macos_fixed_base relinks the fixed-base fixture with and without
--macos-fixed-base 0x400000 and checks that every segment and section
moves by the same amount, __PAGEZERO ends 64 KiB below the base, the
lowest load page is at the base, the entry offset is unchanged, and the
metadata load bias and the relocated slot hold base-relative addresses.
It also checks the lowest base and the refused options and images.
cli_args covers the parsing, range, repetition and --macos requirement.
Ruffle (PPSA68091), VLC (PPSA85300) and XPSemu (PPSA97358) read
app0/imports.txt, whose import slot addresses assume the executable's
lowest ELF load page at 0x400000, and dereference them at once. macOS
output always placed that page at 0x140010000, so all three fault on
their first slot read. Linux and Windows have --linux-fixed-base and
--windows-fixed-base for this; macOS had no equivalent.
--macos-fixed-base <address> builds the load image so that the lowest
ELF load page is at the address, as --windows-fixed-base does. The
Mach-O header takes the 64 KiB below it and __PAGEZERO ends there. The
executable is MH_EXECUTE without MH_PIE, so dyld does not slide it. The
address must be 64 KiB aligned, from 0x20000 through 0x7fffffff0000,
and an image ending past the macOS user address space is refused.
WriteMacOsImage wrote the Windows ImageBase constant into the Mach-O
segment and section addresses, __PAGEZERO, the metadata load bias, the
TLS descriptors and the init pointer, while the relocations it rebases
were computed from the WindowsLoadImage base. Read the base from the
load image everywhere instead. Every caller still builds its image at
ImageBase, so the output is unchanged.
macos_gs_traps converts the forms Wine's ntdll in Prospero Win (PPSA99995) uses, a store, an ALU read and a register-address form shorter than a jump, and checks that each becomes ud2 and NOP padding of its own length before the next instruction, with none of the original bytes left.
On x86-64 macOS, including under Rosetta, the host owns GS (it holds the
pthread TSD base, which the macOS TLS stubs read), so a guest instruction
that reads or writes through GS cannot be translated, and the TLS scan
refused the whole module. Prospero Win's (PPSA99995) Wine ntdll has six.
Overwrite each in place with ud2 and NOP padding of its own length, as the
Windows writer does in #6102, and refuse one that is also an AMD-only
trampoline site.
A per-game relinker-patches.toml (or --patches) replaces verified bytes in
the input executable and bundled modules before conversion. Entries are
checked against the expected bytes and against every in-place writer,
the ELF header range and relocation targets. An <output-stem>.patches.toml
manifest records the applied entries, and --verify-patches checks an input
or a converted output. With no patch file the output is unchanged.
Resolve the docs/dev/debt/relinker.md conflict with #5994: keep its
sce_module syscall-scan entry, which now also stops at the end of the
last unwind function when the PLT comes before the code (it calls the
same FindSceCodeEnd), and its /libexec/ld-elf.so.1 start in the code
analysis entry, with this PR's end for a PLT before the code.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The Windows deferred preinit thunk pushed r12, r13 and r14 and then
popped r12, r13 and r14, so the caller got r12 and r14 back swapped.
InitializeDeferredModule keeps the module base, table and count live
across the call to the thunk, so a compiler that keeps any of them in
r12 or r14 sees corrupted loader state after opening a deferred module
that has a preinit array. Pop in reverse push order instead and pin the
new bytes in test_guest_preinit.
guest_preinit loads the instrumented guest_module_args_host.prx into Python, so in an ANYPS5_ENABLE_ASAN build it needs the same verify_asan_link_order=0 as the other module tests; without it, it fails with "ASan runtime does not come first in initial library list". add_asan_test_options does nothing outside ASan builds.
Signed-off-by: Ayamullah Khan <ayamullahkhan04@gmail.com>
Converted guest modules never ran their DT_PREINIT_ARRAY entries: the
reader validated the array and the unused-NID filter kept its targets,
but no writer emitted or ran it. ld.so runs a shared object's preinit
array only for the main executable, so the Linux output runs the
entries from the DT_INIT stub before the module initializer; the macOS
and Windows outputs run them before the initializer in their startup
stubs, and the deferred Windows output exports a thunk that runs them
before the initializer for runtime-loaded modules. A module with a
preinit array and no initializer is still rejected, since the Linux
stub exists only with one.
Adrià