CydandClaude Fable 5
e97862507c
The SegPhys-corrected dump read real code at last (the earlier zeros were the
probe reading EIP as a bare linear address; CS=00FF has a base):
66D4 push 0 / push edi / push ebx / push esi
66D9 call dword near [ebx+4] <- faults
66DC cmp eax,0 / jz done
66E5 mov ebx,[ebx] / jmp loop
A linked-list walk with a per-node callback -- node = {next@+0, handler@+4},
four args, "handled" on nonzero. A DPMI exception/interrupt handler chain.
The arithmetic closes exactly: the read is DS_base + ebx + 4, and
7000FA64 - F000CA64 = 80003000, so DS base is 0x80003000 and the famous cr2
is that wrap. My earlier '[EBX+0x3004]' reading was fabricated from the cr2
alone -- there is no 0x3004 displacement, which is why the constant appeared
in no binary.
So: a chain node's NEXT pointer holds F000CA60, the value parked in unhooked
IVT slots -- the walk expected a terminator and got an interrupt vector, then
read its +4 as a function pointer. Identical registers on every catch, so
one deterministic path, entered often enough that our 60s load window catches
it 25-40% of the time while shipped's 15s window mostly does not.
Open: which routine owns the chain, and where the bogus next came from. The
probe now walks the EBP frame chain to name the caller.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
57 lines
3.2 KiB
Plaintext
57 lines
3.2 KiB
Plaintext
LOG: Early LOG Init complete
|
|
LOG: CONFIG: Loaded config file: C:/VWE/TeslaRel410/emulator/render-bridge/pod_render_rec.conf
|
|
LOG: DOSBox-X's working directory: C:\VWE\TeslaRel410\emulator\src\src
|
|
LOG: Logging init: beginning logging proper. This is the end of the early init logging
|
|
LOG: Logging: No logfile was given. All further logging will be discarded.
|
|
LOG: DOSBox-X version 2026.06.02 Commit d75a57c (MinGW SDL2 64-bit)
|
|
LOG: Prevent capture: 0
|
|
LOG: SDL: version 2.32.10, Video windows, Audio directsound
|
|
LOG: EXPERIMENTAL: Debugger enabled for MinGW build, DOSBox-X crashes depending on the terminal software you use. Launching from command prompt (cmd.exe) is recommended.
|
|
LOG: Windows keyboard layout ID is 0x0409
|
|
LOG: Host keyboard layout is now us (US English)
|
|
LOG: Mapper keyboard layout is now us (US English)
|
|
LOG: SDL2 reports desktop display mode 3440 x 1440
|
|
LOG: OpenGL Version : 4.6.0 NVIDIA 610.47
|
|
LOG: Configured windowposition: -
|
|
LOG: SDL: Current window pixel format: SDL_PIXELFORMAT_RGB888
|
|
LOG: SDL: You are running in 24 bpp mode, this will slow down things!
|
|
LOG: Releasing keyboard
|
|
LOG: SDL: Windows 11 round corners will be disabled.
|
|
LOG: Screen report: Method 'Win98base' (3440.000 x 1440.000 pixels) at (0.000 x 0.000) (910.167 x 381.000 mm) (35.833 x 15.000 in) (96.000 x 96.000 DPI)
|
|
LOG: ISA BCLK: 8333333.333Hz (25000000/3)
|
|
LOG: monopal: green,
|
|
LOG: Active save slot: 1 [Empty]
|
|
LOG: USING AVI+ZMBV
|
|
LOG: Pentium CMPXCHG8B emulation is enabled
|
|
LOG: Max 1073741824 sz 32768
|
|
LOG: Final 32768
|
|
LOG: Final arrangement: Below 4GB = 32768KB, Above 4GB = 0KB
|
|
LOG: VPXLOG: fifosock listening on 127.0.0.1:8621
|
|
LOG: VPXLOG: live render backend started
|
|
LOG: VPXLOG: base 0x150 respond=1 handshakes=3 log='C:\Users\cyd\AppData\Local/Temp/vwe-pod/vpxresp.txt'
|
|
LOG: MIDI:Opened device:win32
|
|
LOG: mic_input: Selected microphone device: Microphone (Steam Streaming Microphone)
|
|
LOG: One joystick reported, initializing with 4axis
|
|
LOG: Using joystick Xbox One Controller with 6 axes, 16 buttons and 1 hat(s)
|
|
LOG: VOODOO LFB now at d0000000
|
|
LOG: Serial1: BASE 3f8h
|
|
LOG: Serial1: namedpipe client of \\.\pipe\vrio (poll 0.10ms burst x16)
|
|
LOG: Serial1: namedpipe connected to \\.\pipe\vrio
|
|
LOG: Serial2: BASE 2f8h
|
|
LOG: Serial2: namedpipe client of \\.\pipe\vplasma (poll 1.00ms burst x1)
|
|
LOG: Serial2: namedpipe connected to \\.\pipe\vplasma
|
|
LOG: Serial3: BASE 3e8h
|
|
LOG: Serial: port 3 will write to file C:\VWE\TeslaRel410\emulator\render-bridge\podlog.txt
|
|
LOG: Parallel1: BASE 378h
|
|
LOG: MPU-401 Registering I/O ports as if IBM PC MPU-401 at base 330h
|
|
LOG: Memory I/O complexity optimization enabled aka option 'memory io optimization 1'. If the game or demo is unable to draw to the screen properly, set the option to false.
|
|
LOG: The 'scanline render on demand' option is available and may provide a modest boost in video render performance if set to true.
|
|
LOG: Allocated APM BIOS pm entry point at f000:ce40
|
|
LOG: Writing code to fce40
|
|
LOG: Writing code to fce60
|
|
LOG: Windows: IID_ITaskbarList3 is available
|
|
LOG: ISA Plug & Play BIOS enabled
|
|
LOG: VGA ROM BIOS init callback
|
|
LOG: pixratio 1.000, dw false, dh false
|
|
LOG: Aspect ratio: 640 x 480 xToY=1.333 yToX=0.750
|