RagnarokOnline Patcher Lite (c) 2009-2021 Ai4rei/AN

Whole thing started with me accidentally opening a 64-bit release in a hex editor, only to see a fragment of random source code embedded around the PE header. That's not something that is supposed to be inside a compiled executable file, nor was it rsu source code in the first place. Taking a look at the uploaded 64-bit releases, the result was the same, so I pulled them; the 32-bit releases were clean.

Doing a few more 64-bit compiles revealed, that the fragments come from free disk space; basically an information disclosure vulnerability. Now who is at fault? The 64-bit build-chain is not local (because VS2019 does not run on Win98 obviously), so the remote Win7 machine mounts the rsu source share and builds it.

To do tests, I made an application that fills all free disk space with the string "DISCLOSE" and ran it before every test build. Doing 32-bit builds on the remote Win7 machine fails the test. Doing 64-bit builds (VS2005 and VS2010) from a remote WinXP machine worked fine. So it's not a 64-bit thing. To rule out the OS variable, I tried a 64-build with VS2005 on Win7; fails. And a 32-bit build with VS6 on the same machine; clean. Doing the 64-build on Win7 locally passes the test.

TL;DR: In short, combining Visual C++ 2005 (maybe even 2003) on Win7 (maybe even Vista) and a Win98 network share is a bad idea, as it leads to information disclosure. Not sure why WinXP is not affected, but the general reason for this vulnerability is probably that the Win7+VS2005/2019 installation assumes the contents of pre-allocated files to be zero-initialized, which they aren't on Win98.

So, unfortunately¹⁾²⁾, VS2019 will only serve for internal builds, public builds will use VS2005 or VS2010, depending on which one does better on current hardware.

1. Since Microsoft is not going to fix a vulnerability that occurs only in one case on a 23 year old OS
2. It was a great help when migrating to 64-bit

Native 64-bit releases (built with MSVC 2019) have been pulled for investigation/questioning. Data is not at risk, but you are better off using the 32-bit version (built with MSVC 6) for now.

This release fixes, among others, an issue that prevented updating jRO RAG, when there are more than one year worth of patches to apply.

This major release contains a refreshed UI, completely reworked GRF engine, native 64-bit builds and other, far too many under-the-hood changes and bug fixes to mention them all, see included doc/history.txt for details.

Can be found in the news archives.