fabi/Syplheed-Reborn
Archived
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

re: freeze frontier — wait confirmed by ordinal, but info args will not work here

Browse Source 
Two corrections to the plan the freeze file leaves for the next pass, both cheap
to establish and both worth having before a run is spent discovering them.

The export in the frozen frame is confirmed. The shim frame carries its ordinal
as a template parameter, 176 decimal, which is 0xB0, and xboxkrnl_table.inc line
190 maps that to KeWaitForSingleObject. The identification was previously read
off frame names; it is now pinned by ordinal.

The file's stated next step does not work on this binary. It says the wait
target is one info-args-equivalent away now that a debugger can be attached, but
readelf shows zero debug sections and only a symtab of 27807 entries. The
Release build is not stripped, which is why frames carry function names, but it
has no debug info at all, so gdb can name a frame and nothing inside it: no info
args, no p *this, no member access. The earlier note conflated "not stripped"
with "has debug info".

Two routes remain and their costs are now recorded. A prologue-guided stack read
can recover XObject::Wait's spilled this pointer from a known stack slot, needing
no rebuild and keeping the oracle byte-identical to the one every other
measurement in this corpus used, at the price of per-frame archaeology that must
be redone if the binary changes. Alternatively a RelWithDebInfo build via
build-canary makes this and every future freeze question straightforward, at the
price of a full compile and a binary that differs from the measured one.

Neither is attempted here. Recorded so the next pass picks with the costs
visible.
This commit is contained in:
Sylpheed RE agent
2026-08-25 07:36:56 +00:00
parent eb7cedb13e
commit 0120677722
2 changed files with 69 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
docs/re/BACKLOG.md
View File

@@ -696,6 +696,18 @@ search cannot find a *schedule*.
nothing. ✅ **Fixed: `INDEX.md` now has a generated table of all 59 notes** with
title + status and says to search it before starting. Regenerate when notes are
added.
* ✅🔴 **(2026-08-25) Freeze frontier: wait confirmed, but `info args` won't work.**
✅ **Verified** the frozen frame's export by ordinal: the shim's
`(unsigned short)176` = `0xB0` = **`KeWaitForSingleObject`**
(`xboxkrnl_table.inc:190`) — previously read off frame names, now pinned.
🔴 **Corrected:** the doc's "the handle is one `info args` away" is wrong for
this binary — `readelf` shows **0 debug sections**, symtab only (27 807 entries).
Not stripped ≠ has debug info; gdb can name frames and nothing inside them.
**Two routes, costs recorded:** (1) prologue-guided stack read of `XObject::Wait`'s
spilled `this` — no rebuild, keeps the oracle identical, but per-frame
archaeology; (2) a `RelWithDebInfo` build via `build-canary` — makes this and all
future freeze questions easy, at a full compile and a binary differing from the
one every other measurement used.
* ~~🚧 BLOCKER: t=210/240 unreachable in one turn~~ — **superseded, see above**;
it rested on an untested assumption that a turn is one shell call. 595 s shell cap − ~220 s boot (a ~190 s title movie that cannot be
tapped through) − ~25 s startup = **~350 s observation ≈ 193 game-seconds**.