Files
psxrecomp/docs
Matthew Stanley 414314d412 aot_overlay_spike: robust header-table base recovery via jal self-consistency
The old delta-sweep matched export-table pointers against 0x27BD prologues,
but those pointers point at mid-function DISPATCH entries, not prologues
(measured: 0/29 hit a prologue at the true base). It scattered bases by
2-16KB and decoded data as code.

Fix: j/jal targets are BASE-INDEPENDENT (0x80000000 | (imm26<<2), since all
game code lives in 0x800xxxxx). At the true base, the maximum number of
intra-overlay jal targets land on a real prologue. recover_base() votes every
(jal-target, prologue-offset) pair for base t-o within the pointer-containment
window; the peak is unique and sharp (~2x margin). Records are emitted
page-aligned with a FILL prefix, because the runtime keys shards by a
page-aligned region_start and compile_overlays takes load_addr verbatim.
Weak-signal files are skipped (score<4 or <1.5x runner-up) -- safe coverage
loss under the per-function code_crc dispatch guard. Also dedup overlays by
content CRC (position-fixed BINs are reused across AREA folders).

Validation: generic output is byte-identical (base, region envelope, seed set)
to the live-proven tomba1_extract.py hand tool for ALL 22 Tomba 1 overlays,
with no hardcoded constants. Tomba 2's 21 A*.BIN overlays converge on a single
consistent base 0x80108F9C (region 0x80108000 +3996).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
2026-07-17 20:19:03 -07:00
..