Every Marvel's Wolverine cheat crashed the console; CheatRunner's worked.
Our engine PT_ATTACHed the game, set the protection byte of the vm_map
entry holding the address to RWX with kernel_mprotect, wrote with PT_IO,
and "restored" it to R-X. Measured on the Pro (FW 13.60): the game's
.text is one 95 MiB entry (0x400000-0x6324000), execute-only (0x04), so
each toggle made the whole executable RWX under a copy-on-write PT_IO
write and left it R-X. kernel_mprotect edits the entry byte directly (no
pmap update, no split); CheatRunner traced two kernel panics to that
call and moved to the page-table walk this commit uses.
- Read/write through kernel_proc_getpaddr + the direct map (mdbg as a
fallback), inside kernel_rw_lock; read back after every write. No
ptrace stop, no protection change.
- Apply a cheat as a whole: every location is read and checked against
its cheat and original bytes before anything is written; on a write
failure the earlier writes are undone. The old engine wrote whichever
locations matched, so a jump could land without its code cave.
- Write code caves before the jumps into them when turning on, and the
reverse when turning off (cheats_plan.c, host-tested on the real
Wolverine pack).
- Refuse a cheat the parser had to truncate, and a base of 0.
- Toggle state is keyed by the flat index across all of a title's files;
a toggle in the second file used to mark the first file's mods, which
the watcher then re-applied at the next launch.
Verified on the Pro with Wolverine running: God Mode, Max Resources/XP
(20 locations), Infinite Item Charges and an MC4 Infinite Health on and
off, 60 s each, game and console stayed up; a clashing MC4 cheat was
refused with nothing written.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01RxCGb8Asp1A1AQYiv1kbgS
