In PS5 Prospero PRX binaries, compilers place embedded constant data tables (such as the OpenSSL Whirlpool lookup table in ubiservices.prx) in inter-FDE gaps after function code, referenced via RIP-relative LEA instructions.
- In RelativeJumpTables, detect constant data tables in inter-FDE gaps that begin with padding, contain no direct branch targets, and contain undecodable non-code bytes, distinguishing them from valid unannotated code routines and multi-hop gap branches.
- In GuestModuleBuilder and RelinkerPipeline, extract unwind functions from PT_GNU_EH_FRAME as well as PT_SCE_DYNLIBDATA, and mask embedded data tables with 0x90 in scan buffers before SyscallScanner.
- In CodeInstructionCollector, populate table boundaries whenever unwind functions are present to prevent addAddressTakenRoot from adding data table addresses to CFG roots on Windows and macOS.
- Update relinker technical debt documentation and add regression tests.
Fixes#7547
Unblocks: PPSA28155 #7547
BunnyFl ran firmware 13.42's libSceSystemService.sprx in an emulator and
recorded the checks these calls make before they pass a request on. A
null title ID or one whose length isn't 9 makes sceSystemServiceGetAppId
and sceLncUtilGetAppId return -1 and sceLncUtilIsAppLaunched return
0x80940005. A null output, list, count or user returns 0x80940005 from
the LncUtil and SystemService calls and 0x80e30003 from
sceShellCoreUtilGetUserFocus, before the app ID is looked at, and a null
sceLncUtilLoadExec path returns 0x80940005.
What the module passes on as a request still throws: another
9-character title ID, another app ID, a list capacity of 0 and an empty
sceLncUtilLoadExec path.
The export threw and was declared without parameters. It follows
int_x509_param_set_hosts of LibreSSL 2.7, the first release with this
export: a name with an embedded NUL is refused, otherwise the host list
is freed, and a non-empty name is copied with the guest strndup into a
new one-name list. A null or empty name only clears the list.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
main's canonical-header refactor (f38d29fd08) edited the old libSceSaveData and libSceSaveDataDialog sources this branch removes, and made EventFlag.cpp, libSceNpCommon's Runtime.cpp and GuestKernelErrors.cpp include the old SaveDataCore.hpp. Those three use nothing from it and build without it, so the include is dropped. SaveDataWriteReplacement.cpp takes main's canonical header and keeps only the native path.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
On a standard-port handle the console answers NOT_PERMITTED (0x80920101):
Halo CE Universal's pad probe measured it on firmware 13.59 for two
connected DualSenses in three runs. The function returned 0 with
invented controller information instead. The special port keeps its
zeroed answer.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
The libc.prx that PPSA31872 ships returns ERANGE for a buffer shorter than
23 bytes and otherwise strncpy's length - 1 bytes and terminates the last
one. This matches the firmware 13.60 log, where error 0 with a 16-byte
buffer returned 34 although "No error" fits.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Prospero Win measured on firmware 12.02 that the PS5 kernel accepts
MAP_EXCL but ignores it: MAP_FIXED | MAP_EXCL over an existing mapping
replaces it without error. Fixed anonymous mmap now does the same instead
of FreeBSD's ENOMEM. MAP_EXCL without MAP_FIXED stays EINVAL.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
The nine-slot _ZTVSt7collateIcE export added by #9979 was still zeroed, so a guest that called through the exported vtable faulted. Fill slots 2 through 8 with the same facet methods that g_collateVtable uses, leave the offset-to-top and typeinfo slots zero, and cover compare, transform, hash, retain and release through the exported object.
The debt entry said that shrink-wrapped leaves, which push later and pop in
balance, could be framed. They cannot as the framer works now: lowering RSP on
entry moves their later pushes onto the spills, which keep their addresses.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Match the AT_REMOVEDIR and rmdir sites so file reparse points stay on the old unlink path. Cover file symlink unlinkat on Windows and point the debt at the drive-target consumers.
Dean Galvin