S16v4: reject STUBV return

2026-09-13 12:15:25 +00:00
parent 80ee6d1bf3
commit 47e78ee42f
3 changed files with 22 additions and 17 deletions
@@ -393,14 +393,15 @@ def main():
    mu.mem_write(0x08006964, bytes.fromhex(
        "04c09de50c309fe5002093e5022082e3002083e51eff2fe1"
        "00a17300"))
-    # S16-stublet (b27, 50B @0x08006CC0): smart return for B66 bx ip.
-    # ip odd + top 8 (code) => add sp,#8 (pop the helper frame it
+    # S16-stublet (b27, 64B @0x08006CC0): smart return for B66 bx ip.
+    # ip==STUBV (fill/maze, never a legit return) => default;
+    # ip odd + top 8 (code) => add sp,#8 (pop the helper frame B66
    # skipped!) + bx ip (legit pushed-lr return, un-leaks the stack);
    # else default (restore r7, jump poll resumption 0x8007779).
    mu.mem_write(0x08006CC0, bytes.fromhex(
-        "ddf804c01cf0010f0bd05fea1c63082b00d102b06047"
-        "5fea1c73082b00d160474af20007c0f2730747f2797c"
-        "c0f6000c6047"))
+        "ddf804c046f68d33c0f600039c450ed01cf0010f0bd0"
+        "5fea1c63082b01d102b060475fea1c73082b01d102b0"
+        "60474af20007c0f2730747f2797cc0f6000c6047"))
    # stack zone fill (STUBV odd)
    mu.mem_write(0x085F0000, struct.pack("<I", STUBV) * (0x10000 // 4))
    # pop-site slots (sp values from traces)