[Y_Less]

Today I learned how to confuse the PAWN VM and "steal" parts of the heap for my own uses. For the new version of y_malloc I switched to using the heap instead of an array because it makes compiling and file sizes better. I wrote code something like this:

pawn Код:

#emit LCTRL  5
#emit STOR.S <malloc pointer>
#emit ADD.C  <malloc size>
#emit SCTRL  5

And everything was fine - it didn't take me long at all to convince y_malloc to allocate memory from this freshly reserved portion of the heap and seemed to be going well untill I called "malloc" from a different callback (i.e. not OnGameModeInit).

The problem was that the PAWN virtual machine (i.e. the thing that runs PAWN scripts) resets the heap after every callback (which is normally the right thing to do). The function amx_Exec contains something like:

pawn Код:

reset_heap = amx->heap;
reset_stack = amx->stack;
heap = amx->heap;
stack = amx->stack;

// Run the PAWN callback.

amx->heap = reset_heap;
amx->stack = reset_stack;

So any modifications or assignments we make in the heap are lost as soon as the callback ends, which is no good if we are using it as global memory. Fortunately, I found a solution by confusing the virtual machine! When you call "sleep" this code is run:

pawn Код:

amx->reset_heap = reset_heap;
amx->reset_stack = reset_stack;

And then "amx_Exec" ends without resetting the values, because it was never designed for callbacks in the way SA:MP does them. When the sleep time is up, the code resumes and this code is run:

pawn Код:

reset_heap = amx->reset_heap;
reset_stack = amx->reset_stack;
heap = amx->heap;
stack = amx->stack;

Then when the callback finally ends, the normal end code is run to again reset the stack and heap back to their original values:

pawn Код:

amx->heap = reset_heap;
amx->stack = reset_stack;

Now people have said that you can only call "sleep" from "main" - this is not STRICTLY true, you can call it from anywhere, it just won't do anything. "main" is the only function that you can sleep and resume later, so "main" is the only function that can call the code we DO NOT WANT - i.e. the code I just showed to reset "reset_stack" and "reset_heap". But there's a bug! Calling "sleep" from a callback first, THEN from "main" will do the following:

pawn Код:

// Start amx_Exec
reset_heap = amx->heap;
reset_stack = amx->stack;
heap = amx->heap;
stack = amx->stack;

// Run OnGameModeInit

// Call "sleep":
amx->reset_heap = reset_heap;
amx->reset_stack = reset_stack;

// Start amx_Exec
reset_heap = amx->heap;
reset_stack = amx->stack;
heap = amx->heap;
stack = amx->stack;

// Run "main":

// Call "sleep":
amx->reset_heap = reset_heap;
amx->reset_stack = reset_stack;

We have finally manged to overwrite the value of "amx->reset_heap" with our own value, i.e. the value AFTER our allocated data. If "main" doesn't exist (i.e. this is a filterscript) then the code still works because "sleep" can never be resumed from to fully reset the heap pointer. I'm sorry this is not well explained - it is hard to explain and took me ages to understand and figure out!