mirror of
https://github.com/boykopovar/AnyPS5.git
synced 2026-11-05 13:20:11 +00:00
The Windows loader sets up TLS for a dynamically loaded DLL only when it snaps the DLL's imports. Guest modules had no import directory, so their TLS directory was never processed: every guest module kept TLS index 0 and read and wrote the executable's TLS block. A guest libc's thread-locals (gmtime's buffer at +0x39c in Marvel's Wolverine) then ran past the executable's 0x150-byte block into the process heap, and corrupted a loader node that crashed the next thread start in ntdll. Guest modules with TLS now import from KERNEL32, as the executable does. Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>