The PS5 module read for #9027 returns 0x80268006 from sceAudioOut2MasteringInit,
sceAudioOut2MasteringInitEx, sceAudioOut2MasteringTerm,
sceAudioOut2MasteringGetState and sceAudioOut2MasteringSetParam before
sceAudioOut2Initialize. #9027 left the check out because AudioOut2
initialization was not tracked; AudioOut2IsInitialized_nid_no_patch now
tracks it, so each of these returns 0x80268006 first, before its own
mastering-state and argument checks, and changes no state. The debt entry
drops the closed gap.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
atan2f returned the host atan2, so its last bit depended on the host: on
Windows it differs from the libc.prx that titles ship on 7,126,466 of
200,001,024 sampled argument pairs. That libc.prx is msun's e_atan2f.c over
its atanf; with two NaN arguments it returns y's. The port gives the same
bits as PPSA07923's, PPSA05916's and PPSA13934's copies on every pair.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Main implements sceAppContentGetEntitlementKey next to this branch's
sceAppContentGetPftFlag; the merge keeps both declarations, both test
blocks and both debt entries. With that export implemented, Export.cpp
has 8 NotImplemented exports, and the pending-exports count says 8.
Read the unwind functions of an image that only has PT_GNU_EH_FRAME so
inter-FDE data tables are still found and masked, but leave the syscall
and call-site scan ranges empty without PT_SCE_DYNLIBDATA as main does.
The fixture now emits standard dynamic tags for its SysV block, and the
debt entry stays within the 1000 character limit.
A delta read its blocks with ReadCommittedUnsynced while GPU work
accepted before the call could still write them, so a capture could
hold a block from before a DMA copy that the replay then wrote back over
the copy's result. A delta with blocks to read now waits up to 10 s for
the accepted submissions and records the serials after the wait; the
capture stops with a warning when the work does not finish. The Windows
quarantine of agc_driver_frame_replay is removed.
Fixes#10711
Co-Authored-By: Claude Opus 5.5 <[email protected]>
In PS5 Prospero PRX binaries, compilers place embedded constant data tables (such as the OpenSSL Whirlpool lookup table in ubiservices.prx) in inter-FDE gaps after function code, referenced via RIP-relative LEA instructions.
- In RelativeJumpTables, detect constant data tables in inter-FDE gaps that begin with padding, contain no direct branch targets, and contain undecodable non-code bytes, distinguishing them from valid unannotated code routines and multi-hop gap branches.
- In GuestModuleBuilder and RelinkerPipeline, extract unwind functions from PT_GNU_EH_FRAME as well as PT_SCE_DYNLIBDATA, and mask embedded data tables with 0x90 in scan buffers before SyscallScanner.
- In CodeInstructionCollector, populate table boundaries whenever unwind functions are present to prevent addAddressTakenRoot from adding data table addresses to CFG roots on Windows and macOS.
- Update relinker technical debt documentation and add regression tests.
Fixes#7547
Unblocks: PPSA28155 #7547
BunnyFl ran firmware 13.42's libSceSystemService.sprx in an emulator and
recorded the checks these calls make before they pass a request on. A
null title ID or one whose length isn't 9 makes sceSystemServiceGetAppId
and sceLncUtilGetAppId return -1 and sceLncUtilIsAppLaunched return
0x80940005. A null output, list, count or user returns 0x80940005 from
the LncUtil and SystemService calls and 0x80e30003 from
sceShellCoreUtilGetUserFocus, before the app ID is looked at, and a null
sceLncUtilLoadExec path returns 0x80940005.
What the module passes on as a request still throws: another
9-character title ID, another app ID, a list capacity of 0 and an empty
sceLncUtilLoadExec path.
main's canonical-header refactor (f38d29fd08) edited the old libSceSaveData and libSceSaveDataDialog sources this branch removes, and made EventFlag.cpp, libSceNpCommon's Runtime.cpp and GuestKernelErrors.cpp include the old SaveDataCore.hpp. Those three use nothing from it and build without it, so the include is dropped. SaveDataWriteReplacement.cpp takes main's canonical header and keeps only the native path.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
On a standard-port handle the console answers NOT_PERMITTED (0x80920101):
Halo CE Universal's pad probe measured it on firmware 13.59 for two
connected DualSenses in three runs. The function returned 0 with
invented controller information instead. The special port keeps its
zeroed answer.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
The libc.prx that PPSA31872 ships returns ERANGE for a buffer shorter than
23 bytes and otherwise strncpy's length - 1 bytes and terminates the last
one. This matches the firmware 13.60 log, where error 0 with a 16-byte
buffer returned 34 although "No error" fits.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Evrim Cicek