Quana Labs is an independent research and development lab. Investigations, experiments, reverse engineering and tools, documented with methods, evidence and revision history.https://quanalabs.com/enhttps://quanalabs.com/entries/tekken-4-round-timer-rand/https://quanalabs.com/entries/tekken-4-round-timer-rand/An early Tekken 4 (PS2) cheat targeted what looked like the round timer. The code was a division by 60 whose remainder, not quotient, was kept: a random 0 to 59 frame countdown per fighter. The disassembler of the time hid the instructions that gave it away. Three other early patches were wrong too. None of them ever ran, for an unrelated reason.Thu, 22 Oct 2026 00:00:00 GMTReverse engineeringFindingPlayStation 2MIPS assemblyDisassemblyBinary patchingNegative resultTekkenhttps://quanalabs.com/entries/tekken-4-headless-testing/https://quanalabs.com/entries/tekken-4-headless-testing/How the Tekken 4 project proves changes in game without a person playing: PCSX2 is booted by script, steered with synthetic key presses, and asked for savestates, which hold all 32 MB of main memory plus sound and video memory. Every in-game result in the project was produced this way, with rules learned from the times it went wrong.Thu, 22 Oct 2026 00:00:00 GMTReverse engineeringReferencePlayStation 2PCSX2EmulationTest automationMethodologyPythonTekkenhttps://quanalabs.com/entries/tekken-4-audio/https://quanalabs.com/entries/tekken-4-audio/Tekken 4 (PS2) hides its sound driver inside the executable as a compressed, bit-inverted package; the project unpacks and repacks it, and the repacked driver runs identically. The banks, the sound-effect tables, the music track tables and the stage-to-music map are decoded, and music swaps, shortened tracks and replaced sound banks all work in PCSX2. Every result was read from memory: nothing has been checked by ear.Thu, 22 Oct 2026 00:00:00 GMTReverse engineeringInvestigationPlayStation 2MIPS assemblyAudioFile formatsCompressionEmulationTest automationTekkenModdinghttps://quanalabs.com/entries/tekken-4-character-models/https://quanalabs.com/entries/tekken-4-character-models/Tekken 4 (PS2) fighters are CHRTK4 models: VIF packets of skinned vertices and textured strips that the PS2’s vector unit consumes directly. The format is decoded well enough to reshape a head, widen a body and build a 3D beard out of hidden hair meshes, all at the original size, and the results render in PCSX2. Adding new vertices or bones is still out of reach.Thu, 22 Oct 2026 00:00:00 GMTReverse engineeringInvestigationPlayStation 2File formats3D modelsEmulationTekkenModdinghttps://quanalabs.com/entries/tekken-4-wall-winding/https://quanalabs.com/entries/tekken-4-wall-winding/A custom wall in a Tekken 4 (PS2) stage only blocks fighters if each face’s corners wind so that (c1 − c0) × (c2 − c0) points the same way as the face’s stored normal. A correctly placed wall wound the other way loads, links into the collision grid, and is walked straight through. All 867 stock wall faces follow the rule.Thu, 22 Oct 2026 00:00:00 GMTReverse engineeringFindingPlayStation 2File formatsEmulationFalsificationTekkenModdinghttps://quanalabs.com/entries/tekken-4-stage-limits/https://quanalabs.com/entries/tekken-4-stage-limits/A desk model of Tekken 4’s stage memory predicted the game would fail once a stage’s main file passed about 7.6 MB. In PCSX2, stages of 6.0, 6.6, 7.4 and 7.7 MB all loaded and played: the game gave up its pose cache and then shrank a second buffer instead of failing. The same run confirmed the crowd budget and the start-region mechanism.Thu, 22 Oct 2026 00:00:00 GMTReverse engineeringExperimentPlayStation 2EmulationTest automationFalsificationTekkenModdinghttps://quanalabs.com/entries/tekken-4-stages/https://quanalabs.com/entries/tekken-4-stages/Each Tekken 4 (PS2) stage is four archive files, and the biggest is a 15-section container holding the geometry, textures, floor, walls, crowd and start positions. The geometry and wall formats rebuild the stock stages byte for byte, and a new stage 17, with its own geometry, textures, props and collision, loads and plays in PCSX2.Thu, 22 Oct 2026 00:00:00 GMTReverse engineeringInvestigationPlayStation 2MIPS assemblyFile formats3D modelsEmulationTekkenModdinghttps://quanalabs.com/entries/tekken-4-movesets/https://quanalabs.com/entries/tekken-4-movesets/How Tekken 4 (PS2) stores each fighter’s moves: an LZSS-compressed “Character Data” file of twenty tables. The format is decoded well enough to rebuild all 22 stock movesets byte for byte, and edits made with it work in game: a move’s damage changed, a button rerouted, a brand-new move added, and one fighter’s whole moveset run on another’s body.Thu, 22 Oct 2026 00:00:00 GMTReverse engineeringInvestigationPlayStation 2MIPS assemblyFile formatsCompressionEmulationTest automationTekkenModdinghttps://quanalabs.com/entries/tekken-4-data-bin/https://quanalabs.com/entries/tekken-4-data-bin/Tekken 4 (PS2) stores almost everything in one 2.57 GB file, DATA.BIN, with no index inside it. The index is a 1,121-entry table in the game’s executable, and the archive’s only protection is a reversible flip of each file’s first 4 KB. Both are decoded, every checksum passes, and a modified disc that appends new files to the archive boots and plays.Thu, 22 Oct 2026 00:00:00 GMTReverse engineeringInvestigationPlayStation 2MIPS assemblyFile formatsDisassemblyEmulationTekkenModdinghttps://quanalabs.com/entries/tekken-4-map/https://quanalabs.com/entries/tekken-4-map/A status map of the Tekken 4 (PS2) teardown as of 2026-10-22: what is decoded and proven in game, what is decoded but unproven, what is partly understood and what is still unknown, across the archive, movesets, characters, stages and sound. Also the claims that turned out wrong, and the open problems in order of how much they block.Thu, 22 Oct 2026 00:00:00 GMTReverse engineeringReferencePlayStation 2MIPS assemblyFile formatsEmulationTekkenModdinghttps://quanalabs.com/entries/lab-conventions/https://quanalabs.com/entries/lab-conventions/The rules the lab keeps: every entry gets a permanent identifier, addresses never break, changes are logged as lettered revisions, claims carry an evidence status, AI involvement is disclosed, and results that turned out to be wrong stay on the record.Thu, 22 Oct 2026 00:00:00 GMTThe labReferenceAbout the archiveMethodology