WC3 1.29.2 client support (with real password auth)

[Vegasq]

WC3 1.29.2 client support (with real password auth)

Adds enough server- and client-side glue for a vanilla Warcraft III
1.29.2.9231 client to log into PvPGN with a properly verified password.

The SRP3 protocol divergence between PvPGN and 1.29 — PvPGN's
implementation was written for 1.27/1.28 and the proofs don't match —
is sidestepped W3CE-style: the client is patched to emit
bnet_hash(password) where SRP3 would have sent its M1, and PvPGN's
existing legacy passhash1 / hash_eq fallback validates that
without any server-side cryptographic bypass.

End-to-end working against an upstream-style PvPGN. Wrong passwords
fail. Login then proceeds to channel join, MOTD, etc. as normal.

Server-side changes

• conf/versioncheck.json.in — adds 0x1d verbyte rows under
  both WAR3 and W3XP blocks for game version 1.29.2.15
  (CheckRevision 0x3cc7eaf6).
• src/bnetd/handle_bnet.cpp:2951 — fix a pre-existing {fmt}
  crash in _client_motdw3. The line fmt::format_to(serverinfo, "{}" + '\n', ...) was C++ pointer arithmetic, not string
  concatenation, and crashed bnetd with FATAL ERROR: argument index out of range the first time the W3 MOTD was rendered. Fixed to
  "{}\n". Independent of 1.29 work but only manifested with 1.29
  because that was the first version that got far enough to request
  the W3 MOTD on this code path.

Client-side patcher (new, contrib/wc3-1.29-client-patch/)

A Linux-side EXE patcher that produces a self-contained patched
Warcraft III.exe — no DLLs, no loaders, no runtime injection.

Mirrors what
W3CE's
PvPGNPatcher does (analysed from W3CE-v0.2.1-alpha) but as a static
patch.

The patcher appends a new PE section (.pvpgnh) containing:

• A port of PvPGN's bnet_hash() from src/common/bnethash.cpp
  (do_blizzard_hash variant), compiled from C with no libc and no
  external symbols.
• An LphChecked replacement (replaces the SRP3 M1 computation —
  the client now sends bnet_hash(lower(password)) as the 20-byte
  logon proof).
• A CreateAccount trampoline + wrapper that calls the original,
  then copies the plaintext password into the verifier slot — PvPGN
  reads this as a null-terminated plaintext string and stores
  passhash1 = bnet_hash(plaintext).

Plus four byte patches in .text:

Site	VA	Effect
auth_req	0x00831424	NOPs the JNE that fails the 128-byte server-signature compare. PvPGN sends an all-zero signature; this lets the client accept it.
M2 dispatch	0x00830DDB	74 21 → 75 20 flip. Lets the client accept an all-zero M2 reply (which is what PvPGN's legacy hash_eq success path emits).
LphChecked entry	0x0083A590	5-byte JMP to the new lph_checked_hook in the cave.
CreateAccount entry	0x00986A50	5-byte JMP to the new wrapper.

For 1.29.2.9231 the output is deterministic — current reference MD5
729ac6d7b8438d9579c9a1738ef2d42a.

Build:

sudo apt install gcc-multilib
python3 -m venv ~/venv && source ~/venv/bin/activate
pip install keystone-engine pefile capstone
cd contrib/wc3-1.29-client-patch
python3 build_payload.py /path/to/clean/Warcraft\ III.exe out.exe

Documentation

• docs/wc3-1.29-pvpgn-notes.md — full binary-analysis writeup of
  the 1.29.2.9231 internals: where the gateway INI lives (note the
  1.29-specific BattleNet\ subfolder), how CheckRevision is keyed,
  the auth_req signature hunt, the M2 verifier hunt, the motdw3 bug.
• docs/wc3-1.29-real-auth-plan.md — design plan + W3CE analysis
  that produced the patcher.
• contrib/wc3-1.29-client-patch/README.md — usage + caveats.

Caveats

• Authenticode signature is stripped on the client EXE. Modifying
  any byte breaks Blizzard's signature; the build also clears the
  Security data directory entry. Windows SmartScreen may warn
  ("Unknown Publisher") on first launch.
• ASCII passwords only. The LphChecked hook's lowercasing is
  ASCII A–Z. PvPGN's own create-account also lowercases ASCII-only
  via strtolower, so this matches upstream behaviour.
• Only 1.29.2.9231 is supported. Hardcoded against that build's
  byte offsets (vanilla MD5 c453b4a0bde1a47f41cb2475573edb84).
  Other 1.29.x sub-versions need offsets re-derived; methodology in
  the docs.
• No support for Reforged (1.32+). Reforged dropped classic
  BNCS entirely.

Testing

Verified end-to-end on a 1.29.2.9231 install on Windows 10, against
this branch's bnetd built on Ubuntu 24.04:

• Account creation stores passhash1 = bnet_hash(lower(password))
  and salt and verifier (the SRP3 ones from the client, unused
  by the legacy auth path).
• Login with the correct password takes the legacy
  _client_logonproofreq hash_eq success branch — log message
  "<user>" logged in (right password).
• Login with the wrong password is rejected — log message
  got wrong client password proof for "<user>".
• Client proceeds to channel join (Warcraft 3 Frozen Throne), MOTD
  loads, anongame info requests work.

[Meanski]

I don't have WC3 installed to confirm any of this. Accepting other reviewers to chime in