Adds AUDIT-HLC probes for every path that signals an XEvent or duplicates
its handle, so the round-23 puzzle (waits completing without visible
NtSetEvent/KeSetEvent) can be cross-referenced by underlying X_KEVENT VA
and by primary handle.
* NtCreateEvent_inner: always log kevent_va for handle/VA cross-ref
* XEvent::Set: universal hook prints primary handle + kevent_va + LR;
catches all paths into the event regardless of shim used
* NtSetEvent: extended with PPC back-chain walk for caller's guest_lr
(same idiom as the wait probe), so the signaler function is
immediately identifiable
* NtReadFile / NtReadFileScatter / NtWriteFile: log when signal_event
path fires ev->Set() inline at IO completion (bypasses both
NtSetEvent and KeSetEvent shims)
* CompleteOverlappedEx (kernel_state.cc): log when overlapped event
is signaled at completion
* NtDuplicateObject: log src/dst handle pair (round-24 confirmed silph
event is dup'd before signaling, explaining the handle-mismatch
puzzle between NtSetEvent's `handle=` argument and XEvent::Set's
primary handle())
Result: silph wait at sub_821CB030+0x1B0 on handle F80000A0 is signaled
via NtSetEvent on handle F80000A8 (the duplicate created by sub_8245D9D8
at lr=0x82450DF4 inside the worker chain sub_82450A28 ← 0xA68 ← 0xB68).
Verdict A confirmed: signaler exists and is reachable, but round-17.β
missed it because the search keyed on the wrong handle. No bypass path;
the worker chain is identical between canary and ours-impl, but ours
signals different handles (work-item queue divergence at sub_82452DC0).
Audit-only diagnostic. No semantic changes. Net delta +86 LOC across 7
files. All probes gated on the existing audit_handle_lifecycle cvar
(default off). Tested via Sylpheed boot (35 s, 4 MB log). Audit-handle-
lifecycle-probes branch, local-only.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Some games persist BGM volume through their own save files but never
call XMPSetVolume. Add a TitlePatch system that intercepts NtReadFile/
NtWriteFile to apply game-specific logic as well as logic to identify
the memory location that the volume data is read into and monitor that
memory location for changes, updating XMP player volume if it changes
during gameplay.
Includes patches for known games with this issue:
Dead or Alive Xtreme 2 (544307D2), PGR4 (4D5307F9) and PGR3 (4D5307D1)
Stub XamVoiceSubmitPacket
Stubs for __CAP_Start_Profiling/End_Profiling/Enter_Function/Exit_Function
add a note about io_status_block in NtDeviceIoControlFile, change the param's type
move the X_IOCTL_ constants from NtDeviceIoControlFile's body into xbox.h
add X_STATUS_INVALID_IMAGE_FORMAT to xbox.h
Implement XexLoadImageHeaders
Much more correct version of IoCreateDevice, properly initializes/allocates device extension data
Stub version of IoDeleteDevice
Open the quickstart guide in the browser the first time a user opens the emulator
Add some persistent flags that are stored in the registry on windows, not in the config. These are just used to indicate whether one-time tasks have run, like showing the quickstart guide. On non-windows platforms a default value is returned that skips any of these tasks so they don't run every single time.
If the user opens a .iso file, show a warning telling them that we do not condone or support piracy. If the user closes the messagebox within two seconds set a sticky flag that will show them the warning every time instead. Otherwise the warning is never shown again. The Beep function is used to spook them a bit, to hopefully make them less likely to skip the message
If a user opens an archive file, which we do not support, explain to them that they're dumb.
Removed messages intended to "catch" pirates. If they're out there, we don't want to know about them. A huge chunk of the discourse on our discord is now about piracy. Hopefully these changes will deter them from coming to us for now, but some of these messages may backfire
XMountUtilityDrive-related code checks some values returned from NtDeviceIoControlFile, stub just returns values that it seems to accept
IoCreateDevice is also used by utility-drive code, writing some values into a pointer returned by it, so stub allocs space so it can write to the pointer without errors.
[VFS] Device now exposes name, attributes, component name max length.
[VFS] Fix STFS device to return 0x200 sector size. XCTD compression
userland code appears to always expect a sector size of 0x200.
[Kernel] Move X_FILE_*_INFORMATION structs to new files.
[Kernel] Move NtQueryInformationFile, NtSetInformationFile,
NtQueryVolumeInformationFile to new file.
[Kernel] Cleanup implementation of NtQueryInformationFile,
NetSetInformationFile, NtQueryVolumeInformationFile.
[Kernel] Properly validate arguments to NtQueryInformationFile,
NetSetInformationFile, NtQueryVolumeInformationFile.
[Kernel] Properly implement query of XFileFsVolumeInformation.
[Kernel] Properly implement query of XFileFsSizeInformation.
[Kernel] Properly implement query of XFileFsAttributeInformation.
[VFS] Allow specifying root entry to open from with OpenFile.
[Kernel] NtCreateFile now opens from root entry when available instead
of needlessly building a full path and resolving from that.
[VFS] Reduce code duplication by adding Entry::ResolvePath.
[VFS] Remove ResolveBasePath to avoid multiple calls to find_base_guest_path.
C++17ification!
- Filesystem interaction now uses std::filesystem::path.
- Usage of const char*, std::string have been changed to
std::string_view where appropriate.
- Usage of printf-style functions changed to use fmt.
Games like Forza use NtQueryInformationFile to get the size of the file, to make sure that there's enough room inside it to write data.
Previously, updating the file size (via SetInfoFile(EndOfFile) or WriteFile) wouldn't update the vfs::Entry size field, which NtQueryInfo uses to return the size of the file.
This resulted in the game thinking that the file was smaller than it actually is, and trying to correct that by using SetInfoFile(EndOfFile), which then truncated the file and deleted important data that was written to it.
- Convert http to https, provide archive link when possible.
- Made CPU-JIT.png more readable on dark themes;
Added a white background so there isn't black text on a black
background.
