Repository navigation
Social Club: the renderer bridge for helper build 2.4.0.296 - #559
Merged
Merged
Conversation
Social Club updated to 2.4.0.296 on 2026-11-03 and its launcher no longer loaded its pages under Madeira: [sc-rph] recognised one helper build only (TimeDateStamp 0x6a86d563), so SocialClubHelper.exe ran unpatched under --single-process, the launcher's UI waited for a page that never became ready and gave up with a website-load-failed error. The launcher reinstalls the current client, so there is no going back to the old one. The patch is now a table of analysed builds (ios_sch_builds): per build its RVAs, the SHA-256 of every code range relied on, the code it installs, its hook sites and the .data ranges that must be zero. The first build's entry writes exactly the bytes it wrote before. 2.4.0.296's entry installs the same bridge: the GetRenderProcessHandler thunk, the renderer MessageLoop adapter with its task callbacks, the renderer drain and the IPC split (separate renderer manager, retained page channels, 64-slot bound). That build leaves 792 bytes past .text's VirtualSize (the first 3.2 KB), so its variant carries no diagnostic traces (RunState, IPC rebind, UI notifications), uses compact Win64 forms for the manager getter, destructor and direct-load hooks, and places the four 5-11 byte task callbacks and two 15-byte IPC stubs in int3 padding between functions (a RET before, the next .pdata function after, checked as all-int3 and by digest before anything is written). Where 2.4.0.296's code differs (browser-only handler registration in Initialize, Channel Response skipping a Connect to the current channel, the capture site's displaced instruction), the digests cover the new bytes and the stubs replay the new form. Build selection is by TimeDateStamp and SizeOfImage; a mismatch logs the stamp, the size and the reason and writes nothing. No helper bytes are in the source, only digests. MADEIRA_SC_RENDER_HANDLER=0, MADEIRA_SC_CEF=0 and MADEIRA_SC_IPC_SPLIT=0 apply to both builds. Tests: check-sc-render-loop, -ipc-split and -render-handler run once per build (sc-render-handler.S is the thunk's source); check-sc-runstate, -ui-close and -ipc-rebind confirm the 2.4.0.296 build has no trace. New check-sc-helper-binary.py maps a real helper the way the loader does (never runs it), checks every digest, and runs the guard and the patch on the copy, in both bases with the IPC split on and off, then checks that switches, another image name and one-byte changes in any window write nothing: MADEIRA_SC_HELPER_EXE names the helper; without it the test is skipped. The 2.4.0.296 helper passes it; the device run is still to come. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
125hz
added a commit
that referenced
this pull request
Nov 4, 2026
Social Club updated to 2.4.0.296 on 2026-11-03 and its launcher no longer loaded its pages under Madeira: [sc-rph] recognised one helper build only (TimeDateStamp 0x6a86d563), so SocialClubHelper.exe ran unpatched under --single-process, the launcher's UI waited for a page that never became ready and gave up with a website-load-failed error. The launcher reinstalls the current client, so there is no going back to the old one. The patch is now a table of analysed builds (ios_sch_builds): per build its RVAs, the SHA-256 of every code range relied on, the code it installs, its hook sites and the .data ranges that must be zero. The first build's entry writes exactly the bytes it wrote before. 2.4.0.296's entry installs the same bridge: the GetRenderProcessHandler thunk, the renderer MessageLoop adapter with its task callbacks, the renderer drain and the IPC split (separate renderer manager, retained page channels, 64-slot bound). That build leaves 792 bytes past .text's VirtualSize (the first 3.2 KB), so its variant carries no diagnostic traces (RunState, IPC rebind, UI notifications), uses compact Win64 forms for the manager getter, destructor and direct-load hooks, and places the four 5-11 byte task callbacks and two 15-byte IPC stubs in int3 padding between functions (a RET before, the next .pdata function after, checked as all-int3 and by digest before anything is written). Where 2.4.0.296's code differs (browser-only handler registration in Initialize, Channel Response skipping a Connect to the current channel, the capture site's displaced instruction), the digests cover the new bytes and the stubs replay the new form. Build selection is by TimeDateStamp and SizeOfImage; a mismatch logs the stamp, the size and the reason and writes nothing. No helper bytes are in the source, only digests. MADEIRA_SC_RENDER_HANDLER=0, MADEIRA_SC_CEF=0 and MADEIRA_SC_IPC_SPLIT=0 apply to both builds. Tests: check-sc-render-loop, -ipc-split and -render-handler run once per build (sc-render-handler.S is the thunk's source); check-sc-runstate, -ui-close and -ipc-rebind confirm the 2.4.0.296 build has no trace. New check-sc-helper-binary.py maps a real helper the way the loader does (never runs it), checks every digest, and runs the guard and the patch on the copy, in both bases with the IPC split on and off, then checks that switches, another image name and one-byte changes in any window write nothing: MADEIRA_SC_HELPER_EXE names the helper; without it the test is skipped. The 2.4.0.296 helper passes it; the device run is still to come. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Social Club updated to 2.4.0.296 on 2026-11-03 and its launcher stopped loading its pages under Madeira:
[sc-rph]recognised one helper build only (TimeDateStamp 0x6a86d563), soSocialClubHelper.exeran unpatched under--single-process, the launcher's UI waited for a page that never became ready and gave up with a website-load-failed error. The launcher reinstalls the current client, so there is no going back.What changed
ios_sch_builds): per build its RVAs, the SHA-256 of every code range relied on, the code it installs, its hook sites and the.dataranges that must be zero. The first build's entry writes exactly the bytes it wrote before.GetRenderProcessHandlerthunk, the renderer MessageLoop adapter with its task callbacks, the renderer drain and the IPC split (separate renderer manager, retained page channels, 64-slot bound)..text's VirtualSize (the first build 3.2 KB), so its variant carries no diagnostic traces, uses compact Win64 forms for the manager getter, destructor and direct-load hooks, and places the four small task callbacks and two 15-byte IPC stubs in int3 padding between functions (a RET before, the next.pdatafunction after, checked as all-int3 and by digest before anything is written).MADEIRA_SC_RENDER_HANDLER=0,MADEIRA_SC_CEF=0andMADEIRA_SC_IPC_SPLIT=0apply to both builds.Tests
sc-render-handler.Sis the thunk's source); check-sc-runstate, -ui-close and -ipc-rebind confirm the 2.4.0.296 build has no trace.check-sc-helper-binary.pymaps a real helper the way the loader does (never runs it), checks every digest, and runs the guard and the patch on the copy in both bases with the IPC split on and off, then checks that switches, another image name and one-byte changes in any window write nothing.MADEIRA_SC_HELPER_EXEnames the helper; without it the test is skipped. The 2.4.0.296 helper passes.Device-tested in the sc-1103 build on top of main.
🤖 Generated with Claude Code