muskit/spice2x.github.io
0
0
Fork 0
mirror of https://github.com/spice2x/spice2x.github.io.git synced 2026-08-02 06:40:42 -07:00
Code Issues Packages Projects Releases Wiki Activity

iidx, sdvx: bi2x hook fix (#496)

Browse Source 
## Link to GitHub Issue, if one exists
n/a

## Description of change
Both games take the address returned by `aioNMgrIob2_Create` and reads
values offset from that address as part of the I/O routine. This means
that the I/O routines of these games have been accessing random
variables in data/bss segments for years, they just happened to get a
value that doesn't lead to a crash.

Stumbled upon this while trying to add a new feature that required
adding more globals, but suddenly the game stopped polling I/O when I
changed a value of my global. Scary.

## Testing
Tested both games I/O
This commit is contained in:
bicarus
2026-01-03 19:27:53 -08:00
committed by GitHub
parent 7e89037db3
commit bf7666939a
2 changed files with 35 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/spice2x/games/iidx/bi2x_hook.cpp
+18 -6
View File
@@ -30,6 +30,14 @@ namespace games::iidx {
uint8_t dummy1[0x9A0];
};
// add padding before and after as the game will try to deref an offset
// from the address returned by aioNMgrIob2_Create
struct AIO_NMGR_IOB2_PTR {
uint8_t dummy0[0x100];
AIO_NMGR_IOB2 *iob2;
uint8_t dummy1[0x400 - sizeof(AIO_NMGR_IOB2 *)];
};
struct AIO_IOB2_BI2X_TDJ {
// who knows
uint8_t data[0x13F8];
@@ -112,7 +120,7 @@ namespace games::iidx {
AIO_IOB2_BI2X_TDJ *custom_node = nullptr;
AC_HNDLIF *acHndlif = nullptr;
AIO_NMGR_IOB2 *aioNmgrIob2 = nullptr;
AIO_NMGR_IOB2_PTR *aioNmgrIob2 = nullptr;
/*
* implementations
@@ -458,12 +466,16 @@ namespace games::iidx {
static AIO_NMGR_IOB2** __fastcall aioNMgrIob2_Create(AC_HNDLIF *a1, unsigned int a2) {
if (aioNmgrIob2 == nullptr) {
aioNmgrIob2 = new AIO_NMGR_IOB2;
memset(aioNmgrIob2, 0x0, sizeof(AIO_NMGR_IOB2));
aioNmgrIob2->pAIO_NMGR_IOB_BeginManage = AIO_NMGR_IOB_BeginManageStub;
aioNmgrIob2 = new AIO_NMGR_IOB2_PTR{};
aioNmgrIob2->iob2 = new AIO_NMGR_IOB2{};
aioNmgrIob2->iob2->pAIO_NMGR_IOB_BeginManage = AIO_NMGR_IOB_BeginManageStub;
}
log_info("bi2x_hook", "aioNMgrIob2_Create");
return &aioNmgrIob2;
log_info("bi2x_hook", "aioNMgrIob2_Create returned {}, padded size=0x{:x}, IOB2 @ {}, size=0x{:x}",
fmt::ptr(&aioNmgrIob2->iob2), sizeof(*aioNmgrIob2),
fmt::ptr(aioNmgrIob2->iob2), sizeof(*aioNmgrIob2->iob2));
return &aioNmgrIob2->iob2;
}
static int64_t __fastcall aioIob2Bi2x_WriteFirmGetState(int64_t a1) {