LOW⚡ | src/core/libraries/network/ssl2.cpp | 149 | const char* dummy_data = "dummy"; | CODE |
| LOW⚡ | src/core/libraries/network/ssl2.cpp | 150 | u64 dummy_length = strlen(dummy_data) + 1; | CODE |
| LOW⚡ | src/core/libraries/network/ssl2.cpp | 152 | strncpy(data, dummy_data, dummy_length); | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | scripts/ps4_names2stubs.py | 7 | CODE | |
| LOW | scripts/ps4_names2stubs.py | 7 | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | .github/workflows/build.yml | 428 | # Check if release already exists and get ID | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | src/shader_recompiler/ir/ir_emitter.cpp | 2195 | // Example usage: | COMMENT |