From 6a7e0b3bae04a5a4667267b6a45baddeb66fc570 Mon Sep 17 00:00:00 2001
From: salmonik <salmonik@tuta.io>
Date: Wed, 4 Nov 2026 13:19:50 +0100
Subject: Fix No spread on the hl2_complete server build

The server RandomSeed GOT slot was hardcoded to 0xce1348, measured on the
older bin/server.so. The anniversary branch loads hl2_complete/bin/server.so,
whose R_386_JMP_SLOT for RandomSeed is 0xce5348, so the patch hit unrelated
writable data and no spread silently did nothing.

- Read the relocation from the loaded module's ELF (module_jump_slot) instead
  of hardcoding, with the two known offsets as fallback.
- Override whenever the RandomSeed caller's `this` is the local server player
  (CBaseEntity::FireBullets) instead of matching a hardcoded return-address
  range that also moved between builds.
- m_takedamage is a char (FIELD_CHARACTER) in the 2013 SDK; resolve it as such
  and read a byte, so the IMMUNE damage tag actually works.
---
 src/hl2h.cpp | 50 +++++++++++++++++++++++++++++++++++---------------
 1 file changed, 35 insertions(+), 15 deletions(-)

(limited to 'src/hl2h.cpp')

diff --git a/src/hl2h.cpp b/src/hl2h.cpp
index 28b2995..7ce35d3 100644
--- a/src/hl2h.cpp
+++ b/src/hl2h.cpp
@@ -471,11 +471,12 @@ static bool jumpbug_apply(CUserCmd *cmd, int local, void *ent, int flags,
 // server RandomSeed diagnostic / override
 // ---------------------------------------------------------------------------
 //
-// The installed 2024 server build is stripped and its usercmd/server-random-seed
-// handling differs from the 2013 SDK source. This hook is installed on the
-// server.so GOT slot for RandomSeed (R_386_JUMP_SLOT at vaddr 0xce1348) so we
-// can see which seed FireBullets actually uses and optionally force the chosen
-// spread seed. Disabled unless HL2H_SEED_TRACE / HL2H_SEED_FORCE are set.
+// The server is a stripped build whose usercmd/random-seed handling differs
+// from the 2013 SDK source. Hook the server.so PLT slot for RandomSeed so we
+// can force the chosen spread seed. The GOT offset is read from the loaded
+// module's relocation table at runtime (module_jump_slot): hardcoding it broke
+// when Steam switched to the hl2_complete/server.so branch (0xce1348 ->
+// 0xce5348).
 
 static void (*g_real_random_seed)(int) = nullptr;
 static uintptr_t g_srv_base = 0;
@@ -487,8 +488,10 @@ static void hkdSrvRandomSeed(int seed) {
   long off = (long)(ret - g_srv_base);
   static bool trace = getenv("HL2H_SEED_TRACE") != nullptr;
   static int logs = 0;
-  bool bullet_site = (off >= 0x216900 && off <= 0x216930);
 
+  // The caller's first argument is `this`. Only FireBullets is called on the
+  // player entity; the CUniformRandomStream wrappers and the constructor-time
+  // RandomSeed(0) reset have a different object there.
   void *frame = nullptr;
   __asm__ volatile("movl %%ebp, %0" : "=r"(frame));
   if (frame)
@@ -497,7 +500,7 @@ static void hkdSrvRandomSeed(int seed) {
   bool local = self && g_local_server_player &&
                (uintptr_t)self == g_local_server_player;
 
-  if (bullet_site && local && feature_active(FEAT_SPREAD) &&
+  if (local && g_server.contains(ret) && feature_active(FEAT_SPREAD) &&
       spread_no_spread_enabled()) {
     int pellets = g_spread_pellets;
     if (pellets < 1)
@@ -516,12 +519,10 @@ static void hkdSrvRandomSeed(int seed) {
     idx++;
   }
 
-  if (trace && (bullet_site || logs < 12)) {
-    if (logs < 200) {
-      logs++;
-      logd("srvseed: seed=%d off=0x%lx bullet=%d self=%p local=%d", seed, off,
-           (int)bullet_site, self, (int)local);
-    }
+  if (trace && logs < 200) {
+    logs++;
+    logd("srvseed: seed=%d off=0x%lx self=%p local=%d", seed, off, self,
+         (int)local);
   }
   if (g_real_random_seed)
     g_real_random_seed(seed);
@@ -532,9 +533,28 @@ static void install_seed_hook() {
   if (g_seed_hook_installed || failed || !g_server.valid())
     return;
   g_srv_base = g_server.ranges[0].lo;
-  uintptr_t slot = g_srv_base + 0xce1348; // R_386_JUMP_SLOT RandomSeed
-  if (!g_server.contains(slot))
+  uintptr_t reloc = 0, bias = 0;
+  uintptr_t slot = 0;
+  if (module_jump_slot(g_server.path.c_str(), "RandomSeed", &reloc, &bias)) {
+    slot = g_srv_base + reloc - bias;
+    logf("seed hook: RandomSeed GOT reloc=%#lx bias=%#lx -> %#lx",
+         (unsigned long)reloc, (unsigned long)bias, (unsigned long)slot);
+  } else {
+    // ELF parse failed (deleted/unreadable module); try the builds we know.
+    static const uintptr_t known[] = {0xce5348, 0xce1348};
+    for (size_t i = 0; i < sizeof(known) / sizeof(known[0]) && !slot; i++) {
+      uintptr_t cand = g_srv_base + known[i];
+      if (g_server.contains(cand))
+        slot = cand;
+    }
+    logf("seed hook: ELF reloc scan failed, fallback slot=%#lx",
+         (unsigned long)slot);
+  }
+  if (!slot || !g_server.contains(slot)) {
+    failed = true;
+    logf("seed hook: no writable RandomSeed slot");
     return;
+  }
   g_real_random_seed =
       (void (*)(int))dlsym(RTLD_NEXT, "RandomSeed");
   if (!g_real_random_seed)
-- 
cgit v1.2.3