mountain 3 crash: rollingbouldermountain spawners end while their boulders still write parent.v13 (use after free), seen in game, one-word level fix tested; diag tooling in notes/dev

notes/dev/mountain3-diag/Mtn3DiagMod.java

@@ -0,0 +1,44 @@
+package mtn3;
+
+import com.eliasmueller.llamamod.exe.ExeImage;
+import com.eliasmueller.llamamod.mods.Mod;
+import com.eliasmueller.llamamod.mods.ModContext;
+import com.eliasmueller.llamamod.mods.ModOption;
+import java.io.IOException;
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.util.List;
+
+/** Throwaway diagnostics: stale parent-variable access log + local heap consistency check. */
+public final class Mtn3DiagMod implements Mod {
+    static final Path DIR = Path.of("/home/elias/.claude/jobs/90c6eed7/tmp/m3/diag");
+
+    public String id() { return "mtn3-diag"; }
+    public String name() { return "Mountain 3 diagnostics"; }
+    public String description() { return "Logs stale parent writes and checks the local heap (test only)."; }
+    public boolean modifiesExecutable() { return true; }
+    public List<ModOption> options() {
+        return List.of(ModOption.bool("fix", "Fix", "Redirect stale parent writes to a dummy", false),
+                ModOption.string("rev", "Rev", "cache buster", "1"));
+    }
+
+    public void apply(ModContext ctx) throws IOException {
+        ExeImage exe = ctx.exe();
+        long data = exe.allocateData(8192, "mtn3 diag data");
+        long cave = exe.nextAllocation();
+        String fix = ctx.optionBool("fix") ? "1" : "0";
+        Path bin = DIR.resolve(String.format("cave_%s_%x_%x.bin", fix, cave, data));
+        Files.writeString(DIR.resolve("addresses.txt"), String.format("CAVE=0x%x DATA=0x%x FIX=%s%n", cave, data, fix));
+        if (!Files.exists(bin)) {
+            throw new IOException("assemble " + bin);
+        }
+        long at = exe.place(Files.readAllBytes(bin), "mtn3 diag code");
+        if (at != cave) {
+            throw new IOException("cave moved " + Long.toHexString(at));
+        }
+        exe.hookJmp(0x553770, "8B 44 24 04 8B", cave, "pushParentVarAddr");
+        exe.hookJmp(0x553a40, "56 8B 74 24 08", cave + 5, "popParentVar");
+        exe.hookJmp(0x41ada0, "8B 44 24 04 56", cave + 10, "FreeLocalMem");
+        exe.hookJmp(0x41ae20, "8B 0D 9C 49 58 00", cave + 15, "AllocLocalMem");
+    }
+}

notes/dev/mountain3-diag/cave.asm

@@ -0,0 +1,285 @@
+; Mountain 3 crash diagnostics (German groove.exe). nasm -f bin -DCAVE=.. -DDATA=.. -DFIX=0/1
+bits 32
+org CAVE
+%define D(o) dword [DATA+o]
+; DATA layout: 0 magic, 16 cnt_parent_ok, 20 cnt_stale_addr, 24 cnt_stale_pop, 28 cnt_free, 32 cnt_anom,
+; 36 cnt_alloc, 40 stale ring idx, 44 all ring idx, 48 dummy, 52 last free ptr, 56 last alloc size, 60 tmp idx,
+; 64 stale ring 32x32, 1088 anomaly record 64 bytes, 1152 dump 256 bytes (hdr-128..+128), 1408 all-ring 64x32 (2048)
+; 3456 free history 64 x 16
+entry_addr:  jmp near push_addr
+entry_pop:   jmp near pop_var
+entry_free:  jmp near free_hook
+entry_alloc: jmp near alloc_hook
+
+push_addr:
+    mov eax,[esp+4]
+    mov ecx,[eax+0xc]
+    mov edx,[esp+8]
+    mov [DATA+60],edx
+    mov edx,0x11
+    call record_all
+    test ecx,ecx
+    jz .stale
+    cmp dword [ecx+0xec],0
+    jz .stale
+    inc D(16)
+.ok:
+    mov edx,[ecx+0xf4]
+    mov ecx,[esp+8]
+    lea edx,[edx+ecx*4]
+.push:
+    push edx
+    push eax
+    call 0x54bbd0
+    add esp,8
+    ret
+.stale:
+    inc D(20)
+    mov edx,1
+    call record
+    call stale_info
+    call check_heap
+%if FIX
+    mov edx,DATA+48
+    jmp .push
+%else
+    test ecx,ecx
+    jnz .ok
+    mov edx,DATA+48
+    jmp .push
+%endif
+
+pop_var:
+    push esi
+    mov esi,[esp+8]
+    push esi
+    call 0x54bc00
+    add esp,4
+    mov ecx,[esi+0xc]
+    mov edx,[esp+0xc]
+    mov [DATA+60],edx
+    push eax
+    mov eax,esi
+    mov edx,0x12
+    call record_all
+    pop eax
+    test ecx,ecx
+    jz .stale
+    cmp dword [ecx+0xec],0
+    jz .stale
+    inc D(16)
+.ok:
+    mov edx,[ecx+0xf4]
+    mov ecx,[esp+0xc]
+    lea edx,[edx+ecx*4]
+.store:
+    pop esi
+    mov [edx],eax
+    ret
+.stale:
+    inc D(24)
+    push eax
+    mov eax,esi
+    mov edx,2
+    call record
+    call stale_info
+    call check_heap
+    pop eax
+%if FIX
+    mov edx,DATA+48
+    jmp .store
+%else
+    test ecx,ecx
+    jnz .ok
+    mov edx,DATA+48
+    jmp .store
+%endif
+
+; record: eax strat, ecx parent, edx kind, [DATA+60] idx. Preserves eax, ecx.
+record:
+    push esi
+    push edi
+    push ebx
+    mov esi,[DATA+40]
+    and esi,31
+    shl esi,5
+    lea edi,[DATA+64+esi]
+    jmp rec_common
+record_all:
+    push esi
+    push edi
+    push ebx
+    mov esi,[DATA+44]
+    and esi,63
+    shl esi,5
+    lea edi,[DATA+1408+esi]
+    inc D(44)
+    dec D(40)          ; compensated below
+rec_common:
+    inc D(40)
+    mov [edi],eax
+    mov [edi+4],ecx
+    mov [edi+8],edx
+    mov ebx,[DATA+60]
+    mov [edi+12],ebx
+    mov ebx,[eax+0x18]
+    mov [edi+16],ebx
+    mov dword [edi+20],0
+    mov dword [edi+24],0
+    mov dword [edi+28],0
+    test ecx,ecx
+    jz .np
+    mov ebx,[ecx+0x18]
+    mov [edi+20],ebx
+    mov ebx,[ecx+0xf4]
+    mov [edi+24],ebx
+    mov ebx,[ecx+0xec]
+    mov [edi+28],ebx
+.np:
+    pop ebx
+    pop edi
+    pop esi
+    ret
+
+free_hook:
+    pushad
+    inc D(28)
+    mov eax,[esp+36]
+    mov [DATA+52],eax
+    mov esi,[DATA+28]
+    and esi,63
+    shl esi,4
+    mov [DATA+3456+esi],eax
+    mov ebx,[esp+32]           ; caller
+    mov [DATA+3456+esi+4],ebx
+    mov ebx,[eax-4]            ; size|used
+    mov [DATA+3456+esi+8],ebx
+    mov ebx,[eax-12]           ; next
+    mov [DATA+3456+esi+12],ebx
+    call check_heap
+    popad
+    mov eax,[esp+4]
+    push esi
+    jmp 0x41ada5
+
+alloc_hook:
+    pushad
+    inc D(36)
+    mov eax,[esp+36]
+    mov [DATA+56],eax
+    call check_heap
+    popad
+    mov ecx,[0x58499c]
+    jmp 0x41ae26
+
+; walks the local heap; on the first inconsistency records it (code in anomaly+0)
+check_heap:
+    pushad
+    mov esi,[0x58499c]
+    test esi,esi
+    jz .done
+    xor edi,edi
+    mov ecx,70000
+.loop:
+    mov edx,1
+    cmp [esi+4],edi
+    jne .bad
+    mov edx,2
+    movzx eax,word [esi+10]
+    cmp eax,1
+    ja .bad
+    mov ebx,[esi]
+    test ebx,ebx
+    jz .done
+    mov edx,3
+    movzx eax,word [esi+8]
+    lea eax,[esi+eax*4+12]
+    cmp ebx,eax
+    jne .bad
+    mov edi,esi
+    mov esi,ebx
+    dec ecx
+    jnz .loop
+.done:
+    popad
+    ret
+.bad:
+    inc D(32)
+    cmp dword [DATA+32],1
+    jne .done
+    mov [DATA+1088],edx
+    mov [DATA+1092],esi
+    mov [DATA+1096],edi
+    mov eax,[esi]
+    mov [DATA+1100],eax
+    mov eax,[esi+4]
+    mov [DATA+1104],eax
+    mov eax,[esi+8]
+    mov [DATA+1108],eax
+    mov eax,[DATA+28]
+    mov [DATA+1112],eax
+    mov eax,[DATA+36]
+    mov [DATA+1116],eax
+    mov eax,[DATA+40]
+    mov [DATA+1120],eax
+    mov eax,[esp+32]          ; return address of check_heap caller
+    mov [DATA+1124],eax
+    mov eax,[DATA+52]
+    mov [DATA+1128],eax
+    mov eax,[DATA+56]
+    mov [DATA+1132],eax
+    ; dump 256 bytes from edi (previous header) if set, else esi-128
+    test edi,edi
+    jnz .src
+    lea edi,[esi-128]
+.src:
+    mov esi,edi
+    lea edi,[DATA+1152]
+    mov ecx,64
+    rep movsd
+    jmp .done
+
+; stale_info: ecx parent, [DATA+60] idx -> DATA+4480 + (n&31)*16: target, block hdr, size|used, value before
+stale_info:
+    pushad
+    test ecx,ecx
+    jz .out
+    mov edi,[ecx+0xf4]
+    mov eax,[DATA+60]
+    lea edi,[edi+eax*4]
+    mov ebx,[DATA+40]
+    dec ebx
+    and ebx,31
+    shl ebx,4
+    lea ebx,[DATA+4480+ebx]
+    mov [ebx],edi
+    mov eax,[edi]
+    mov [ebx+12],eax
+    mov dword [ebx+4],0
+    mov dword [ebx+8],0
+    mov esi,[0x58499c]
+    mov ecx,70000
+.l:
+    test esi,esi
+    jz .out
+    mov edx,[esi]
+    test edx,edx
+    jnz .h
+    movzx eax,word [esi+8]
+    lea edx,[esi+eax*4+12]
+.h:
+    cmp edi,esi
+    jb .next
+    cmp edi,edx
+    jae .next
+    mov [ebx+4],esi
+    mov eax,[esi+8]
+    mov [ebx+8],eax
+    jmp .out
+.next:
+    mov esi,[esi]
+    dec ecx
+    jnz .l
+.out:
+    popad
+    ret

notes/dev/mountain3-diag/rd.py

@@ -0,0 +1,54 @@
+#!/usr/bin/env python3
+"""rd.py SESSION : attach briefly with winedbg, dump diag data, print summary"""
+import os, re, subprocess, sys, struct
+S = sys.argv[1]; DATA = 0x70f010; N = 4992
+env = dict(os.environ, WINEPREFIX='/home/elias/.claude/jobs/90c6eed7/tmp/%s/data/wine' % S, WINEDEBUG='-all')
+def dbg(cmds):
+    out = subprocess.run(['winedbg'], input='\n'.join(cmds) + '\ndetach\nquit\n', env=env, capture_output=True, text=True, timeout=60).stdout
+    return out
+pl = dbg(['info proc'])
+m = re.search(r'([0-9a-f]{8})\s+\d+\s+\\_ \'groove.exe\'', pl)
+if not m: print('no groove.exe'); sys.exit(1)
+pid = m.group(1)
+out = dbg(['attach 0x' + pid, 'x/%dx 0x%x' % (N // 4, DATA), 'x/16x 0x58499c'])
+words = {}
+for l in out.splitlines():
+    mm = re.match(r'.*?0x([0-9a-f]{8}):\s+((?:[0-9a-f]{8}\s*)+)$', l)
+    if mm:
+        a = int(mm.group(1), 16)
+        for i, w in enumerate(mm.group(2).split()): words[a + 4 * i] = int(w, 16)
+def W(o): return words.get(DATA + o, 0)
+names = set()
+for base, cnt in ((64, 32), (1408, 64)):
+    for i in range(cnt):
+        e = DATA + base + 32 * i
+        for k in (16, 20):
+            if words.get(e + k): names.add(words[e + k])
+nm = {}
+if names:
+    o2 = dbg(['attach 0x' + pid] + ['x/s 0x%x' % a for a in sorted(names)])
+    ss = [l for l in o2.splitlines() if l.startswith('Wine-dbg>') and '"' not in l or True]
+    segs = o2.split('Wine-dbg>')
+    for i, a in enumerate(sorted(names)):
+        nm[a] = segs[2 + i].strip() if 2 + i < len(segs) else hex(a)
+print('parent_ok=%d stale_addr=%d stale_pop=%d free=%d alloc=%d anomalies=%d staleidx=%d allidx=%d' % (W(16), W(20), W(24), W(28), W(36), W(32), W(40), W(44)))
+def ring(base, cnt, idx, label, last=12):
+    print('--', label)
+    n = min(idx, cnt)
+    for j in range(max(0, idx - last), idx):
+        e = base + 32 * (j % cnt)
+        s, p, k, vi, sn, pn, pv, pec = (W(e + 4 * q) for q in range(8))
+        print('  #%d kind=%x strat=%x(%s) parent=%x(%s) v%d parentvars=%x parent_ec=%x target=%x' % (j, k, s, nm.get(sn, '-'), p, nm.get(pn, '-'), vi, pv, pec, pv + 4 * vi))
+ring(64, 32, W(40), 'stale', 32)
+for j in range(max(0, W(40) - 32), W(40)):
+    e = 4480 + 16 * (j % 32); t, h, su, v = (W(e + 4 * q) for q in range(4))
+    print('  stale#%d target=%x block=%x off=+0x%x %s size=%d value_before=%x%s' % (j, t, h, t - h if h else 0, 'USED' if su >> 16 else 'FREE', su & 0xffff, v, '  <<< HEADER HIT' if h and t - h < 12 else ''))
+ring(1408, 64, W(44), 'all parent accesses (last 16)', 16)
+if W(32):
+    print('ANOMALY code=%d hdr=%x prevhdr=%x hdr.next=%x hdr.prev=%x sizeused=%x frees=%d allocs=%d staleidx=%d caller=%x lastfree=%x lastalloc=%d' % tuple(W(1088 + 4 * q) for q in range(12)))
+    d = [W(1152 + 4 * q) for q in range(64)]
+    for q in range(0, 64, 8): print('   ' + ' '.join('%08x' % x for x in d[q:q + 8]))
+fh = [(W(3456 + 16 * q), W(3456 + 16 * q + 4), W(3456 + 16 * q + 8), W(3456 + 16 * q + 12)) for q in range(64)]
+print('heapbase', hex(words.get(0x58499c, 0)))
+if '-f' in sys.argv:
+    for q in range(64): print('  free ptr=%x caller=%x sizeused=%x next=%x' % fh[q])

notes/dev/mountain3-diag/wadfix.py

@@ -0,0 +1,10 @@
+#!/usr/bin/env python3
+"""wadfix.py IN OUT: RollingBoulderMountain never ends (its final 'wait until v13 == 0' compares with 0.5)."""
+import struct, sys
+d = bytearray(open(sys.argv[1], 'rb').read())
+pat = struct.pack('<6I', 0x1002f, 0xd0004, 0x44, 0x4e, 0xfffc0012, 0xb4)  # freezeOffCamera 1; v13; pushShort 0; eq; jzYield -4; end
+i = d.find(pat)
+assert i >= 0 and d.find(pat, i + 1) < 0, 'pattern not unique'
+struct.pack_into('<I', d, i + 8, 0x08000044)  # pushShort 0.5
+open(sys.argv[2], 'wb').write(d)
+print('patched at 0x%x' % (i + 8))