[NoRain211]

Summary

The runner placed kernel data exports (KeTickCount and the other synthetic exports) and the startup thread object at 0x00740000. That address is inside the .data BSS of both DOAXBV (0x003b2224-0x00eeb29c) and DOA3, so the kernel data shared memory with the game's own variables.

-#define XBOX_STARTUP_THREAD_OBJECT 0x00740500u
+#define XBOX_KERNEL_DATA_BASE 0x00f80000u   /* above the main stack top 0x00f7fff0 */
+#define XBOX_STARTUP_THREAD_OBJECT (XBOX_KERNEL_DATA_BASE + 0x500u)

runner.cpp, kernel_thread.c, d3d_frame_adapter.c and their tests now take the base from xbox_memory_layout.h. The runner also refuses an XBE image that reaches the kernel data area. The research doc's KeTickCount address is updated to match.

This replaces the older codex/kernel-data-base branch, which was never merged and is 411 commits behind. The two kernel commits are rebased onto current main; the only conflict was an include in d3d_frame_adapter.c.

Verification

• MSVC Debug ctest: 47 of 47 pass. llvm-mingw clang ctest: 45 of 45 pass.
• python tools/public_export.py verify --require-public-tree passes.
• Agent smoke run (startup only): built with tools/build_game.py --imported at 7042289 (the BuildGame.cmd path, reusing an extracted import) and launched the way run_game.py does, for 75 s. Build identity: lifter 7adaf21, recipe 307fc3d3780166b14063de686db7a6536aaba20b65589a5900f6944049870c09, program manifest a063777b8fad7d6c0fb5473c8a716941cc96d30fdaec3b0e727a586876f8c688, generation_parity: exact-local-match, receipt status built-unverified. The runner started with the kernel data at 0x00f80000, played through the logo and opening movie sequence, then read asset archives. It presented 4,180 frames at 60.00 fps with 0 late frames in the last window; the worst frame (286 ms) was during startup. No crash, stop or kernel error in the log.
• Not a play test. This shows the game boots and runs past the opening movies with the new layout. It does not show gameplay, rendering or audio, and there was no A/B run against a build from main. Merged at the maintainer's request without a separate play test of this change.

Contribution checklist

• The change follows AGENTS.md and CONTRIBUTING.md.
• No XBE, generated game C, retail instruction bytes, extracted assets or filenames, saves, BIOS data, private paths, or run evidence are included.
• Third-party material and its license are identified, if applicable (none).

[norain211-mira]

Mira PR Walkthrough

This PR moves the synthetic kernel data exports (KeTickCount and others) and the startup thread object. They used to sit at 0x00740000, inside the .data BSS of both DOAXBV and DOA3. They now sit at a new XBOX_KERNEL_DATA_BASE of 0x00f80000, just above the main stack top. The runner, kernel thread, and D3D frame adapter code now read the base from xbox_memory_layout.h, and the runner refuses any XBE image that reaches the kernel data area. Unit tests pass, but the change has not been run against a game build.

sequenceDiagram
participant Runner
participant Layout as xbox_memory_layout.h
participant XBE as XBE Image
participant Kernel as Kernel Data (0x00f80000)
Runner->>Layout: read XBOX_KERNEL_DATA_BASE
Runner->>XBE: compute image end
alt image reaches kernel data base
Runner-->>Runner: refuse to load
else no overlap
Runner->>Kernel: place KeTickCount & exports
Runner->>Kernel: place startup thread object (+0x500)
end

Loading

Confidence: 4/5   ◉◉◉◉○   Safe with minor verification

• The fix is small and puts the address in one shared header, which makes sense, but it has not been checked against a game build. Code that still expects the old address, or 0x00f80000 overlapping other runtime regions (heap or other stacks), would only show up at runtime.

7 files reviewed

---

Comment @norain211-mira help to get the list of available commands and usage tips.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	⚠️ Failed 2026-10-24T14:39:03.358305Z We couldn’t complete this review. Comment @codex review to try again.	7042289	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.