Can't Drive This (PPSA02743)

[JJenkx]

Tested Can't Drive This (PPSA02743) natively on Linux 7.2.9 / Ryzen 9 7950X / Radeon RX 6650 XT, RADV Mesa 26.2.4. Unity 2019.4.18f1 (IL2CPP). Short bring-up check.

Result

On main 5b59fbc553 the title no longer aborts at startup: an earlier local test on an older integration stopped after 2.25 s with an uncaught Il2CppExceptionWrapper. It now presents at a steady 59.94 FPS for 240 s, but stays on the "CAN'T DRIVE THIS" loading screen with an empty progress bar, with or without Cross presses.

What happens

• One managed exception is thrown on the main thread, right after the first frame's input polling (sceSystemServiceGetStatus, sceUserServiceGetEvent, sceImeUpdate, scePadRead, sceMouseRead): System.NullReferenceException: Object reference not set to an instance of an object. Nothing else is thrown in 90 s.
• Just before that, Unity reads the header and block info of the LZ4HC AssetBundle manifest Media/StreamingAssets/StreamingAssets (UnityFS v7, 18256 bytes), then opens it again on another thread. The game makes no further file accesses.

How the exception was found

This may help with other IL2CPP titles. The title's own sce_module/libc.prx provides libc++abi, so __cxa_throw is that module's vkuuLfhnSZI#guest export. Because AnyPS5 maps guest modules itself, gdb does not list them as shared libraries. Its address is the start of the module's executable mapping in /proc/<pid>/maps, minus (that mapping's file offset − 0x4000), plus the symbol's nm value. At that breakpoint:

• rsi is the C++ type_info (name at +8: 22Il2CppExceptionWrapper), and rdi points to the wrapper, whose first word is the Il2CppException*.
• The class's name and namespace pointers sit at +0x10/+0x18 of Il2CppClass.
• The message Il2CppString* is at exception +0x18; its UTF-16 length is at +0x10 and its characters start at +0x14.

Not found yet

Which C# method dereferences null. Mapping the throwing return address in Il2CppUserAssemblies.prx to a method needs the IL2CPP metadata.

AI-assisted testing and report: yes, Claude Code.

[JJenkx]

Follow-up on main 5b59fbc553:

• The throwing method is <LoadManifest>d__11::MoveNext in Assembly-CSharp.dll (method token 0x0600206E), the coroutine that loads the AssetBundle manifest. It was identified by:
  1. reading each Il2CppCodeGenModule (assembly name pointer, method count, method-pointer array) from the live module at the throw;
  2. finding the stack return address closest above a method pointer, 278 bytes into that method;
  3. looking up token 0x0600206E in global-metadata.dat (version 24; 32-byte method entries with the token at word 5; type entries of 92 bytes).
• The manifest bundle Media/StreamingAssets/StreamingAssets is valid. It is UnityFS v7 with LZ4HC block info, 64 bytes compressed to 91 at offset 64 after 16-byte alignment, and it decompresses to one 0x46d0-byte block. The loading thread reads the header and block info and then seeks to the data start (128). A second thread opens the file again and makes no read: no read/pread syscall, and no failing sceKernelRead/sceKernelPread. The coroutine then dereferences null.
• Before each file it reads, the player prints path /app0/Media/... is not considered suitable for apr reads flags:0x0. This includes the bundle, so every file falls back to ordinary reads. BloodRayne: ReVamped (BloodRayne: ReVamped (PPSA05916) #8764) does use APR reads.

So the bundle never finishes loading, but why the async read is never issued is not established.