feat: implement cosf, time, ctype tables, tracked heap access, IL2CPP lookup ABI paths (#542)

* fix: add Messenger CRT and AGC compatibility shims

* fix: keep Messenger IL2CPP bootstrap on HLE shims

* Fix Messenger compatibility ABI handling

* Make IL2CPP ABI regression tests portable

src/SharpEmu.Core/Cpu/Native/DirectExecutionBackend.Imports.cs

@@ -2168,25 +2168,18 @@ public sealed partial class DirectExecutionBackend
 		}
 
 		var symbolNameAddress = cpuContext[CpuRegister.Rdi];
-		var outputAddress = cpuContext[CpuRegister.Rsi];
 		if (!TryReadAsciiZ(symbolNameAddress, 512, out var symbolName) ||
-			outputAddress == 0 ||
-			!TryResolveIl2CppApiAddress(symbolName, out var resolvedAddress) ||
-			!TryWriteUInt64Compat(outputAddress, resolvedAddress))
+			!TryResolveIl2CppApiAddress(symbolName, out var resolvedAddress))
 		{
 			Console.Error.WriteLine(
-				$"[LOADER][WARN] il2cpp_api_lookup_symbol failed: name='{symbolName}' out=0x{outputAddress:X16}");
-			if (outputAddress != 0)
-			{
-				_ = TryWriteUInt64Compat(outputAddress, 0);
-			}
-
-			cpuContext[CpuRegister.Rax] = ulong.MaxValue;
-			return OrbisGen2Result.ORBIS_GEN2_OK;
+				$"[LOADER][WARN] il2cpp_api_lookup_symbol failed: name='{symbolName}'");
+			// il2cpp_api_lookup_symbol is a normal one-argument pointer-returning
+			// function. In particular, RSI is not an output pointer; the title's
+			// caller leaves it live from an earlier call. Do not write through it.
+			return Il2CppApiLookupAbi.SetResult(cpuContext, resolved: false, address: 0);
 		}
 
-		cpuContext[CpuRegister.Rax] = 0;
-		return OrbisGen2Result.ORBIS_GEN2_OK;
+		return Il2CppApiLookupAbi.SetResult(cpuContext, resolved: true, resolvedAddress);
 	}
 
 	private bool TryResolveIl2CppApiAddress(string symbolName, out ulong address)
@@ -2196,8 +2189,23 @@ public sealed partial class DirectExecutionBackend
 			return true;
 		}
 
-		return Aerolib.Instance.TryGetByExportName(symbolName, out var symbol) &&
-			TryResolveRuntimeSymbolAddress(symbol.Nid, out address);
+		if (Aerolib.Instance.TryGetByExportName(symbolName, out var symbol) &&
+			TryResolveRuntimeSymbolAddress(symbol.Nid, out address))
+		{
+			return true;
+		}
+
+		// Unity's IL2CPP API table is populated through this resolver, then the
+		// returned pointers are called directly by the title. Use the callable
+		// zero-return stub for missing APIs rather than a non-callable sentinel.
+		if (symbolName.StartsWith("il2cpp_", StringComparison.Ordinal) &&
+			_unresolvedReturnStub != 0)
+		{
+			address = (ulong)_unresolvedReturnStub;
+			return true;
+		}
+
+		return false;
 	}
 
 	private OrbisGen2Result DispatchBootstrapBridge()

src/SharpEmu.Core/Cpu/Native/Il2CppApiLookupAbi.cs

@@ -0,0 +1,18 @@
+// Copyright (C) 2026 SharpEmu Emulator Project
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+using SharpEmu.Core.Cpu;
+using SharpEmu.HLE;
+
+namespace SharpEmu.Core.Cpu.Native;
+
+internal static class Il2CppApiLookupAbi
+{
+    internal static OrbisGen2Result SetResult(CpuContext context, bool resolved, ulong address)
+    {
+        // il2cpp_api_lookup_symbol is a normal pointer-returning function:
+        // the result is in RAX and RSI remains caller-owned state.
+        context[CpuRegister.Rax] = resolved ? address : 0;
+        return OrbisGen2Result.ORBIS_GEN2_OK;
+    }
+}