crash.cpp

#include <windows.h>
#include "a2mgr.h"

DWORD _stdcall CheckValid(LPVOID what, DWORD count = 4)
{
    if(!IsBadReadPtr(what, count)) return (DWORD)what;
    return 0;
}

DWORD _stdcall CheckValidW(LPVOID what, DWORD count = 4)
{
    if(!IsBadWritePtr(what, count)) return (DWORD)what;
    return 0;
}

void __declspec(naked) CRASH_fix_414994()
{
    __asm
    {
        push	4
        push	eax
        call	CheckValid
        test	eax, eax
        jz		ret_bad

        mov		eax, [eax]
        push	0x38
        push	eax
        call	CheckValid
        test	eax, eax
        jz		ret_bad

        mov		ecx, [eax+0x34]
        and		ecx, 1
        
        mov		edx, 0x0041499C
        jmp		edx

ret_bad:
        mov		edx, 0x00417BE5
        jmp		edx
    }
}

void __declspec(naked) CRASH_fix_42353A()
{
    __asm
    {
        push	8
        push	eax
        call	CheckValid
        test	eax, eax
        jz		ret_bad

        mov		ecx, [eax+4]
        mov		edx, [ebp+0x08]
        lea		eax, [ecx+edx*4]
        mov		esp, ebp
        pop		ebp
        retn	4

ret_bad:
        xor		eax, eax
        mov		esp, ebp
        pop		ebp
        retn	4
    }
}

void __declspec(naked) CRASH_fix_523295()
{
//+fix for spell range calculating:
// all spells use data.bin-spells-maxRange value (1 byte = base, 2 byte = divider)
// range = 0, if base=0
// range = base + spell_level / divider, if base <> 0
// if divider = 0 in data.bin, default divider = 3 for teleport, 30 for other spells
    __asm
    {
        push	4
        push	eax
        call	CheckValid
        test	eax, eax
        jz		ret_bad

//		mov		ecx, [ebp-0x0C]
//		mov		dl, [eax]
//		mov		[ecx+0x09], dl
//		mov		eax, [ebp-0x0C]
//		xor		ecx, ecx
//		mov		cl, [eax+0x08]
//		cmp		ecx, 0x17
//
//		mov		edx, 0x005232A5
//		jmp		edx

        mov		ecx, [eax]
        or		cl,cl
        je		range_end // range = 0
        mov		edx, [ebp-0x0C]
        cmp		byte ptr [edx+0x08], 0x17
        jne		spell_not_tp

        mov		al, 3
        jmp		spell_any
spell_not_tp:
        mov		al, 30
spell_any:
        or		ch,ch
        jne		default_range
        mov		ch,al
default_range:
        xor		eax,eax
        mov		al, [ebp+0x08]
        cwde
        div		ch
        add		cl,al
range_end:
        mov		edx, 0x005232EB
        jmp		edx


ret_bad:
        mov		edx, 0x005234A3
        jmp		edx
    }
}

void __declspec(naked) CRASH_fix_46AD10()
{
    __asm
    {
        mov		edx, [ebp-0x58]
        movsx	eax, word ptr [edx+0x104]
        movsx	ecx, word ptr [edx+0x108]
        cmp		eax, ecx
        jle		skip_replace

        mov		word ptr [edx+0x104], cx

skip_replace:
        mov		edx, [ebp-0x58]
        movsx	eax, word ptr [edx+0x104]
        mov		ecx, [ebp-0x20]
        sub		ecx, [ebp-0x18]
        sub		ecx, 8
        imul	eax, ecx
        mov		edx, [ebp-0x58]
        movsx	ecx, word ptr [edx+0x108]
        cdq

        cmp		ecx, 0
        jz		skip_div
        idiv	ecx
        mov		[ebp-0x08], eax
        jmp		retc

skip_div:
        mov		[ebp-0x08], 0

retc:
        cmp		[ebp-0x08], 0
        mov		edx, 0x0046AD3A
        jmp		edx
    }
}

void __declspec(naked) CRASH_fix_420450()
{
    __asm
    {
        push	0x0C
        push	ecx
        call	CheckValid
        test	eax, eax
        jz		ret_bad

        mov		edx, [eax+0x08]
        mov		eax, [ebp+0x08]
        shl		eax, 8
        lea		eax, [edx+eax*2]
        mov		esp, ebp
        pop		ebp
        retn	4

ret_bad:
        xor		eax, eax
        mov		esp, ebp
        pop		ebp
        retn	4
    }
}

void __declspec(naked) CRASH_fix_45FC3B()
{
    __asm
    {
        push	0x14
        push	ecx
        call	CheckValid
        test	eax, eax
        jz		ret_bad
        mov		[ebp-0x10], eax
        mov		eax, 0x006297E4
        cmp		[eax], 0
        jz		loc_45FC4E

        mov		edx, 0x0045FC47
        jmp		edx

ret_bad:
loc_45FC4E:
        mov		edx, 0x0045FC4E
        jmp		edx
    }
}

void __declspec(naked) CRASH_fix_458CF9()
{
    __asm
    {
        push	[ebp-0x04]
        push	[ebp-0x08]
        call	CheckValidW
        test	eax, eax
        jz		ret_bad

        push	[ebp-0x04]
        push	[ebp-0x0C]
        call	CheckValid
        test	eax, eax
        jz		ret_bad

        push	[ebp-0x04]
        push	[ebp-0x0C]
        push	[ebp-0x08]
        mov		edx, 0x00458D05
        jmp		edx

ret_bad:
        xor		eax, eax
        mov		edx, 0x00458D24
        jmp		edx
    }
}

void __declspec(naked) CRASH_fix_4657AD()
{
    __asm
    {
        push	1
        push	ecx
        call	CheckValid
        test	eax, eax
        jz		ret_bad

        movsx	edx, byte ptr [eax]
        mov		[ebp-0x10], edx
        mov		eax, [ebp-0x28]
        add		eax, 1
        mov		[ebp-0x28], eax

        mov		edx, 0x004657BC
        jmp		edx

ret_bad:
        xor		eax, eax
        mov		edx, 0x0046584C
        jmp		edx
    }
}

void __declspec(naked) CRASH_fix_46B685()
{
    __asm
    {
        push	0x2C
        push	ecx
        call	CheckValid
        test	eax, eax
        jz		ret_bad

        cmp		dword ptr [eax+0x28], 0
        jle		loc_46B698

        mov		edx, 0x0046B68B
        jmp		edx

loc_46B698:
        mov		edx, 0x0046B698
        jmp		edx

ret_bad:
        xor		eax, eax
        mov		edx, 0x0046C246
        jmp		edx
    }
}

void __declspec(naked) shop_init_2(void)
{
    _asm
    {
        mov	dword ptr [edx+0x164], 0
        mov	dword ptr [edx+0x168], 0
        mov	dword ptr [edx+0x16C], 0
        mov	dword ptr [edx+0x170], 0
        mov	dword ptr [edx+0x174], 0
        mov	dword ptr [edx+0x178], 0
        mov	dword ptr [edx+0x17C], 0
        retn
    }
}

void __declspec(naked) CRASH_fix_4BEE2D()
{
    __asm
    {
        call	shop_init_2
        mov		edx, 0x004BEE34
        jmp		edx
    }
}

void __declspec(naked) CRASH_fix_4AAB7E()
{
    __asm
    {
        test	ecx, ecx
        jz		ret_bad

        mov		edx, [ecx]
        mov		ecx, [ebp-0x114]
        mov		ebx, 0x004AAB86
        jmp		ebx

ret_bad:
        mov		edx, 0x004AAD31
        jmp		edx
    }
}

void __declspec(naked) CRASH_fix_multiwindow_1()
{
    __asm
    {
        push	u_pid_string
        lea		edx, [ebp-0x230]
        push	edx
        mov		edx, 0x0049C15F
        jmp		edx
    }
}

void __declspec(naked) CRASH_fix_multiwindow_2()
{
    __asm
    {
        push	u_pid_string
        lea		ecx, [ebp-0x66C]
        push	ecx
        mov		edx, 0x0049C66D
        jmp		edx
    }
}

void __declspec(naked) CRASH_fix_multiwindow_3()
{
    __asm
    {
        push	u_pid_string
        lea		edx, [ebp-0x288]
        push	edx
        mov		edx, 0x004B7BA0
        jmp		edx
    }
}

void __declspec(naked) CRASH_fix_multiwindow_4()
{
    __asm
    {
        push	u_pid_string_delete
        lea		ecx, [ebp-0x340]
        push	ecx
        mov		edx, 0x0048724A
        jmp		edx
    }
}