The Windows loader sets up TLS for a dynamically loaded DLL only when it snaps the DLL's imports. Guest modules had no import directory, so their TLS directory was never processed: every guest module kept TLS index 0 and read and wrote the executable's TLS block. A guest libc's thread-locals (gmtime's buffer at +0x39c in Marvel's Wolverine) then ran past the executable's 0x150-byte block into the process heap, and corrupted a loader node that crashed the next thread start in ntdll. Guest modules with TLS now import from KERNEL32, as the executable does. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> |
||
|---|---|---|
| .. | ||
| Decoder | ||
| libs | ||
| relinker | ||
| shader/recompiler | ||