From 6a7e0b3bae04a5a4667267b6a45baddeb66fc570 Mon Sep 17 00:00:00 2001
From: salmonik <salmonik@tuta.io>
Date: Wed, 4 Nov 2026 13:19:50 +0100
Subject: Fix No spread on the hl2_complete server build

The server RandomSeed GOT slot was hardcoded to 0xce1348, measured on the
older bin/server.so. The anniversary branch loads hl2_complete/bin/server.so,
whose R_386_JMP_SLOT for RandomSeed is 0xce5348, so the patch hit unrelated
writable data and no spread silently did nothing.

- Read the relocation from the loaded module's ELF (module_jump_slot) instead
  of hardcoding, with the two known offsets as fallback.
- Override whenever the RandomSeed caller's `this` is the local server player
  (CBaseEntity::FireBullets) instead of matching a hardcoded return-address
  range that also moved between builds.
- m_takedamage is a char (FIELD_CHARACTER) in the 2013 SDK; resolve it as such
  and read a byte, so the IMMUNE damage tag actually works.
---
 src/modules.cpp | 99 +++++++++++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 99 insertions(+)

(limited to 'src/modules.cpp')

diff --git a/src/modules.cpp b/src/modules.cpp
index 70e2dff..b832694 100644
--- a/src/modules.cpp
+++ b/src/modules.cpp
@@ -1,5 +1,7 @@
 // modules.cpp — /proc/self/maps parsing and module discovery
 #include "hl2h.h"
+#include <elf.h>
+#include <vector>
 
 static bool basename_is(const char *path, const char *base) {
   size_t pl = strlen(path), bl = strlen(base);
@@ -70,3 +72,100 @@ void find_modules() {
   }
   fclose(f);
 }
+
+// ---------------------------------------------------------------------------
+// ELF relocation lookup
+// ---------------------------------------------------------------------------
+//
+// The server RandomSeed hook used to hardcode the GOT offset measured on one
+// server.so build. The anniversary branch ships a different server.so
+// (hl2_complete/bin/server.so) whose slot moved, so the patch silently landed
+// on unrelated data and No spread stopped working. Read the loaded module's
+// ELF relocation table instead: find the R_386_JMP_SLOT for a symbol and
+// return its virtual address plus the load bias implied by the first PT_LOAD.
+bool module_jump_slot(const char *path, const char *name, uintptr_t *out_vaddr,
+                      uintptr_t *out_bias) {
+  if (!path || !*path || !name)
+    return false;
+  FILE *f = fopen(path, "rb");
+  if (!f)
+    return false;
+  if (fseek(f, 0, SEEK_END) != 0) {
+    fclose(f);
+    return false;
+  }
+  long sz = ftell(f);
+  if (sz < (long)sizeof(Elf32_Ehdr) || fseek(f, 0, SEEK_SET) != 0) {
+    fclose(f);
+    return false;
+  }
+  std::vector<unsigned char> buf((size_t)sz);
+  size_t got = fread(buf.data(), 1, buf.size(), f);
+  fclose(f);
+  if (got != buf.size())
+    return false;
+  if (buf.size() < sizeof(Elf32_Ehdr))
+    return false;
+
+  const Elf32_Ehdr *eh = (const Elf32_Ehdr *)buf.data();
+  if (memcmp(eh->e_ident, ELFMAG, SELFMAG) != 0 ||
+      eh->e_ident[EI_CLASS] != ELFCLASS32)
+    return false;
+  if (eh->e_shoff == 0 || eh->e_shentsize != sizeof(Elf32_Shdr))
+    return false;
+  if ((uint64_t)eh->e_shoff + (uint64_t)eh->e_shnum * sizeof(Elf32_Shdr) >
+      buf.size())
+    return false;
+  const Elf32_Shdr *sh = (const Elf32_Shdr *)(buf.data() + eh->e_shoff);
+
+  uintptr_t bias = 0;
+  if (eh->e_phoff && eh->e_phnum &&
+      eh->e_phentsize == sizeof(Elf32_Phdr) &&
+      (uint64_t)eh->e_phoff + (uint64_t)eh->e_phnum * sizeof(Elf32_Phdr) <=
+          buf.size()) {
+    const Elf32_Phdr *ph = (const Elf32_Phdr *)(buf.data() + eh->e_phoff);
+    for (int i = 0; i < eh->e_phnum; i++) {
+      if (ph[i].p_type == PT_LOAD) {
+        bias = ph[i].p_vaddr;
+        break;
+      }
+    }
+  }
+
+  for (int s = 0; s < eh->e_shnum; s++) {
+    if (sh[s].sh_type != SHT_REL || sh[s].sh_link >= eh->e_shnum)
+      continue;
+    if ((uint64_t)sh[s].sh_offset + (uint64_t)sh[s].sh_size > buf.size())
+      continue;
+    const Elf32_Shdr &symsh = sh[sh[s].sh_link];
+    if (symsh.sh_link >= eh->e_shnum)
+      continue;
+    const Elf32_Shdr &strsh = sh[symsh.sh_link];
+    if ((uint64_t)symsh.sh_offset + (uint64_t)symsh.sh_size > buf.size() ||
+        (uint64_t)strsh.sh_offset + (uint64_t)strsh.sh_size > buf.size())
+      continue;
+    const Elf32_Rel *rels = (const Elf32_Rel *)(buf.data() + sh[s].sh_offset);
+    size_t nrels = sh[s].sh_size / sizeof(Elf32_Rel);
+    const Elf32_Sym *syms = (const Elf32_Sym *)(buf.data() + symsh.sh_offset);
+    size_t nsyms = symsh.sh_size / sizeof(Elf32_Sym);
+    const char *strs = (const char *)(buf.data() + strsh.sh_offset);
+    size_t strn = strsh.sh_size;
+    for (size_t r = 0; r < nrels; r++) {
+      unsigned type = ELF32_R_TYPE(rels[r].r_info);
+      unsigned sym = ELF32_R_SYM(rels[r].r_info);
+      if (type != R_386_JMP_SLOT || sym >= nsyms)
+        continue;
+      if (syms[sym].st_name >= strn)
+        continue;
+      const char *sn = strs + syms[sym].st_name;
+      if (strcmp(sn, name) != 0)
+        continue;
+      if (out_vaddr)
+        *out_vaddr = rels[r].r_offset;
+      if (out_bias)
+        *out_bias = bias;
+      return true;
+    }
+  }
+  return false;
+}
-- 
cgit v1.2.3