From 73efef2cdfe275cd32ca017c463ca42affe036a4 Mon Sep 17 00:00:00 2001 From: Jacob Babor Date: Fri, 26 Jun 2026 22:57:23 -0500 Subject: [PATCH] Guard GPS solver node reads --- ...ightGPS_fullsolver_nodeonly_crash_0453.log | 15 ++ ..._fullsolver_nodeonly_crash_report_0453.txt | 145 ++++++++++++++++++ ...lsolver_nodeonly_crash_stacktrace_0453.txt | 4 + red4ext/EdgeWeightGPS/src/Main.cpp | 20 +-- 4 files changed, 175 insertions(+), 9 deletions(-) create mode 100644 logs/EdgeWeightGPS_fullsolver_nodeonly_crash_0453.log create mode 100644 logs/EdgeWeightGPS_fullsolver_nodeonly_crash_report_0453.txt create mode 100644 logs/EdgeWeightGPS_fullsolver_nodeonly_crash_stacktrace_0453.txt diff --git a/logs/EdgeWeightGPS_fullsolver_nodeonly_crash_0453.log b/logs/EdgeWeightGPS_fullsolver_nodeonly_crash_0453.log new file mode 100644 index 0000000..9803c06 --- /dev/null +++ b/logs/EdgeWeightGPS_fullsolver_nodeonly_crash_0453.log @@ -0,0 +1,15 @@ +2026-06-27 04:53:16.000 +0ms EdgeWeightGPS Main reason=Load handle=0x6fffeff10000 sdk=0x725e9e78 runtime=2.3.1 +2026-06-27 04:53:16.001 +1ms registered Running game-state callbacks +2026-06-27 04:53:16.009 +9ms hook attach GPSQuerySubmit 0x70a42c target=0x14070a42c rva=0x70a42c result=ok original=0x1018c0480 +2026-06-27 04:53:16.016 +16ms hook attach GPSQueryResultFetch 0x7094b8 target=0x1407094b8 rva=0x7094b8 result=ok original=0x1018c04e0 +2026-06-27 04:53:16.023 +23ms hook attach GPSNodeMultiplier 0x40bb40 target=0x14040bb40 rva=0x40bb40 result=ok original=0x1018c0540 +2026-06-27 04:53:33.116 +17116ms GameState Running OnEnter app=0x31fb80 +2026-06-27 04:53:33.147 +17147ms GameState Running OnUpdate app=0x31fb80 count=0 +2026-06-27 04:53:33.154 +17154ms GameState Running OnUpdate app=0x31fb80 count=1 +2026-06-27 04:53:33.161 +17161ms GameState Running OnUpdate app=0x31fb80 count=2 +2026-06-27 04:53:33.168 +17168ms GameState Running OnUpdate app=0x31fb80 count=3 +2026-06-27 04:53:33.174 +17174ms GameState Running OnUpdate app=0x31fb80 count=4 +2026-06-27 04:54:03.208 +47208ms hook GPSQuerySubmit 0x70a42c call=3 manager=0x199001390 query=0x79cbfa60 query_f00=0/0x0 query_f04=65535/0xffff query_f08=2043348996/0x79cb0804 query_f0c=0/0x0 query_fcc=5/0x5 query_pos58=(-1569.68,1213.26,17.3741,0) resolveTraceWindowMs=1200 ret_rva=0x8d20d4 +2026-06-27 04:54:03.208 +47208ms hook GPSQuerySubmit result call=3 queryId=3 manager_nextIdD4=4/0x4 +2026-06-27 04:54:03.208 +47208ms hook GPSQuerySubmit 0x70a42c call=4 manager=0x199001390 query=0x79cbfa60 query_f00=0/0x0 query_f04=65535/0xffff query_f08=2052/0x804 query_f0c=0/0x0 query_fcc=5/0x5 query_pos58=(-1569.68,1213.26,17.3741,0) resolveTraceWindowMs=1200 ret_rva=0x8d20d4 +2026-06-27 04:54:03.208 +47208ms hook GPSQuerySubmit result call=4 queryId=4 manager_nextIdD4=5/0x5 diff --git a/logs/EdgeWeightGPS_fullsolver_nodeonly_crash_report_0453.txt b/logs/EdgeWeightGPS_fullsolver_nodeonly_crash_report_0453.txt new file mode 100644 index 0000000..d96954d --- /dev/null +++ b/logs/EdgeWeightGPS_fullsolver_nodeonly_crash_report_0453.txt @@ -0,0 +1,145 @@ +Registered crash info file... +InternalVersion: 3.0.5294808 P4CL: 9778208 Stream: //R6.Root/R6.Release +!!!CRASHED!!! +Error Reason: Unhandled exception +Expression: EXCEPTION_ACCESS_VIOLATION (0xC0000005) +Message: The thread attempted to read inaccessible data at 0x8C. +File: +Line: 0 + +"uptimeSeconds":47 +"stopThreadID":424 +"exceptionCode":0xC0000005 +"processID":372 +"Engine/CommitFailedErrorCode@1#TID=0":"0" +"ResourceLoaderThrottler/PreviousSpeed@883287#TID=0":"Flood" +"ResourceLoaderThrottler/CurrentSpeed@883288#TID=0":"Stream" +"ResourceLoaderThrottler/NumThrottleTokensAcquired@891857#TID=0":"1" +"ResourceLoaderThrottler/NumThrottleTokensSoftLimit@891856#TID=0":"2" +"Gpu/RayTracing/Enabled@256#TID=0":"false" +"Configuration/Name@2#TID=0":"FINAL" +"Configuration/Name2@3#TID=0":"FINAL" +"Game/Patch@7#TID=0":"2.31" +"Game/TransformAnimator/Components@891262#TID=0":"315" +"Game/TransformAnimator/RunningComponents@891261#TID=0":"271" +"Game/TransformAnimator/AddedRunningComponents@891258#TID=0":"0" +"Game/TransformAnimator/RemovedRunningAnimations@891259#TID=0":"0" +"Game/TransformAnimator/RotatingMeshNodes@891260#TID=0":"120" +"Game/TransformAnimator/AddedRotatingMeshNodes@891256#TID=0":"0" +"Game/TransformAnimator/RemovedRotatingMeshNodes@891257#TID=0":"0" +"Game/SessionDesc/WorldName@271043#TID=0":"03_night_city" +"Game/SessionDesc/IsValid@271044#TID=0":"true" +"Game/SessionDesc/IsLoadingSavedSession@271045#TID=0":"true" +"Game/SessionDesc/IsJoiningRemoteSession@271046#TID=0":"false" +"Game/SessionDesc/HostName@271047#TID=0":"" +"Game/SessionDesc/GameRulesConfig@271048#TID=0":"None" +"Game/SessionDesc/SpawnLocalPlayer@271049#TID=0":"false" +"Game/SessionDesc/SpawnPoint@271050#TID=0":"Position=[0, 0, 0, 0] Rotation=[Roll:0, Pitch:0, Yaw:0]" +"Game/SessionDesc/SpawnRecordId@271051#TID=0":"<0x0000001C15982ADF>" +"Game/SessionDesc/Gender@271052#TID=0":"None" +"GameSessionDesc/UseSpecifiedStartPoint@271053#TID=0":"false" +"GameSessionDesc/IsSpectator@271054#TID=0":"false" +"GameSessionDesc/SpawnTags@271055#TID=0":"" +"Game/SessionDesc/IsStreamingTestRequested@271056#TID=0":"false" +"Game/SessionDesc/IsBenchmark@271057#TID=0":"false" +"Game/GameEffects/RunningEffects@891660#TID=0":"1" +"Game/GameEffects/AddedEffects@891659#TID=0":"0" +"Game/GameEffects/TerminatingEffects@891661#TID=0":"1" +"Game/Interactions/DialogVisualizerTotalCount@891598#TID=0":"0" +"Game/Interactions/DeviceVisualizerTotalCount@891599#TID=0":"0" +"Game/Interactions/LootVisualizerTotalCount@891600#TID=0":"0" +"Game/Interactions/HotSpots/CurrentCount@891605#TID=0":"406" +"Game/Interactions/HotSpots/MaxCount@891606#TID=0":"539" +"Game/Interactions/HotSpots/LastFrameAddedCount@891601#TID=0":"0" +"Game/Interactions/HotSpots/MaxAddedCount@891602#TID=0":"577" +"Game/Interactions/HotSpots/LastFrameRemovedCount@891603#TID=0":"0" +"Game/Interactions/HotSpots/MaxRemovedCount@891604#TID=0":"139" +"Game/Interactions/UniqueLayersCurrentCount@891607#TID=0":"3323" +"Game/Interactions/UniqueLayersMaxCount@891608#TID=0":"4682" +"Game/Interactions/EventsLastFrameCount@891596#TID=0":"0" +"Game/Interactions/EventsMaxCount@891597#TID=0":"25" +"Game/PlayerStateMachine/numberOfStateMachines@801419#TID=0":"10" +"Game/TransactionSystem/NumberOfItemsInPlayersInventory@406887#TID=0":"620" +"Game/TransactionSystem/NumberOfItemsInPlayersStash@606182#TID=0":"813" +"Game/StatsSystem/NumberOfStatsBundles@890653#TID=0":"2355" +"Game/StatPoolsSystem/MaxNumberOfStatPoolListenersOnObject@796426#TID=0":"10" +"Game/StatsSystem/MaxNumberOfStatModifiersOfStatTypeOnObject@796901#TID=0":"99" +"Game/StatsSystem/NameOfMaxNumberOfStatModifiersOnObjectStatType@796902#TID=0":"StaminaRatio" +"Game/mounting/MountingFacility/numberOfGameplayMounts@800175#TID=0":"1" +"Game/mounting/MountingFacility/numberOfMountEvents@800036#TID=0":"0" +"Game/ItemFactorySystemPool/numberOfPrePooledOwners@407020#TID=0":"1" +"Game/ItemFactorySystemPool/numberOfPrePooledItems@270847#TID=0":"0" +"Game/ItemFactorySystemPool/numberOfPostPooledItems@270845#TID=0":"0" +"Game/ItemFactorySystem/numberOfOwnerDatas@407021#TID=0":"1" +"Game/ItemFactorySystem/numberOfItemsWithNoOwner@270844#TID=0":"0" +"Game/ItemFactorySystem/numberOfCachedOwners@407019#TID=0":"1" +"Game/ItemFactorySystem/numberOfCachedItems@699885#TID=0":"7" +"Game/ItemFactorySystem/numberOfUncachedOwners@889000#TID=0":"107" +"Game/ItemFactorySystem/numberOfUncachedItems@891619#TID=0":"127" +"Game/StatPoolsSystem/MaxNumberOfUnassignedStatPoolListeners@799211#TID=0":"5207" +"Game/StatsSystem/MaxNumberOfStatsListenersOnObject@798882#TID=0":"207" +"Game/StatsSystem/MaxNumberOfStatsCallbackData@790981#TID=0":"267" +"Game/mounting/LowLevelSystem/numberOfAssociations@799839#TID=0":"14" +"Game/ItemFactorySystemLowLevel/numberOfSpawnRequests@891620#TID=0":"0" +"Game/ItemFactorySystemLowLevel/numberOfReleaseRequests@830096#TID=0":"0" +"Game/ItemFactorySystemLowLevel/numberOfCancelRequests@270879#TID=0":"0" +"Game/ItemFactorySystemLowLevel/numberOfAppearanceChangeRequests@813221#TID=0":"0" +"Game/Population/AlwaysSpawned@891420#TID=0":"18" +"Game/Population/Attached@891421#TID=0":"221" +"Game/Population/Registered@891422#TID=0":"4462" +"Game/Population/InBucket@891423#TID=0":"1001" +"Game/Population/VisQueries@891424#TID=0":"2002" +"Rendering/AsyncCompute@891839#TID=0":"true" +"Game/LoadingStage@883286#TID=0":"Finished" +"Session/GameDefinitionName@270834#TID=0":"" +"Engine/OOM@4#TID=0":"false" +"GlobalMode/IsClosing@5#TID=0":"false" +"GlobalMode/IsGame@17#TID=0":"true" +"Jobs/InitParam/MaxLatentJobs@8#TID=0":"131072" +"Jobs/InitParam/MaxCriticalPathJobs@9#TID=0":"65536" +"Jobs/InitParam/MaxImmediateJobs@10#TID=0":"2048" +"Jobs/InitParam/WorkerThreadStackSizeKB@11#TID=0":"1024" +"Jobs/InitParam/MaxThreads@12#TID=0":"27" +"Jobs/InitParam/AllJobsCriticalPath@14#TID=0":"false" +"Jobs/InitParam/UseJobDebugger@13#TID=0":"false" +"Jobs/Dispatcher/NumDispatcherThreads@15#TID=0":"11" +"Jobs/Dispatcher/MaxHWConcurrency@16#TID=0":"12" +"Gpu/Device/Name@251#TID=0":"AMD Radeon RX 7900 XT (RADV NAVI31)" +"Gpu/Device/Vendor@252#TID=0":"AMD" +"Gpu/Device/DriverVersion@253#TID=0":"Radeon software 99.10.2" +"Gpu/Device/TotalMemoryMB@250#TID=0":"20464" +"Gpu/Device/UsedMemoryMB@891858#TID=0":"5614" +"Engine/SafeInit@48012#TID=0":"Finished" +"Engine/IsHeadless@228#TID=0":"false" +"Engine/VersionWatermark@227#TID=0":"3.0.5294808 P4CL: 9778208 Stream: //R6.Root/R6.Release Aug 27 2025 17:30:27 (FINAL) Total memory: 11598729216 bytes [EP1]" +"Engine/InitParams/InteropStartingPort@213#TID=0":"0" +"Engine/InitParams/RenderPreset@214#TID=0":"1" +"Engine/InitParams/QualityLevelName@215#TID=0":"None" +"Engine/InitParams/TextureQualityLevelName@216#TID=0":"High" +"Engine/InitParams/WatchdogTimeoutSecondsOverride@217#TID=0":"0" +"Engine/InitParams/ScriptsSilentCompilation@218#TID=0":"false" +"Engine/InitParams/ScriptsSilentValidation@219#TID=0":"false" +"Engine/InitParams/TweakDBSilentValidation@220#TID=0":"false" +"Engine/InitParams/PvdDumpToFile@221#TID=0":"false" +"Engine/InitParams/ProfilerEnabled@222#TID=0":"false" +"Engine/InitParams/ShowVersionWatermark@223#TID=0":"true" +"Engine/InitParams/WindowCaption@224#TID=0":"" +"Engine/PC/SystemName@225#TID=0":"Windows 10 Pro" +"Engine/PC/SystemVersion@226#TID=0":"10.0.19045" +"Engine/Scripts/PrimaryBlobModifiedDate@235#TID=0":"134020895866810433" +"Engine/Scripts/FallbackBlobModifiedDate@236#TID=0":"0" +"Engine/Scripts/BlobPathUsed@237#TID=0":"Loaded" +"Engine/Scripts/ShouldCompileScripts@233#TID=0":"true" +"Engine/Scripts/CompileScriptsSuccess@234#TID=0":"false" +"Engine/Scripts/Loaded@238#TID=0":"true" +"Telemetry/PlaythroughID@386977#TID=0":"69e857a3ebf988d1" +"Telemetry/VisitID@49737#TID=0":"25e0da41-9ece-4bbb-b389-692e511be993" +"Streaming/LastObserverPosition@891639#TID=0":"[-1569, 1213, 18]" +"Streaming/IsLastObserverPositionValid@891640#TID=0":"true" +"Streaming/IsTeleporting@891641#TID=0":"false" +"Streaming/DebugLastTeleportDistance@891642#TID=0":"0.000000" +"Streaming/MountState@386954#TID=0":"Mounted" +"Streaming/Observer/0/LastObserverPosition@891636#TID=0":"[-1569, 1213, 18]" +"Streaming/Observer/0/LastObserverVelocityOffsetPosition@891637#TID=0":"[-1569, 1213, 18]" +"Streaming/Observer/0/UseStreamingOcclusion@891638#TID=0":"false" +"##CrashDump##/DumpCrashDataSeconds":"0" diff --git a/logs/EdgeWeightGPS_fullsolver_nodeonly_crash_stacktrace_0453.txt b/logs/EdgeWeightGPS_fullsolver_nodeonly_crash_stacktrace_0453.txt new file mode 100644 index 0000000..5a4521f --- /dev/null +++ b/logs/EdgeWeightGPS_fullsolver_nodeonly_crash_stacktrace_0453.txt @@ -0,0 +1,4 @@ +Error reason: Unhandled exception +Expression: EXCEPTION_ACCESS_VIOLATION (0xC0000005) +Message: The thread attempted to read inaccessible data at 0x8C. +File: (0) diff --git a/red4ext/EdgeWeightGPS/src/Main.cpp b/red4ext/EdgeWeightGPS/src/Main.cpp index 922083c..e0c2e91 100644 --- a/red4ext/EdgeWeightGPS/src/Main.cpp +++ b/red4ext/EdgeWeightGPS/src/Main.cpp @@ -210,6 +210,7 @@ constexpr uint16_t kTrafficLaneFlagGpsOnly = 0x0200; constexpr uint16_t kTrafficLaneFlagNoAiDriving = 0x2000; constexpr uint16_t kTrafficLaneFlagHighway = 0x4000; constexpr uint16_t kTrafficLaneFlagNoAutodrive = 0x8000; +constexpr uintptr_t kMinimumReadableAddress = 0x10000; constexpr float kGpsSolverHighwayMultiplier = 0.35f; constexpr float kGpsSolverGpsOnlyMultiplier = 1.10f; constexpr float kGpsSolverPavementMultiplier = 1.25f; @@ -927,7 +928,7 @@ bool IsReadableMemory(const void* aPointer, size_t aSize) const auto begin = reinterpret_cast(aPointer); const auto end = begin + aSize; - if (end < begin) + if (begin < kMinimumReadableAddress || end < begin) { return false; } @@ -4878,18 +4879,19 @@ float DetourGpsNodeMultiplier(void* aJob, void* aNode) } uint32_t mode = 0; - uint16_t nodeFlags = 0; const auto jobAddress = reinterpret_cast(aJob); - const auto nodeAddress = reinterpret_cast(aNode); const auto hasMode = aJob && TryReadMemory(reinterpret_cast(jobAddress + 0xC4), mode); - const auto hasFlags = aNode && TryReadMemory(reinterpret_cast(nodeAddress + 0x88), nodeFlags); - - if (hasMode && hasFlags && mode == 2 && std::isfinite(result)) + if (hasMode && mode == 2 && std::isfinite(result)) { - const auto patchMultiplier = GpsSolverNodeWeightMultiplier(nodeFlags); - if (patchMultiplier != 1.0f) + uint16_t nodeFlags = 0; + const auto nodeAddress = reinterpret_cast(aNode); + if (aNode && TryReadMemory(reinterpret_cast(nodeAddress + 0x88), nodeFlags)) { - result *= patchMultiplier; + const auto patchMultiplier = GpsSolverNodeWeightMultiplier(nodeFlags); + if (patchMultiplier != 1.0f) + { + result *= patchMultiplier; + } } }