re: the JIT context is in %rsi; but the re-run could not locate the mission

From Canary's own source (x64_emitter.cc:881) GetContextReg() returns rsi, so at
any JIT instruction %rsi is the PPCContext* -- which is also why the faulting
instruction read 0x110(%rsi), a guest register load. That is the way past the
watchpoint's ceiling: the guest register file is available at the write, and a
0x82xxxxxx word picked out of it resolves against sylpheed.db to name the caller.
trigger_watch.sh now dumps x/128wx  instead of a useless host backtrace.

The re-run then failed for an unrelated and unexplained reason: it reached
flight, the pilot bound, the guest was animating, and find_mission returned
NOTFOUND. Narrowed: the .ssb header is absent from guest memory (0 hits where
earlier runs hit immediately), ADN110 is absent too, but the manifest string
'Stage02.ssb' IS present at 0xBDA6C50B. So memory is readable and the manifest
is loaded while the script is not, in a mission that is flying.

No explanation offered. The cheap discriminator for next time is to poll for the
header from the moment flight starts and record when it appears, instead of
sampling once.
This commit is contained in:
Sylpheed RE agent
2026-08-25 19:03:33 +00:00
parent c50ab7275f
commit 761dcd004c
2 changed files with 54 additions and 1 deletions

View File

@@ -44,7 +44,16 @@ kill -INT "$pid"; sleepfor 3
echo "--- watching ${WATCH_S}s"
sleepfor "$WATCH_S"
kill -INT "$pid"; sleepfor 3
{ echo 'echo === WHO WROTE IT ===\n'; echo 'bt 8'; echo 'x/3i $pc'
# The host stack is useless here: the write happens in JIT-compiled guest code,
# which is unsymbolised and not host-unwindable. But Xenia's x64 backend keeps
# the guest context in %rsi (x64_emitter.cc: `GetContextReg() { return rsi; }`),
# so the guest register file is right there. Dump it and pick out the words that
# look like guest code addresses (0x82xxxxxx) -- the guest LR is among them, and
# that names the calling guest function.
{ echo 'echo === WHO WROTE IT ===\n'; echo 'x/3i $pc'
echo 'info registers rsi rdi'
echo 'echo === GUEST CONTEXT ===\n'
echo 'x/128wx $rsi'
echo 'echo === END ===\n'; echo 'delete'; echo 'continue'; } >> "$CMD"
sleepfor 10
tail -c +$((before + 1)) "$OUT" | grep -vE '^\s*$' | tail -60