mountain 3 crash: rollingbouldermountain spawners end while their boulders still write parent.v13 (use after free), seen in game, one-word level fix tested; diag tooling in notes/dev
This commit is contained in:
MineTec committed
1 parent
8b3c38fe56
commit
e36ff2d2c2
5 files changed
+537
No files matched your search
@@ -0,0 +1,44 @@
|
||||
package mtn3;
|
||||
|
||||
import com.eliasmueller.llamamod.exe.ExeImage;
|
||||
import com.eliasmueller.llamamod.mods.Mod;
|
||||
import com.eliasmueller.llamamod.mods.ModContext;
|
||||
import com.eliasmueller.llamamod.mods.ModOption;
|
||||
import java.io.IOException;
|
||||
import java.nio.file.Files;
|
||||
import java.nio.file.Path;
|
||||
import java.util.List;
|
||||
|
||||
/** Throwaway diagnostics: stale parent-variable access log + local heap consistency check. */
|
||||
public final class Mtn3DiagMod implements Mod {
|
||||
static final Path DIR = Path.of("/home/elias/.claude/jobs/90c6eed7/tmp/m3/diag");
|
||||
|
||||
public String id() { return "mtn3-diag"; }
|
||||
public String name() { return "Mountain 3 diagnostics"; }
|
||||
public String description() { return "Logs stale parent writes and checks the local heap (test only)."; }
|
||||
public boolean modifiesExecutable() { return true; }
|
||||
public List<ModOption> options() {
|
||||
return List.of(ModOption.bool("fix", "Fix", "Redirect stale parent writes to a dummy", false),
|
||||
ModOption.string("rev", "Rev", "cache buster", "1"));
|
||||
}
|
||||
|
||||
public void apply(ModContext ctx) throws IOException {
|
||||
ExeImage exe = ctx.exe();
|
||||
long data = exe.allocateData(8192, "mtn3 diag data");
|
||||
long cave = exe.nextAllocation();
|
||||
String fix = ctx.optionBool("fix") ? "1" : "0";
|
||||
Path bin = DIR.resolve(String.format("cave_%s_%x_%x.bin", fix, cave, data));
|
||||
Files.writeString(DIR.resolve("addresses.txt"), String.format("CAVE=0x%x DATA=0x%x FIX=%s%n", cave, data, fix));
|
||||
if (!Files.exists(bin)) {
|
||||
throw new IOException("assemble " + bin);
|
||||
}
|
||||
long at = exe.place(Files.readAllBytes(bin), "mtn3 diag code");
|
||||
if (at != cave) {
|
||||
throw new IOException("cave moved " + Long.toHexString(at));
|
||||
}
|
||||
exe.hookJmp(0x553770, "8B 44 24 04 8B", cave, "pushParentVarAddr");
|
||||
exe.hookJmp(0x553a40, "56 8B 74 24 08", cave + 5, "popParentVar");
|
||||
exe.hookJmp(0x41ada0, "8B 44 24 04 56", cave + 10, "FreeLocalMem");
|
||||
exe.hookJmp(0x41ae20, "8B 0D 9C 49 58 00", cave + 15, "AllocLocalMem");
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,285 @@
|
||||
; Mountain 3 crash diagnostics (German groove.exe). nasm -f bin -DCAVE=.. -DDATA=.. -DFIX=0/1
|
||||
bits 32
|
||||
org CAVE
|
||||
%define D(o) dword [DATA+o]
|
||||
; DATA layout: 0 magic, 16 cnt_parent_ok, 20 cnt_stale_addr, 24 cnt_stale_pop, 28 cnt_free, 32 cnt_anom,
|
||||
; 36 cnt_alloc, 40 stale ring idx, 44 all ring idx, 48 dummy, 52 last free ptr, 56 last alloc size, 60 tmp idx,
|
||||
; 64 stale ring 32x32, 1088 anomaly record 64 bytes, 1152 dump 256 bytes (hdr-128..+128), 1408 all-ring 64x32 (2048)
|
||||
; 3456 free history 64 x 16
|
||||
entry_addr: jmp near push_addr
|
||||
entry_pop: jmp near pop_var
|
||||
entry_free: jmp near free_hook
|
||||
entry_alloc: jmp near alloc_hook
|
||||
|
||||
push_addr:
|
||||
mov eax,[esp+4]
|
||||
mov ecx,[eax+0xc]
|
||||
mov edx,[esp+8]
|
||||
mov [DATA+60],edx
|
||||
mov edx,0x11
|
||||
call record_all
|
||||
test ecx,ecx
|
||||
jz .stale
|
||||
cmp dword [ecx+0xec],0
|
||||
jz .stale
|
||||
inc D(16)
|
||||
.ok:
|
||||
mov edx,[ecx+0xf4]
|
||||
mov ecx,[esp+8]
|
||||
lea edx,[edx+ecx*4]
|
||||
.push:
|
||||
push edx
|
||||
push eax
|
||||
call 0x54bbd0
|
||||
add esp,8
|
||||
ret
|
||||
.stale:
|
||||
inc D(20)
|
||||
mov edx,1
|
||||
call record
|
||||
call stale_info
|
||||
call check_heap
|
||||
%if FIX
|
||||
mov edx,DATA+48
|
||||
jmp .push
|
||||
%else
|
||||
test ecx,ecx
|
||||
jnz .ok
|
||||
mov edx,DATA+48
|
||||
jmp .push
|
||||
%endif
|
||||
|
||||
pop_var:
|
||||
push esi
|
||||
mov esi,[esp+8]
|
||||
push esi
|
||||
call 0x54bc00
|
||||
add esp,4
|
||||
mov ecx,[esi+0xc]
|
||||
mov edx,[esp+0xc]
|
||||
mov [DATA+60],edx
|
||||
push eax
|
||||
mov eax,esi
|
||||
mov edx,0x12
|
||||
call record_all
|
||||
pop eax
|
||||
test ecx,ecx
|
||||
jz .stale
|
||||
cmp dword [ecx+0xec],0
|
||||
jz .stale
|
||||
inc D(16)
|
||||
.ok:
|
||||
mov edx,[ecx+0xf4]
|
||||
mov ecx,[esp+0xc]
|
||||
lea edx,[edx+ecx*4]
|
||||
.store:
|
||||
pop esi
|
||||
mov [edx],eax
|
||||
ret
|
||||
.stale:
|
||||
inc D(24)
|
||||
push eax
|
||||
mov eax,esi
|
||||
mov edx,2
|
||||
call record
|
||||
call stale_info
|
||||
call check_heap
|
||||
pop eax
|
||||
%if FIX
|
||||
mov edx,DATA+48
|
||||
jmp .store
|
||||
%else
|
||||
test ecx,ecx
|
||||
jnz .ok
|
||||
mov edx,DATA+48
|
||||
jmp .store
|
||||
%endif
|
||||
|
||||
; record: eax strat, ecx parent, edx kind, [DATA+60] idx. Preserves eax, ecx.
|
||||
record:
|
||||
push esi
|
||||
push edi
|
||||
push ebx
|
||||
mov esi,[DATA+40]
|
||||
and esi,31
|
||||
shl esi,5
|
||||
lea edi,[DATA+64+esi]
|
||||
jmp rec_common
|
||||
record_all:
|
||||
push esi
|
||||
push edi
|
||||
push ebx
|
||||
mov esi,[DATA+44]
|
||||
and esi,63
|
||||
shl esi,5
|
||||
lea edi,[DATA+1408+esi]
|
||||
inc D(44)
|
||||
dec D(40) ; compensated below
|
||||
rec_common:
|
||||
inc D(40)
|
||||
mov [edi],eax
|
||||
mov [edi+4],ecx
|
||||
mov [edi+8],edx
|
||||
mov ebx,[DATA+60]
|
||||
mov [edi+12],ebx
|
||||
mov ebx,[eax+0x18]
|
||||
mov [edi+16],ebx
|
||||
mov dword [edi+20],0
|
||||
mov dword [edi+24],0
|
||||
mov dword [edi+28],0
|
||||
test ecx,ecx
|
||||
jz .np
|
||||
mov ebx,[ecx+0x18]
|
||||
mov [edi+20],ebx
|
||||
mov ebx,[ecx+0xf4]
|
||||
mov [edi+24],ebx
|
||||
mov ebx,[ecx+0xec]
|
||||
mov [edi+28],ebx
|
||||
.np:
|
||||
pop ebx
|
||||
pop edi
|
||||
pop esi
|
||||
ret
|
||||
|
||||
free_hook:
|
||||
pushad
|
||||
inc D(28)
|
||||
mov eax,[esp+36]
|
||||
mov [DATA+52],eax
|
||||
mov esi,[DATA+28]
|
||||
and esi,63
|
||||
shl esi,4
|
||||
mov [DATA+3456+esi],eax
|
||||
mov ebx,[esp+32] ; caller
|
||||
mov [DATA+3456+esi+4],ebx
|
||||
mov ebx,[eax-4] ; size|used
|
||||
mov [DATA+3456+esi+8],ebx
|
||||
mov ebx,[eax-12] ; next
|
||||
mov [DATA+3456+esi+12],ebx
|
||||
call check_heap
|
||||
popad
|
||||
mov eax,[esp+4]
|
||||
push esi
|
||||
jmp 0x41ada5
|
||||
|
||||
alloc_hook:
|
||||
pushad
|
||||
inc D(36)
|
||||
mov eax,[esp+36]
|
||||
mov [DATA+56],eax
|
||||
call check_heap
|
||||
popad
|
||||
mov ecx,[0x58499c]
|
||||
jmp 0x41ae26
|
||||
|
||||
; walks the local heap; on the first inconsistency records it (code in anomaly+0)
|
||||
check_heap:
|
||||
pushad
|
||||
mov esi,[0x58499c]
|
||||
test esi,esi
|
||||
jz .done
|
||||
xor edi,edi
|
||||
mov ecx,70000
|
||||
.loop:
|
||||
mov edx,1
|
||||
cmp [esi+4],edi
|
||||
jne .bad
|
||||
mov edx,2
|
||||
movzx eax,word [esi+10]
|
||||
cmp eax,1
|
||||
ja .bad
|
||||
mov ebx,[esi]
|
||||
test ebx,ebx
|
||||
jz .done
|
||||
mov edx,3
|
||||
movzx eax,word [esi+8]
|
||||
lea eax,[esi+eax*4+12]
|
||||
cmp ebx,eax
|
||||
jne .bad
|
||||
mov edi,esi
|
||||
mov esi,ebx
|
||||
dec ecx
|
||||
jnz .loop
|
||||
.done:
|
||||
popad
|
||||
ret
|
||||
.bad:
|
||||
inc D(32)
|
||||
cmp dword [DATA+32],1
|
||||
jne .done
|
||||
mov [DATA+1088],edx
|
||||
mov [DATA+1092],esi
|
||||
mov [DATA+1096],edi
|
||||
mov eax,[esi]
|
||||
mov [DATA+1100],eax
|
||||
mov eax,[esi+4]
|
||||
mov [DATA+1104],eax
|
||||
mov eax,[esi+8]
|
||||
mov [DATA+1108],eax
|
||||
mov eax,[DATA+28]
|
||||
mov [DATA+1112],eax
|
||||
mov eax,[DATA+36]
|
||||
mov [DATA+1116],eax
|
||||
mov eax,[DATA+40]
|
||||
mov [DATA+1120],eax
|
||||
mov eax,[esp+32] ; return address of check_heap caller
|
||||
mov [DATA+1124],eax
|
||||
mov eax,[DATA+52]
|
||||
mov [DATA+1128],eax
|
||||
mov eax,[DATA+56]
|
||||
mov [DATA+1132],eax
|
||||
; dump 256 bytes from edi (previous header) if set, else esi-128
|
||||
test edi,edi
|
||||
jnz .src
|
||||
lea edi,[esi-128]
|
||||
.src:
|
||||
mov esi,edi
|
||||
lea edi,[DATA+1152]
|
||||
mov ecx,64
|
||||
rep movsd
|
||||
jmp .done
|
||||
|
||||
; stale_info: ecx parent, [DATA+60] idx -> DATA+4480 + (n&31)*16: target, block hdr, size|used, value before
|
||||
stale_info:
|
||||
pushad
|
||||
test ecx,ecx
|
||||
jz .out
|
||||
mov edi,[ecx+0xf4]
|
||||
mov eax,[DATA+60]
|
||||
lea edi,[edi+eax*4]
|
||||
mov ebx,[DATA+40]
|
||||
dec ebx
|
||||
and ebx,31
|
||||
shl ebx,4
|
||||
lea ebx,[DATA+4480+ebx]
|
||||
mov [ebx],edi
|
||||
mov eax,[edi]
|
||||
mov [ebx+12],eax
|
||||
mov dword [ebx+4],0
|
||||
mov dword [ebx+8],0
|
||||
mov esi,[0x58499c]
|
||||
mov ecx,70000
|
||||
.l:
|
||||
test esi,esi
|
||||
jz .out
|
||||
mov edx,[esi]
|
||||
test edx,edx
|
||||
jnz .h
|
||||
movzx eax,word [esi+8]
|
||||
lea edx,[esi+eax*4+12]
|
||||
.h:
|
||||
cmp edi,esi
|
||||
jb .next
|
||||
cmp edi,edx
|
||||
jae .next
|
||||
mov [ebx+4],esi
|
||||
mov eax,[esi+8]
|
||||
mov [ebx+8],eax
|
||||
jmp .out
|
||||
.next:
|
||||
mov esi,[esi]
|
||||
dec ecx
|
||||
jnz .l
|
||||
.out:
|
||||
popad
|
||||
ret
|
||||
Executable
+54
@@ -0,0 +1,54 @@
|
||||
#!/usr/bin/env python3
|
||||
"""rd.py SESSION : attach briefly with winedbg, dump diag data, print summary"""
|
||||
import os, re, subprocess, sys, struct
|
||||
S = sys.argv[1]; DATA = 0x70f010; N = 4992
|
||||
env = dict(os.environ, WINEPREFIX='/home/elias/.claude/jobs/90c6eed7/tmp/%s/data/wine' % S, WINEDEBUG='-all')
|
||||
def dbg(cmds):
|
||||
out = subprocess.run(['winedbg'], input='\n'.join(cmds) + '\ndetach\nquit\n', env=env, capture_output=True, text=True, timeout=60).stdout
|
||||
return out
|
||||
pl = dbg(['info proc'])
|
||||
m = re.search(r'([0-9a-f]{8})\s+\d+\s+\\_ \'groove.exe\'', pl)
|
||||
if not m: print('no groove.exe'); sys.exit(1)
|
||||
pid = m.group(1)
|
||||
out = dbg(['attach 0x' + pid, 'x/%dx 0x%x' % (N // 4, DATA), 'x/16x 0x58499c'])
|
||||
words = {}
|
||||
for l in out.splitlines():
|
||||
mm = re.match(r'.*?0x([0-9a-f]{8}):\s+((?:[0-9a-f]{8}\s*)+)$', l)
|
||||
if mm:
|
||||
a = int(mm.group(1), 16)
|
||||
for i, w in enumerate(mm.group(2).split()): words[a + 4 * i] = int(w, 16)
|
||||
def W(o): return words.get(DATA + o, 0)
|
||||
names = set()
|
||||
for base, cnt in ((64, 32), (1408, 64)):
|
||||
for i in range(cnt):
|
||||
e = DATA + base + 32 * i
|
||||
for k in (16, 20):
|
||||
if words.get(e + k): names.add(words[e + k])
|
||||
nm = {}
|
||||
if names:
|
||||
o2 = dbg(['attach 0x' + pid] + ['x/s 0x%x' % a for a in sorted(names)])
|
||||
ss = [l for l in o2.splitlines() if l.startswith('Wine-dbg>') and '"' not in l or True]
|
||||
segs = o2.split('Wine-dbg>')
|
||||
for i, a in enumerate(sorted(names)):
|
||||
nm[a] = segs[2 + i].strip() if 2 + i < len(segs) else hex(a)
|
||||
print('parent_ok=%d stale_addr=%d stale_pop=%d free=%d alloc=%d anomalies=%d staleidx=%d allidx=%d' % (W(16), W(20), W(24), W(28), W(36), W(32), W(40), W(44)))
|
||||
def ring(base, cnt, idx, label, last=12):
|
||||
print('--', label)
|
||||
n = min(idx, cnt)
|
||||
for j in range(max(0, idx - last), idx):
|
||||
e = base + 32 * (j % cnt)
|
||||
s, p, k, vi, sn, pn, pv, pec = (W(e + 4 * q) for q in range(8))
|
||||
print(' #%d kind=%x strat=%x(%s) parent=%x(%s) v%d parentvars=%x parent_ec=%x target=%x' % (j, k, s, nm.get(sn, '-'), p, nm.get(pn, '-'), vi, pv, pec, pv + 4 * vi))
|
||||
ring(64, 32, W(40), 'stale', 32)
|
||||
for j in range(max(0, W(40) - 32), W(40)):
|
||||
e = 4480 + 16 * (j % 32); t, h, su, v = (W(e + 4 * q) for q in range(4))
|
||||
print(' stale#%d target=%x block=%x off=+0x%x %s size=%d value_before=%x%s' % (j, t, h, t - h if h else 0, 'USED' if su >> 16 else 'FREE', su & 0xffff, v, ' <<< HEADER HIT' if h and t - h < 12 else ''))
|
||||
ring(1408, 64, W(44), 'all parent accesses (last 16)', 16)
|
||||
if W(32):
|
||||
print('ANOMALY code=%d hdr=%x prevhdr=%x hdr.next=%x hdr.prev=%x sizeused=%x frees=%d allocs=%d staleidx=%d caller=%x lastfree=%x lastalloc=%d' % tuple(W(1088 + 4 * q) for q in range(12)))
|
||||
d = [W(1152 + 4 * q) for q in range(64)]
|
||||
for q in range(0, 64, 8): print(' ' + ' '.join('%08x' % x for x in d[q:q + 8]))
|
||||
fh = [(W(3456 + 16 * q), W(3456 + 16 * q + 4), W(3456 + 16 * q + 8), W(3456 + 16 * q + 12)) for q in range(64)]
|
||||
print('heapbase', hex(words.get(0x58499c, 0)))
|
||||
if '-f' in sys.argv:
|
||||
for q in range(64): print(' free ptr=%x caller=%x sizeused=%x next=%x' % fh[q])
|
||||
@@ -0,0 +1,10 @@
|
||||
#!/usr/bin/env python3
|
||||
"""wadfix.py IN OUT: RollingBoulderMountain never ends (its final 'wait until v13 == 0' compares with 0.5)."""
|
||||
import struct, sys
|
||||
d = bytearray(open(sys.argv[1], 'rb').read())
|
||||
pat = struct.pack('<6I', 0x1002f, 0xd0004, 0x44, 0x4e, 0xfffc0012, 0xb4) # freezeOffCamera 1; v13; pushShort 0; eq; jzYield -4; end
|
||||
i = d.find(pat)
|
||||
assert i >= 0 and d.find(pat, i + 1) < 0, 'pattern not unique'
|
||||
struct.pack_into('<I', d, i + 8, 0x08000044) # pushShort 0.5
|
||||
open(sys.argv[2], 'wb').write(d)
|
||||
print('patched at 0x%x' % (i + 8))
|
||||
@@ -0,0 +1,144 @@
|
||||
# "Mountain 3 crash" (speedrun community) – investigation 2026-11-08
|
||||
|
||||
Short version: **Mountain 3 = `t1l5m003`** (world 5, chapter 3). Its boulder spawner
|
||||
(`RollingBoulderMountain`) can end while a boulder it spawned is still alive. When that boulder
|
||||
finishes its path, it decrements `parent.v13` of the dead spawner. That write
|
||||
(`-= 1.0`, i.e. `-0x1000`) goes into freed or reused memory (use after free). If it hits a header of
|
||||
the game's local heap, a later `FreeLocalMem` crashes. That matches the community crash dump.
|
||||
The stale write is **verified in game**. A full crash was **not** reproduced. A one-word level-data
|
||||
patch removes the stale write (verified in game).
|
||||
|
||||
## Evidence from the community
|
||||
|
||||
* DebugDiag dump (English exe, 2000-10-17): access violation **writing** `0x0000340d` at
|
||||
`groove+0x1ad52` = VA `0x41AD52`, thread 0, Argonaut name `FreeLocalMem`.
|
||||
* English `0x41AD10..0x41AD89` is byte-identical to German **`FUN_0041ada0`** (only the rel32 of
|
||||
the "ITS NOT USED! %08x" debug printf differs). Crash instruction = German `0x41ADE2`
|
||||
`mov [eax+4], esi`.
|
||||
* The local heap (`FUN_0041af00` init, `FUN_0041ae20` alloc, `FUN_0041ada0` free) holds blocks with a
|
||||
12-byte header `{next, prev, u16 size (dwords), u16 used}`. The blocks are contiguous
|
||||
(`next == hdr + (size+3)*4`). On free, the routine merges with the **next** block if
|
||||
`next.used == 0`, then does `next->next->prev = hdr`. The crash means the header after the
|
||||
freed block had `used == 0` and `next == 0x3409`. 0x3409 is not 4-aligned, so it can't be a real
|
||||
block pointer. **The heap metadata was corrupted earlier, and the free only shows it.**
|
||||
* Clips: index.mp4 is in a snowy canyon with a pushable boulder (red X), wall shards
|
||||
(`SmashWallShrapnel`), a ruby-idol pickup (HUD), and a crash at the cave about 6 s later.
|
||||
index2.mp4 is the Kronk ice race (`KronkOnIceDoor`/`KronkOnIce`, same WAD): black screen about
|
||||
2 s after the race starts. Both are in `t1l5m003`. Our boot to (74.6, 14.8, 6.3) shows the same canyon
|
||||
and boulder as clip 1, so clip 1 is most likely the `#47` push-boulder section (hypothesis,
|
||||
based on what the scenes look like).
|
||||
* Side note: the heap is `operator_new(0x200000)` but is initialised with size `0x800000` into a u16
|
||||
field, so it is really 0xFFFD dwords (≈256 KB). Mountain 3 uses about 88 KB of it, so the heap
|
||||
is not exhausted. No leak was seen: block count stayed stable over minutes.
|
||||
|
||||
## The bug (strat code of unit 1 of t1l5m003, verified by disassembly)
|
||||
|
||||
`RollingBoulderMountain` (6 MAP instances, params v0..v9). `v13` is set to 0 and never
|
||||
incremented anywhere. The only other access is the boulder's `parent.v13 -= 1.0`
|
||||
(`pushParentVarAddr v13; dec`) in `L_0574`, which runs when the boulder ends its path or falls:
|
||||
|
||||
```
|
||||
spawner: ... spawn loop (L_0c24: spawn<7,31,4,0x14c000,0>(…RollingBoulderForMountain)) ...
|
||||
freezeOffCamera 1
|
||||
L_0d90: pushVar v13 / pushShort 0 / eq / jzYield L_0d90 / end ; ends at once when v13 == 0
|
||||
boulder: L_0574: parent.v13 -= 1.0 ; ... ; remove
|
||||
```
|
||||
|
||||
* With `v1 == 0` (instances #17 and #35) or `v4 != 0` (#22 and #47, the pushable "red X" boulders,
|
||||
which wait to be charged), the spawner spawns **one** boulder and **ends in the same frame**
|
||||
(v13 is still 0).
|
||||
* Instances #1 and #27 (`v1` = 8.3 / 8.75) loop: a boulder about every 8–10 s, until the player
|
||||
is near the path start. They end the same way if no boulder has died yet when the loop exits.
|
||||
* Strat removal (strat update loop `FUN_0054c4a0`) frees the var block
|
||||
(`+0xF4`) and the collision block (`+0xC0`) and puts the struct on the free list (LIFO). It does
|
||||
**not** clear the children's `+0xC` parent pointers. The parent opcodes (`0x553750`/`0x553770`/
|
||||
`0x553a40`) have no check.
|
||||
* So the boulder's write goes to `deadSpawner.vars + 0x34`: either memory of the freed var block
|
||||
(now part of a free block or of another allocation, possibly a **block header**), or, if the
|
||||
struct was already reused, `v13` of another strat. For a boulder, `v13` is its sound address
|
||||
(`v13 = sound:4`, used by `playSoundChannel`).
|
||||
* "Predictable intervals" (runner's guess) fits: the stale writes happen a fixed time after you
|
||||
pass a spawner, or after you push a boulder, when that boulder reaches the end of its path.
|
||||
Whether a write hurts depends on the heap layout at that moment, so it depends on timing.
|
||||
It is not deterministic across runs.
|
||||
|
||||
## In-game verification (apptest, Xvfb :26, sessions `mtn3-*`)
|
||||
|
||||
Tooling (throwaway, see `notes/dev/mountain3-diag/`): a test-only mod `Mtn3DiagMod` (loaded through
|
||||
`APPTEST_CP` + `-Dllamamod.extraMods`). It installs a code cave (`cave.asm`, nasm) that replaces the
|
||||
`pushParentVarAddr` and `popParentVar` handlers. They log every access, flag **stale** ones
|
||||
(parent `+0xEC == 0`, i.e. removed) together with the block that the target address falls in, and
|
||||
walk the whole heap on every alloc and free (`next/prev/used` consistency).
|
||||
`rd.py` reads the log by attaching `winedbg` for a moment (stdin script `attach`/`x`/`detach`;
|
||||
works under ptrace_scope 1). `apptest.py` in the agent copy got an env switch
|
||||
`APPTEST_IGNORE_WINEDBG` so the short attach is not taken for a crash (not copied back).
|
||||
A gdb-over-winedbg monitor with breakpoints was too slow: the game froze.
|
||||
|
||||
Boot-to-level `start=29.5, 14, 23.2, 180 @ 5/3` (next to spawners #1 and #17), no input, 70–85 s:
|
||||
|
||||
| | runs | runs with a stale write | heap anomalies | crash |
|
||||
|---|---|---|---|---|
|
||||
| original WAD | 6 (1 manual + 5) | 5 | 0 | 0 |
|
||||
| level fix (below) | 3 | 0 | 0 | 0 |
|
||||
|
||||
Every stale record was the same and deterministic for this start (logged by the cave):
|
||||
`RollingBoulderForMountain` → parent `RollingBoulderMountain` (struct `+0xEC == 0`, removed), `v13`,
|
||||
target = `freed var block + 0x34`. At the time of the write this address was inside a **used
|
||||
16-dword block** (a `0x40000` collision block, most likely the next boulder's), at offset +0x40 from its
|
||||
header, which is 12 bytes before the next block header. In this layout it corrupts collision data
|
||||
(u16 fields `+0x34/+0x36` become 0xF000/0xFFFF), not the heap. Any other layout (other timing,
|
||||
other route, other spawns in between, e.g. an 11-dword allocation such as a `0x28000` pickup's
|
||||
collision block puts a remainder header's size/used word exactly there) turns the same write into
|
||||
header corruption. **Not verified:** a crash caused by this write. No natural run crashed, and the
|
||||
real runner route (from the chapter start at full speed, pushing #22/#47, then the race) could not
|
||||
be driven reliably by key scripts (the push needs speed and alignment; several attempts missed).
|
||||
Also seen in game: strat structs are recycled LIFO (the dead spawner's struct was later reused by a
|
||||
boulder).
|
||||
|
||||
Other checks in this WAD: every `collisionOn` user is spawned or placed with collision type flags
|
||||
(no `typeFlags 0 + collisionOn` case like in the arena), and all `extra` operands are 0. Other
|
||||
parent-variable writers (`KronkOnIcePickup` → `parent.v7`, `CheckPointHead`, `RubyIdolStatue`,
|
||||
`AxeGuardAxe`) have parents that do not end while they live, as far as the code shows. That was
|
||||
checked by reading the code only; the cave saw no stale access from them.
|
||||
|
||||
Side finding (not part of the crash): boot-to-level `start=28.5, 10.5, 22.5, 0 @ 5/3` passes the
|
||||
floor check, but the game crashes while loading (`page fault read 0x00000002 at 0x405527`, floor/
|
||||
tile lookup in `FUN_004054c0`). Out of scope here.
|
||||
|
||||
## Fix / avoidance
|
||||
|
||||
* **Level data (tested):** in `RollingBoulderMountain`, change `pushShort 0` before `eq` to
|
||||
`pushShort 0.5` (word `0x00000044` → `0x08000044`, the only match of the 6-word pattern
|
||||
`0x1002f 0xd0004 0x44 0x4e 0xfffc0012 0xb4`, file offset 0x4a0a27 in the German
|
||||
`t1l5m003.wad`). `v13` only takes whole numbers (0, -1, -2 …), so the spawner never ends. It
|
||||
stays frozen off camera and costs nothing, and every boulder writes into a live spawner. The
|
||||
boulders still roll (in-game: 6–7 normal parent writes per run, 0 stale). `notes/dev/mountain3-diag/wadfix.py IN OUT`.
|
||||
The English CD's WAD is not checked; the patch looks for the pattern and refuses if it isn't unique.
|
||||
* **Exe (general, untested):** let removal (`+0xE8 & 4` path) clear `+0xC` of all strats whose
|
||||
parent is the removed one (pool `DAT_006d9dc0`, stride 0x154), and let the parent opcodes
|
||||
redirect a NULL or removed parent to a dummy dword. This also covers similar bugs in other levels.
|
||||
* **Runners (hypothesis):** there's no reliable avoidance. The write happens when the boulders of
|
||||
#17 and #35 (spawned when you pass their trigger spots) and the pushed boulders #22 and #47 reach
|
||||
the end of their path. Not pushing #22/#47 removes two of the four guaranteed stale writes, if
|
||||
the route allows that.
|
||||
|
||||
Diag tooling notes: the files in `notes/dev/mountain3-diag/` are as used, with absolute paths
|
||||
of the agent job dir. The mod writes `addresses.txt` and expects `cave_<fix>_<CAVE>_<DATA>.bin`
|
||||
(`nasm -f bin -DCAVE=0x6ef0e0 -DDATA=0x70f010 -DFIX=0 cave.asm`; these addresses are valid with
|
||||
boot-to-level + mtn3-diag on the German exe). This is only for the German exe; nothing is registered in the app.
|
||||
|
||||
## Discord answer (draft)
|
||||
|
||||
> We looked into the Mountain 3 crash. Your dump crashes in the game's own memory manager
|
||||
> (`FreeLocalMem`, writing to 0x340d). That is the symptom: its bookkeeping was overwritten
|
||||
> earlier. **Verified:** in Mountain 3 the rolling-boulder spawner can delete itself while
|
||||
> its boulder is still rolling. When that boulder reaches the end of its path (or falls off), it
|
||||
> writes into the spawner's memory, which has already been freed and reused. We saw this
|
||||
> write in the game with a debug build, and a one-value level patch makes it go away.
|
||||
> **Not verified yet:** that this exact write causes your crash. We never got the game to
|
||||
> crash. Where the write lands depends on what else is in memory at that moment, so it
|
||||
> breaks things only sometimes, and the crash can come seconds later somewhere else
|
||||
> (e.g. in the Kronk race). That would explain why it's Mountain 3 only, at different spots,
|
||||
> without an error message, and "every so often" around boulders. The likely triggers are the
|
||||
> one-shot boulders near the start/top of the slope and the two red-X push boulders. We'll
|
||||
> probably ship the fix in LlamaMod.
|
||||
Reference in new issue
Block a user