====================================================================================
#
# this file has been created for the Lame patcher program available for both *nix
# and Windows platforms.
# You need this program for continuing the patching of your files:
#
#   http://aluigi.org/mytoolz.htm#lpatch
#
# Quick step-by-step for Windows:
# - launch lpatch.exe
# - select this voiceindexfix.lpatch file
# - read the message windows and click yes
# - select the file (usually executables or dlls) to patch
# - read the message windows to know if everything has been patched correctly
# - test your game
#
# Quick step-by-step for Linux:
# - use lpatch.x86 or compile it: gcc -o lpatch lpatch.c md5.c
# - launch ./lpatch voiceindexfix.lpatch
# - read the text messages
# - specify the name of the file to patch
# - read the text messages to know if everything has been patched correctly
# - test your game

TITLE
    "VoiceIndex<VOICE_MAX_CHATTERS" / NULL pointer fix for UT2004 and America's Army 0.1a
    by Luigi Auriemma
    e-mail: aluigi@autistici.org
    web:    aluigi.org

INTRO
    This work-around is referred to the vulnerability described here:
    .
    . http://aluigi.org/adv/ut2004null-adv.txt
    . http://aluigi.org/adv/armynchia-adv.txt
    .
    The problem is caused by an assertion (in some cases a NULL pointer) which
    checks if one value is smaller than another and fails when both are zero.
    My solution is very simple, I have just removed the assertion and everything
    works fine on my Windows test server.
    Anyway for the moment this work-around is marked as experimental so report any
    problem which happens when you test the server patched with this work-around
    using the provided proof-of-concepts (this work-around modifies only a part
    of the code which is executed when happens the bug, so in normal conditions
    there are no problems)
    .
    This patch has been created only for the latest known patches of the games which
    are vulneable on Windows (maybe in future will be added support to Linux too),
    older versions will be NOT supported by me so don't ask.

FILE
    engine.dll;engine.so;ucc-bin*


ONLY_ONE


    ; Windows
BYTES_ORIGINAL
    39 58 ??                ; cmp dword ptr [eax+48], ebx
    0F 85 ?? ?? ?? ??       ; jne 10424860
    80 7E ?? 40             ; cmp byte ptr [esi+74], 40
    72 14                   ; jb 10424778
    68 ?? ?? ?? ??          ; push 000006FD
    68 ?? ?? ?? ??          ; push 106A2DB0
    68 ?? ?? ?? ??          ; push 106A42B4
    FF D7                   ; call edi
    83 C4 0C                ; add esp, 0000000C

BYTES_PATCH
    ?? ?? ??
    90 e9                   ; jmp


# note: at the moment doesn't work on Linux
#
#    ; Linux (UT2004 3369)
#BYTES_ORIGINAL
#    8B 53 3C                ; mov edx, dword ptr [ebx+3C]
#    85 D2                   ; test edx, edx
#    0F 85 ?? ?? 00 00       ; jne 0000013F
#    0F B6 56 68             ; movzx edx, byte ptr [esi+68]
#    80 FA 3F                ; cmp dl, 3F
#    88 55 CF                ; mov byte ptr [ebp-31], dl
#    0F 87 ?? ?? 00 00       ; ja 000001BF
#
#BYTES_PATCH
#    ?? ?? ??
#    ?? ??
#    ?? ?? ?? ?? ?? ??
#    ?? ?? ?? ??
#    ?? ?? ??
#    ?? ?? ??
#    90 90 90 90 90 90       ; do not jump
#
#
#    ; Linux (UT2004 3355)
#BYTES_ORIGINAL
#    8B 5F 40                ; mov ebx, dword ptr [edi+40]
#    85 DB                   ; test ebx, ebx
#    0F 85 ?? ?? 00 00       ; jne 0000011F
#    0F B6 5E 6C             ; movzx ebx, byte ptr [esi+6C]
#    80 FB 3F                ; cmp bl, 3F
#    88 5D CF                ; mov byte ptr [ebp-31], bl
#    0F 87 ?? ?? 00 00       ; ja 000001B6
#
#BYTES_PATCH
#    ?? ?? ??
#    ?? ??
#    ?? ?? ?? ?? ?? ??
#    ?? ?? ?? ??
#    ?? ?? ??
#    ?? ?? ??
#    90 90 90 90 90 90       ; do not jump


====================================================================================