mirror of
https://github.com/boykopovar/AnyPS5.git
synced 2026-11-06 13:30:00 +00:00
TideOPL
e6467c4dff
The Windows TLS rewriter only patches instructions that CodeInstructionCollector finds: symbol and unwind function ranges, plus the code their branches, relocated pointers and initializers reach. A fixed-address executable (ET_SCE_EXEC) has no relocations for function pointers held in data, such as vtables or a thread entry loaded with LEA, and its unwind tables need not cover every function. TLS accesses in that code stayed `mov reg, fs:[0]`, which reads address 0 on Windows. PPSA16064 (Minecraft Dungeons II, Unreal Engine) has 3689 such loads in its executable segment; 478 were left unpatched, and its worker threads faulted on their first TLS access at start-up. The collector now also sweeps each executable segment linearly from the first address that int3 padding precedes on a 16-byte boundary, and adds every FS-prefixed instruction with an absolute disp32 operand as a root. The sweep resynchronizes at the next padded 16-byte boundary when an instruction does not decode, crosses such a boundary or starts with two zero bytes, so zero-filled or undecodable bytes are not read as code. The rewriter's own checks still decide which forms it can patch. With this, all 3689 loads in PPSA16064 are patched. New cases in tls_function_coverage: a padded function nothing references is patched, and the same load behind zero fill after padding is left unchanged.