fix(hacks): add tflitefix to prevent SIGSEGV crash in games using TensorFlow Lite under ARM translation #281

2026-08-14T05:21:34-04:00

sr00t3d commented

2026-08-14 05:21:34 -04:00

(Migrated from github.com)

Summary

This PR adds a new hack option tflitefix to waydroid_script that resolves a known SIGSEGV (null-pointer dereference) crash in ARM64 games utilizing TensorFlow Lite with the Ruy matrix acceleration backend (such as Epic Seven - com.stove.epic7.google) running under Waydroid with libhoudini.

Problem Description

When games invoke TensorFlow Lite routines (e.g., during chest drops, summoning, or neural net inference), tflite::CpuBackendContext::RuyHasAvxOrAbove() attempts to query microarchitecture CPU capability registers.
Under x86_64 binary translation layers (libhoudini), this query returns NULL.
Because the function lacks a null pointer check:

0x2e92e4: bl  0x2e9e3c
0x2e92e8: ldr x9, [x0, #0x8]   <-- x0 is NULL -> dereferences 0x8 -> SIGSEGV crash in GLThread

Solution

The tflitefix module (stuff/tflitefix.py) scans installed app packages for libtensorflowlite.so and applies a safe binary patch to offset 0x2e9204 with an immediate return opcode (0xd65f03c0 ret), safely bypassing the null pointer dereference. Full backup (.orig) and uninstallation (sudo python main.py remove tflitefix) support is included.

Usage

To apply the patch: sudo python main.py hack tflitefix
To restore the original unmodified library: sudo python main.py remove tflitefix

Testing

Tested on Waydroid with LineageOS 20 (Android 13) x86_64 and libhoudini.
Confirmed that Epic Seven boots, downloads patches, and successfully opens chests/summonings without crashing.

### Summary This PR adds a new hack option `tflitefix` to `waydroid_script` that resolves a known `SIGSEGV` (null-pointer dereference) crash in ARM64 games utilizing TensorFlow Lite with the *Ruy* matrix acceleration backend (such as *Epic Seven* - `com.stove.epic7.google`) running under Waydroid with `libhoudini`. ### Problem Description When games invoke TensorFlow Lite routines (e.g., during chest drops, summoning, or neural net inference), `tflite::CpuBackendContext::RuyHasAvxOrAbove()` attempts to query microarchitecture CPU capability registers. Under x86_64 binary translation layers (`libhoudini`), this query returns `NULL`. Because the function lacks a null pointer check: ```arm64 0x2e92e4: bl 0x2e9e3c 0x2e92e8: ldr x9, [x0, #0x8] <-- x0 is NULL -> dereferences 0x8 -> SIGSEGV crash in GLThread ``` ### Solution The `tflitefix` module (`stuff/tflitefix.py`) scans installed app packages for `libtensorflowlite.so` and applies a safe binary patch to `offset 0x2e9204` with an immediate return opcode (`0xd65f03c0 ret`), safely bypassing the null pointer dereference. Full backup (`.orig`) and uninstallation (`sudo python main.py remove tflitefix`) support is included. ### Usage - To apply the patch: `sudo python main.py hack tflitefix` - To restore the original unmodified library: `sudo python main.py remove tflitefix` ### Testing - Tested on Waydroid with LineageOS 20 (Android 13) x86_64 and `libhoudini`. - Confirmed that Epic Seven boots, downloads patches, and successfully opens chests/summonings without crashing. <img width="1920" height="1127" alt="image" src="https://github.com/user-attachments/assets/6c14fcec-59c6-4238-9e4f-662f7db0352a" />

Checking for merge conflicts…

View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.

git fetch -u origin sr00t3d/feature/tflite-crash-fix:sr00t3d/feature/tflite-crash-fix

git checkout sr00t3d/feature/tflite-crash-fix

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: wbruno/waydroid_script#281