# Windows 11 "abnormal program termination" at launch (Champ, 2026-10-01)

Cause (static evidence, not yet confirmed on Windows): the server's patched eqgame.exe (md5 e5ea76b0) keeps the
DYNAMIC_BASE (ASLR) flag of stock RoF2, but its added code (cave 0x9651A7-0x965648, entered from H7 0x763640,
H8 0x4C32A3, H9 0x863DE0 and the char-create jumps 0x64B621..0x64F5CE) uses absolute 0x400000-based addresses
(cmp [edx],0xA1AD2C; mov ecx,[0xE67CCC]; mov [0x15D9A00],edx; push 0x9653DB; mov ecx,[0xB828B0] ...) that have
NO .reloc entries. Real Windows rebases the exe at a random address, so those reads/writes hit the wrong memory.
Wine on Trevor's desktop loads it at 0x400000 (hjclient.log: base=00400000), so it never shows there.
Champ ran the stock exe until the 2026-09-30 patcher upgraded it, which is why it started now and why rolling the
DLL back to 213d0907 did not help.

Files
- eqgame.exe  md5 52f918c3ca6548b4ef4ee20c6fdd8078 / sha256 5acd3b73...d505: e5ea76b0 with ONE byte changed,
  DllCharacteristics 0x8140 -> 0x8100 (DYNAMIC_BASE off), so Windows always loads it at 0x400000.
  Everything else (caves, relocs, PE checksum field) untouched.
- dinput8.dll md5 e6a0730c: the 9888ff3c source plus one log line: if the exe is the patched one AND not at
  0x400000, hjclient.log line 2 says "WARNING: patched eqgame.exe relocated by ASLR ...". No other change.

Test sequence for Champ (stop at the first step that answers it)
0. Send line 1 of hjclient.log (EQ folder) from a crashed run: "base=00400000" = theory wrong; anything else = confirmed.
1. Copy eqgame.exe from here over the one in the EQ folder (keep eqgame.exe.stock; the patcher leaves a non-stock,
   non-server exe alone). Start eqgame.exe patchme directly (not via the patcher). Expect: login works.
2. If it still aborts: rename dinput8.dll -> dinput8.dll.off and retry. Still aborts = exe/data, not the DLL.
3. If still aborting: put eqgame.exe.stock back as eqgame.exe. Starts = our exe; still aborts = data files.
4. If stock also aborts: move uifiles/default/EQUI_CharacterCreate.xml and EQUI_SpellDisplay.xml aside, retry.
5. Once 1 works: drop in this dinput8.dll (or keep 213d0907), log in, send hjclient.log.

Ship once confirmed: regenerate the manifest with this eqgame.exe (players on e5ea76b0 will need the patcher's
STOCK_ROF2_EXE/upgrade rule widened to accept e5ea76b0 too, or they stay on the broken exe). Wart for the next exe
rebuild: the stock reloc at 0x4C32A9 now lands on the NOPs after the H8 jmp (harmless when not rebased).
Mandatory ASLR (Exploit protection "Force randomization for images", off by default) would still rebase it.