You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
[Sonic Frontiers] Resources library hook reads the resource name from rcx instead of rax (startup crash) #278
Summary With any code enabled, Sonic Frontiers can crash ~3 seconds into startup. The cause is the Resources library's first WriteAsmHook in Source/Sonic Frontiers/Libraries/Resources.hmm. After calling GetResourceInfo, it reads the (possibly redirected) resource name with mov rdx, [rcx]. GetResourceInfo returns the name in rax; rcx is volatile and holds whatever the call left behind. When that isn't a usable pointer, the game is handed a garbage name and crashes.
Since almost every library depends on Resources (Player, Sonic, Reflection, SaveData, GameObject, etc.), this affects any code set, even a single code. It can work by luck when rcx happens to still hold something readable, which is why it may not reproduce everywhere.
Environment
Sonic Frontiers 1.42 (Steam, exe timestamp 0x676BAE3A)
Linux, Proton Experimental (wine-mono 11.3.0), HedgeModManager 8.0.0-beta7, HE2ModLoader 1.4.0
Started after moving the game to another Steam library; same Proton, prefix and codes before and after.
Crash Access violation at SonicFrontiers.exe+0xEEB4D4 (cmp byte ptr [rdx], 0), in the function the hook patches. The hook signature 48 81 EC D0 00 00 00 49 8B F8 48 8B DA has a single match in this exe, at 0x140EEB4BB. Registers at the crash: rcx = 0x0000000006000000, rdx = rbx = 0x8207060c0402a382 (that's [rcx]), rsi = the original this, rdi = the original r8 (resource type info). Called from exe+0xEE1982 (resource loader).
Activity