Guest module discovery skipped the input executable and the
--executable check rejected an executable converted twice through
std::filesystem::equivalent, which MinGW reports as false for hard links
whose names give different permissions, such as .bin and .exe. Move the
GetFileInformationByHandle comparison to Io::SameFile and use it for
these checks and for SameOutputFile.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Trimming the end of any PT_INTERP inside an executable segment dropped
the code in front of one that follows it, so an image without an SCE
block whose interpreter sits after its code lost its entry points. The
trim now applies to an interpreter that starts the segment, and the SCE
path keeps taking any interpreter inside the scanned range, as before.
The code analysis trims an interpreter path from the start of an
executable segment only for images that have a PT_SCE_DYNLIBDATA block.
An executable without one keeps that path in the scanned range, so
/libexec/ld-elf.so.1 is walked as code: a RELATIVE relocation with
addend 0 roots the control flow graph at the first byte of the segment,
and the 0x64 of "ld-elf" decodes as an FS-prefixed instruction that the
Windows and macOS TLS rewriters refuse. The trim now runs for both
layouts, ending at the segment for an image without the block.
The checks on a guest module's output name threw without an input
path, so the conversion's catch reported the main executable. They now
carry the module's path, as the guest image reader's errors do. The
loop's duplicate-export check gets the same change for consistency; it
cannot fire, because the reader rejects a duplicate first.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
The raw-byte check that runs before a syscall pattern between PS4 unwind
functions is skipped now also accepts mov rax, imm64, merges a following
mov al, imm8 or mov ax, imm16 into the earlier constant, and walks back
over any number of register moves or zeroings that leave rax alone
instead of at most seven. Visited states keep the walk linear in the
bytes it covers.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
A relocation or lea target outside the unwind functions of a PS4 image
is now decoded up to its first jump, return or trap, or to the start of
the next unwind function, which also bounds the transfer check of the
tail rule. A target whose run holds an fs:[disp32] access, the form the
linear TLS sweep roots, is followed as code. The other targets taken as
data are counted in one message and kept as entry points that the
Windows TLS rewrite may not overwrite. The analysis merges nested
unwind ranges like the scans.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
The skip of syscall patterns outside the unwind functions let some real
syscalls through. The scan now merges nested and overlapping unwind
ranges with the instruction scanner's MergeCodeRanges, so a pattern
inside an outer function is refused. A constant syscall number is also
looked for in the bytes in front of the pattern, whatever alignment the
decoding took: a mov eax, mov rax or xor eax, eax that ends at the
pattern or before register moves and zeroings that leave rax alone. The
decoded lookback requires each instruction to end where the next one
starts. Guest modules without PT_SCE_DYNLIBDATA get no unwind ranges,
so their scan stays strict even when their unwind table is read.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Check padding up to the end of the inspected range first, as before, and
use the 16-byte boundary rule only when that fails, so a long NOP that
crosses the boundary no longer rejects the table. Check the bytes the
function's own unwind range still covers after the table, so a table cut
short inside its function is rejected again.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
The code analysis of the Windows and macOS outputs followed every
relocation and lea target inside the code range as code. PS4 images keep
read-only data between unwind functions, and strings and tables there
decoded into garbage, failing the conversion. Outside the unwind functions
such a target is now code only when it is 16-byte aligned, starts less
than 256 bytes after an unwind function and decodes to a jump, return or
trap; lea targets go through the same rule instead of the graph's own.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Between the unwind functions of a PS4 image the bytes are not known to be
code, and read-only tables there can hold 0f 05. Outside the unwind
functions a syscall, sysenter, int 0x80 or sysret pattern now fails the
relink only when a constant syscall number is loaded right before it; the
others are skipped and counted in one message. Inside the unwind functions
and in other images every such instruction still fails.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
windows_named_imports, windows_trace_imports, windows_guest_weak_imports and
guest_module_identity run converted programs that stop on a missing import,
then remove their temporary directory. Windows keeps the modules of such an
exited process open for a short time after the process handle is signaled, so
under parallel ctest the removal fails with PermissionError on a .prx that
program loaded: with Defender real-time protection off, 3 or 4 of these tests
failed in each of three runs of ctest --repeat until-fail:10 -j 16 over the 69
tests that run converted programs.
Add fixture_directory to guest_import_fixtures, a temporary directory whose
removal retries on PermissionError for at most 10 s, and use it in the four
tests. Their checks are unchanged.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
windows_dependency_diagnostics rewrites the fixture images right after the
diagnostic runner exits. The runner ends with an unhandled RaiseException of
STATUS_DLL_NOT_FOUND, and Windows fault handling keeps the exited process's
image files open for a short time after its handle is signaled: on Windows 11
22621 the Restart Manager names the exited runner as the holder and the file
opens 37 to 153 ms later. The rewrite then fails with ERROR_SHARING_VIOLATION,
and the final removal of the fixtures with access denied. Retry opening a
fixture while it fails with a sharing violation and the removal while it fails
with access denied, for at most 10 s each; every other failure still fails the
test at once.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
FindTrailingRelativeJumpTable accepted a jump table after a function's
code only when padding followed it up to the end of the inspected range.
A PS4 function's table can end past its FDE, be padded to the next
16-byte boundary and be followed by more code before the next FDE. The
table is now accepted when padding reaches that boundary; it then ends
there, so the code after it is still analysed as code.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
MCOMMIT becomes STC plus NOP padding and RDPRU goes through a
runtime-checked stub returning the host TSC for MPERF/APERF while
other selectors yield zero, with converter and execution tests.
docs/dev/debt/relinker.md records the new lowering and its unverified
assumptions.
The Linux entry stub now passes each traced import through libc.prx's
TraceImport_nid_no_patch before it calls the guest entry, and stores the
returned thunk in the import's slot. The same imports are traced as on
Windows: functions bound through a PLT slot or a GOT slot, without an
addend, and not weak. TraceImport_nid_no_patch is bound eagerly through
an added GLOB_DAT relocation, so a libc.prx without it fails at load.
Each slot's page is made writable with mprotect first, so slots inside a
PT_GNU_RELRO range can be replaced.
--trace-imports now requires libc.prx among the libraries on Linux too,
and is refused with --macos.
Dean