From f57db35cec90de29b30633a8f6f6798f77e05984 Mon Sep 17 00:00:00 2001 From: Erik Date: Wed, 29 Jul 2026 01:59:47 +0200 Subject: [PATCH] fix(net): xpSpent is a dword on the wire, and we were sending eight bytes RaiseAttribute, RaiseVital, and RaiseSkill each wrote a 64-bit xpSpent, producing a 24-byte action where the server expects 20. ACE's GameActionRaiseAttribute and its Vital and Skill siblings read message.Payload.ReadUInt32(); holtburger's RaiseAttributeData declares xp_spent: u32 and advances the offset by four. Both oracles agree, and the four extra bytes were tail the server never reads. These three are live-wired, from the character sheet through the command router to SendRaiseAttribute, so this was shipping on every attribute, vital, and skill raise. It has not caused a visible failure because ACE reads the low dword and stops, and a single raise cost has never approached the dword ceiling. That is luck about value ranges, not correctness about layout. Worth noting the shape of the miss: the sibling builder BuildTrainSkill had already been corrected to a 20-byte, 32-bit credits field, and its test is even named U32CreditsNotU64. The same class of bug was found and fixed once in this file and the other three cases were left behind. The parameter stays ulong because the cost comes from 64-bit server XP tables several layers up in the App and Runtime command chain; narrowing that end to end is a separate change and is filed in the audit's open questions. Nothing is lost at the wire: a cost that does not fit in a dword was never expressible here. The existing test asserted the 24-byte shape and is corrected, joined by a theory that sweeps zero, one, a realistic cost, and uint.MaxValue across both remaining builders. Core.Net tests go 655 to 659. Co-Authored-By: Claude Fable 5 --- .../Messages/CharacterActions.cs | 27 +++++++++++++---- .../Messages/CharacterActionsTests.cs | 29 +++++++++++++++++-- 2 files changed, 48 insertions(+), 8 deletions(-) diff --git a/src/AcDream.Core.Net/Messages/CharacterActions.cs b/src/AcDream.Core.Net/Messages/CharacterActions.cs index 4abbbc39..96a86670 100644 --- a/src/AcDream.Core.Net/Messages/CharacterActions.cs +++ b/src/AcDream.Core.Net/Messages/CharacterActions.cs @@ -16,9 +16,9 @@ public static class CharacterActions { public const uint GameActionEnvelope = 0xF7B1u; - public const uint RaiseAttributeOpcode = 0x0045u; // u32 attr, u64 xpSpent - public const uint RaiseVitalOpcode = 0x0044u; // u32 vital, u64 xpSpent - public const uint RaiseSkillOpcode = 0x0046u; // u32 skillId, u64 xpSpent + public const uint RaiseAttributeOpcode = 0x0045u; // u32 attr, u32 xpSpent + public const uint RaiseVitalOpcode = 0x0044u; // u32 vital, u32 xpSpent + public const uint RaiseSkillOpcode = 0x0046u; // u32 skillId, u32 xpSpent public const uint TrainSkillOpcode = 0x0047u; // u32 skillId, u32 credits public const uint ChangeCombatModeOpcode = 0x0053u; // u32 combatMode @@ -74,14 +74,31 @@ public static class CharacterActions return body; } + /// + /// Envelope + sequence + sub-opcode + id + 32-bit xpSpent. + /// + /// The xpSpent field is a dword on the wire, not a qword. ACE's + /// GameAction/Actions/GameActionRaiseAttribute.cs (and its Vital and + /// Skill siblings) read message.Payload.ReadUInt32(), and + /// holtburger's RaiseAttributeData declares xp_spent: u32 + /// and advances the offset by four. We were writing eight, making the + /// message 24 bytes where the server expects 20 and leaving four bytes of + /// tail the server never reads. + /// + /// The parameter stays ulong because the cost originates from + /// 64-bit server XP tables several layers up; narrowing that chain end to + /// end is a separate change. No value is lost here: a cost that does not + /// fit in a dword was never expressible on this wire in the first + /// place. + /// private static byte[] BuildAttrOrVital(uint seq, uint sub, uint id, ulong xp) { - byte[] body = new byte[24]; + byte[] body = new byte[20]; BinaryPrimitives.WriteUInt32LittleEndian(body, GameActionEnvelope); BinaryPrimitives.WriteUInt32LittleEndian(body.AsSpan(4), seq); BinaryPrimitives.WriteUInt32LittleEndian(body.AsSpan(8), sub); BinaryPrimitives.WriteUInt32LittleEndian(body.AsSpan(12), id); - BinaryPrimitives.WriteUInt64LittleEndian(body.AsSpan(16), xp); + BinaryPrimitives.WriteUInt32LittleEndian(body.AsSpan(16), (uint)xp); return body; } } diff --git a/tests/AcDream.Core.Net.Tests/Messages/CharacterActionsTests.cs b/tests/AcDream.Core.Net.Tests/Messages/CharacterActionsTests.cs index 94194619..065f411f 100644 --- a/tests/AcDream.Core.Net.Tests/Messages/CharacterActionsTests.cs +++ b/tests/AcDream.Core.Net.Tests/Messages/CharacterActionsTests.cs @@ -7,17 +7,40 @@ namespace AcDream.Core.Net.Tests.Messages; public sealed class CharacterActionsTests { + /// + /// xpSpent is a dword, not a qword: ACE's GameActionRaiseAttribute reads + /// ReadUInt32() and holtburger's RaiseAttributeData declares + /// xp_spent: u32. This test previously asserted the 24-byte, + /// 64-bit shape — note that its sibling BuildTrainSkill_U32CreditsNotU64 + /// had already been corrected to 20 bytes for the same class of mistake. + /// [Fact] - public void BuildRaiseAttribute_HasOpcode0x0045AndXp64() + public void BuildRaiseAttribute_HasOpcode0x0045AndU32Xp() { byte[] body = CharacterActions.BuildRaiseAttribute(seq: 1, attrId: 5, xpSpent: 12345678); - Assert.Equal(24, body.Length); + Assert.Equal(20, body.Length); Assert.Equal(CharacterActions.RaiseAttributeOpcode, BinaryPrimitives.ReadUInt32LittleEndian(body.AsSpan(8))); Assert.Equal(5u, BinaryPrimitives.ReadUInt32LittleEndian(body.AsSpan(12))); Assert.Equal(12345678u, - BinaryPrimitives.ReadUInt64LittleEndian(body.AsSpan(16))); + BinaryPrimitives.ReadUInt32LittleEndian(body.AsSpan(16))); + } + + [Theory] + [InlineData(0u)] + [InlineData(1u)] + [InlineData(12345678u)] + [InlineData(uint.MaxValue)] + public void RaiseVitalAndSkill_AlsoWriteU32Xp(uint xp) + { + byte[] vital = CharacterActions.BuildRaiseVital(seq: 1, vitalId: 1, xpSpent: xp); + byte[] skill = CharacterActions.BuildRaiseSkill(seq: 1, skillId: 8, xpSpent: xp); + + Assert.Equal(20, vital.Length); + Assert.Equal(20, skill.Length); + Assert.Equal(xp, BinaryPrimitives.ReadUInt32LittleEndian(vital.AsSpan(16))); + Assert.Equal(xp, BinaryPrimitives.ReadUInt32LittleEndian(skill.AsSpan(16))); } [Fact]