CydandClaude Opus 5
6467a5f930
The podium crash dies in SocketIterator::DeletePlugs, calling through a segment whose vtable dword has been replaced by a small float. The three dumps prove the segment is wrong BY teardown; nothing in them says when it went wrong, and six configurations of the local repro rig - parked pods, driven pods, light and full page heap, two, four and six pods - reached the podium and tore down clean. So the next real playtest becomes the instrument. RP412SEGCHECK walks the segment table in ~JointedMover before the delete, guarded-reads each segment's first dword, and if one does not match the vtable captured from the very first segment ever built it writes the forensics into rpl4-fail.log, which is closed on the way down and survives the abort - rpl4.log does not. The report carries the entity and whether it was the local pod, which index went bad and what is in it, the first two rows of the object as hex and float, and the heap deltas to its neighbours on either side. Three bracket calls in the winners' circle answer the question the dumps cannot: at podium entry, and either side of the second MakeEntityRenderables on the own pod. Whichever fires first is recorded and travels inside the teardown report, so the log says whether the race broke the segment or the podium did. It deliberately does not skip the delete or repair the pointer. The ownership bug is unfixed and a guard would cost exactly the evidence this is here to collect - it stops on the same object, one step earlier, holding the forensics. On by default, a handful of pointer compares per pod per race; RP412SEGCHECK=0 turns it off, and the environ.ini template says so. tools/podium-repro is the rig itself, banked with what the dumps already established: page heap turned on through the PEB without gflags or elevation, N sandboxed installs, and a feeder that drives full races through them. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
30 lines
976 B
Plaintext
30 lines
976 B
Plaintext
$$ Variant of cdbrun.txt for use WITH `gflags -i rpl4opt.exe +hpa`.
|
|
$$
|
|
$$ No PEB write here: gflags has already put page heap settings in the
|
|
$$ registry (IFEO), and ntdll applies them during process init. Writing
|
|
$$ NtGlobalFlag on top would only muddy which mode is actually in force -
|
|
$$ and the whole point of this variant is to read that off the log
|
|
$$ cleanly. Watch the "page heap enabled with flags 0x..." line: it should
|
|
$$ differ from the 0x2 the PEB trick produces.
|
|
g
|
|
.echo === HEAP CHECK: compare the "page heap enabled with flags" value above ===
|
|
g
|
|
.echo === POD BREAK ===
|
|
.symfix+ C:\Users\cyd\AppData\Local\Temp\claude\sym
|
|
.reload
|
|
r
|
|
.exr -1
|
|
kb 30
|
|
.echo === HEAP FORENSICS eax ===
|
|
!ext.heap -p -a @eax
|
|
.echo === HEAP FORENSICS ecx ===
|
|
!ext.heap -p -a @ecx
|
|
.echo === HEAP FORENSICS edx ===
|
|
!ext.heap -p -a @edx
|
|
.echo === HEAP FORENSICS edi (overrun culprit is often the base) ===
|
|
!ext.heap -p -a @edi
|
|
.dump /ma /u podbreak.dmp
|
|
.echo === DUMP WRITTEN ===
|
|
~*kb 8
|
|
q
|