Another RCBot crash, this time in GetNewDLLFunctions

[jarcen]

After #1899 was fixed I can finally get into game but soon found another crash caused by manual map change.

1. Start a LAN multiplayer server. Wait for map load.
2. Type restart or map subtransit. Crash will occur.

Same story: works in vanilla, crashes in Xash3D.

Message box:

Ver: Xash3D FWGS 0.21 (build 3531-1f5c979, win32-i386)
Sys_Crash: address 1002873B, code C0000005
0 1002873B GetNewDLLFunctions (rcbot.dll)
1 779E3BA7 wcstok_s (ntdll.dll)
2 77998684 LdrGetProcedureAddressForCaller (ntdll.dll)
3 5E0705F0 DrvValidateVersion (nvoglv32.dll)

Stack trace is completely different on each crash, only first line with GetNewDLLFunctions remains same.

Console output says nothing interesting. With -dev 2 additional line appears couldn't exec maps/crossfire_unload.cfg but creating that file does nothing to fix the crash.

[a1batross]

Can you check it with the latest commit?

[jarcen]

build-3532-fb964b8, win32-i386 Still the same crash in GetNewDLLFunctions. I see the fix attempts to not unload DLL. I don't know anything about engine code, but occasionally I see in stack trace of the crash LdrUnloadDll repeated three times. If this is relevant, the attempt to prevent that might not been thorough.

I also should note that the crash only occurs when changing map from console and while there is an active LAN game. Pressing Disconnect and then starting game with map subtransit does not crash. Starting another LAN game from menu while there is an active LAN game also doesn't crash. The precise condition is console command while LAN game is running.

[a1batross]

I will look into it as soon as I will be near my PC then.

[a1batross]

It's not actually GetNewDLLFunctions, address 1002873B points elsewhere.

I know RCBot is opensource, but it seems that version it was compiled from is lost to time.

[jarcen]

Well, that's what crash message tells me. Are you getting same address or relying only on my information? It's not guaranteed that DLL base address remains same: https://stackoverflow.com/questions/8716375/is-dll-always-have-the-same-base-address

Process Hacker tells me on my system rcbot.dll is loaded at 0x10000000, means you need to look at offset +0x0002873B.

[jarcen]

Managed to monkey-patch the rcbot.dll.
First, patch at +28727h to replace branching with jmp, but then it gave me a new crash:

0 10003263 CBaseEntity:SUB_CallUseToggle (rcbot.dll)
1 7538CCE6 FreeLibrary (KERNELBASE.dll)

Another patch at +3254h replacing instruction with jmp. Crashing is apparently gone now.

Bots run. On a basis of my shallow testing, I'd say nothing changed. I have NO IDEA what are the consequences of the patch. This just reroutes around problematic code without me understanding what it did. I need to study some proper disassembly tools like Ghidra to see what is the actual cause of the crash instead of masking it. For now, if anyone on the Internet is suffering from same trouble, I hope search will bring them here.

Artifacts:

Original rcbot.dll, SHA-256: A2675FFDA965616E03426CD179446EE75790A206A451359244FBD8000A928946
Can be obtained from RockCrowbar.zip, posted in #1899

patch.1337 if you want to apply it manually:

>rcbot.dll
00003254:0F->E9
00003255:85->C4
00003256:C3->00
00003259:00->90
00028727:0F->E9
00028728:84->53
00028729:52->22
0002872A:22->00
0002872C:00->90

Patched rcbot.dll, SHA-256: FB009530D33E25FEB34906DCA8ECE8B5F9E0A780DB76C3CA3F2B5604125FB431
Download patched dll: rcbot.dll.zip

[a1batross]

Yeah, it seems the DLL gets loaded at static address and it's always the same. Quite useful because I can just type that address into Ghidra and it shows me the exact line. But I don't know what that means, it doesn't look like it calls engine there, just dereferences NULL ptr with an offset there. Why not take the latest RCBot version? It's probably still works with RockCrowbar чт, 5 дек. 2024 г., 06:59 jarcen ***@***.***>:

…

Managed to monkey-patch the rcbot.dll. First, patch at +28727h to replace branching with jmp, but then it gave me a new crash: 0 10003263 CBaseEntity:SUB_CallUseToggle (rcbot.dll) 1 7538CCE6 FreeLibrary (KERNELBASE.dII) Another patch at +3254h replacing instruction with jmp. Crashing is apparently gone now. Bots run. On a basis of my shallow testing, I'd say nothing changed. I have NO IDEA what I changed. This just reroutes around problematic code without me understanding what it did. I need to study some proper disassembly tools like Ghidra to see what is the actual cause of the crash. For now, if anyone on the Internet is suffering from same trouble, I hope search will bring them here. Artifacts: Original rcbot.dll, SHA-256: A2675FFDA965616E03426CD179446EE75790A206A451359244FBD8000A928946 Can be obtained from RockCrowbar.zip <https://github.com/user-attachments/files/17962983/RockCrowbar.zip>, posted in #1899 <#1899> patch.1337 if you want to apply it manually: >rcbot.dll 00003254:0F->E9 00003255:85->C4 00003256:C3->00 00003259:00->90 00028727:0F->E9 00028728:84->53 00028729:52->22 0002872A:22->00 0002872C:00->90 Patched rcbot.dll, SHA-256: FB009530D33E25FEB34906DCA8ECE8B5F9E0A780DB76C3CA3F2B5604125FB431 Download patched dll: rcbot.dll.zip <https://github.com/user-attachments/files/18017059/rcbot.dll.zip> — Reply to this email directly, view it on GitHub <#1904 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAYQTAMGWRSOSP2J35PIQ5T2D7FRJAVCNFSM6AAAAABSY5Y23CVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDKMJZGAZTMOBVGQ> . You are receiving this because you commented.Message ID: ***@***.***>

[jarcen]

This one? https://github.com/APGRoboCop/rcbotold/releases

I tried. Just retried to be sure. In latest release v1.51-beta9 bots refuse to spawn. Likely they get stuck in spectator mode and can't get past "press Jump to play" screen. Older v1.5-final just straight up crashes when adding bots. No error message, nothing in console, pop goes game window.

I guess I'll bug the devs there. Here problem is again "kinda" solved with my patch. I'm not sure if in near time I'll take on a proper disassembly. If you believe you can do nothing on your end then you can close the issue.

[a1batross]

If it doesn't happen on GoldSrc, then it's our bug. But at least it would be much easier to debug with source code being available.