From e6467c4dff27fedf42eeba45d47fdade44ee2445 Mon Sep 17 00:00:00 2001
From: TideOPL <obinewman101@gmail.com>
Date: Wed, 7 Oct 2026 13:24:26 +0100
Subject: [PATCH] fix(relinker): find Windows guest TLS accesses in code no
 root reaches

The Windows TLS rewriter only patches instructions that
CodeInstructionCollector finds: symbol and unwind function ranges, plus
the code their branches, relocated pointers and initializers reach. A
fixed-address executable (ET_SCE_EXEC) has no relocations for function
pointers held in data, such as vtables or a thread entry loaded with
LEA, and its unwind tables need not cover every function. TLS accesses
in that code stayed `mov reg, fs:[0]`, which reads address 0 on Windows.

PPSA16064 (Minecraft Dungeons II, Unreal Engine) has 3689 such loads in
its executable segment; 478 were left unpatched, and its worker threads
faulted on their first TLS access at start-up.

The collector now also sweeps each executable segment linearly from the
first address that int3 padding precedes on a 16-byte boundary, and adds
every FS-prefixed instruction with an absolute disp32 operand as a root.
The sweep resynchronizes at the next padded 16-byte boundary when an
instruction does not decode, crosses such a boundary or starts with two
zero bytes, so zero-filled or undecodable bytes are not read as code.
The rewriter's own checks still decide which forms it can patch.

With this, all 3689 loads in PPSA16064 are patched. New cases in
tls_function_coverage: a padded function nothing references is patched,
and the same load behind zero fill after padding is left unchanged.
---
 .../src/analysis/CodeInstructionCollector.cpp | 38 +++++++++++++++++++
 .../tests/test_tls_function_coverage.py       | 22 +++++++++++
 2 files changed, 60 insertions(+)

diff --git a/core/relinker/relinker/src/analysis/CodeInstructionCollector.cpp b/core/relinker/relinker/src/analysis/CodeInstructionCollector.cpp
index e065dc76e..0e2f7329f 100644
--- a/core/relinker/relinker/src/analysis/CodeInstructionCollector.cpp
+++ b/core/relinker/relinker/src/analysis/CodeInstructionCollector.cpp
@@ -209,6 +209,44 @@ std::set<Domain::VirtualAddress> CodeInstructionCollector::Collect(const std::ve
             address += info.Length;
         }
     }
+    for (const auto& header : headers) {
+        if (header.Type != 1 || (header.Flags & 1) == 0 || header.FileSize < 16) continue;
+        range(header.Offset, header.FileSize);
+        const auto* text = bytes.data() + header.Offset;
+        const auto size = static_cast<std::size_t>(header.FileSize);
+        const auto paddedStart = [&](std::size_t address) { return address % 16 == 0 && address >= 2 && text[address - 1] == 0xcc && text[address - 2] == 0xcc; };
+        const auto nextPaddedStart = [&](std::size_t address) {
+            address = (address + 16) & ~std::size_t{15};
+            while (address < size && !paddedStart(address)) address += 16;
+            return address;
+        };
+        for (std::size_t position = nextPaddedStart(0); position < size;) {
+            if (position + 1 < size && text[position] == 0 && text[position + 1] == 0) {
+                position = nextPaddedStart(position);
+                continue;
+            }
+            Codegen::DecodedInstructionInfo info;
+            try {
+                info = decoder.DecodeInstruction(text + position, size - position);
+            } catch (const Codegen::CodegenException&) {
+                position = nextPaddedStart(position);
+                continue;
+            }
+            if (info.Length == 0 || info.Length > size - position) {
+                position = nextPaddedStart(position);
+                continue;
+            }
+            const auto next = position + info.Length;
+            const auto crossed = (position & ~std::size_t{15}) + 16;
+            if (crossed < next && paddedStart(crossed)) {
+                position = crossed;
+                continue;
+            }
+            const auto opcode = position + info.OpcodeOffset;
+            if (info.SegmentPrefix == 0x64 && opcode + 2 < next && (text[opcode + 1] & 0xc7) == 0x04 && text[opcode + 2] == 0x25) addRoot(header.MappedAddress + position);
+            position = next;
+        }
+    }
     for (const auto target : staticTargets) {
         for (const auto& [skipBegin, skipEnd] : skipped) {
             if (skipBegin <= target && target < skipEnd)
diff --git a/core/relinker/relinker/tests/test_tls_function_coverage.py b/core/relinker/relinker/tests/test_tls_function_coverage.py
index 3a8cae4dd..ddc45bbfc 100644
--- a/core/relinker/relinker/tests/test_tls_function_coverage.py
+++ b/core/relinker/relinker/tests/test_tls_function_coverage.py
@@ -339,6 +339,28 @@ def main():
         external[0x1300:0x1310] = external[0x1240:0x1250]
         external[0x1240:0x1250] = b"\xe8" + struct.pack("<i", 0x1300 - 0x1245) + b"\xc3" + b"\x90" * 10
         convert("direct-call-from-indirect-block", external, tls_address=0x1300)
+
+        def convert_padded(name, image):
+            source = work / (name + ".elf")
+            output = source.with_suffix(".exe")
+            source.write_bytes(image)
+            result = subprocess.run([str(relinker), "--skip-sce-module", "--windows", str(source), str(output)],
+                                    capture_output=True, text=True, timeout=30)
+            assert result.returncode == 0, (name, result.stdout, result.stderr)
+            return output.read_bytes()
+
+        unreferenced = make_image("register", "unwind")
+        unreferenced[0x18f0:0x1900] = b"\xcc" * 16
+        unreferenced[0x1900:0x1900 + len(TLS_LOAD) + 4] = TLS_LOAD + bytes.fromhex("8b 40 f0 c3")
+        pe = convert_padded("unreferenced-padded-function", unreferenced)
+        assert pe_bytes_at(pe, 0x11900, 1)[0] == 0xe9, "unreferenced-padded-function"
+        assert pe_bytes_at(pe, 0x11850, len(TLS_LOAD)) == TLS_LOAD, "unreferenced-padded-function"
+        zero_filled = make_image("register", "unwind")
+        zero_filled[0x18f0:0x1900] = b"\xcc" * 16
+        zero_filled[0x1900:0x1910] = bytes(16)
+        zero_filled[0x1910:0x1910 + len(TLS_LOAD)] = TLS_LOAD
+        pe = convert_padded("zero-filled-after-padding", zero_filled)
+        assert pe_bytes_at(pe, 0x11910, len(TLS_LOAD)) == TLS_LOAD, "zero-filled-after-padding"
         for register in range(16):
             offset, body = register_load(register)
             image = make_image("register", "unwind", body=body)