ci: Patch VC6 game executable with NXCOMPAT to enhance security

Author: stephanmeesters

.github/workflows/build-toolchain.yml

@@ -180,6 +180,16 @@ jobs:
         run: |
           cmake --build --preset ${{ inputs.preset }}
 
+      - name: Patch VC6 game executable with NXCOMPAT
+        if: startsWith(inputs.preset, 'vc6')
+        shell: pwsh
+        run: |
+          $buildDir = "build\${{ inputs.preset }}"
+          $targetExe = "${{ inputs.game == 'Generals' && 'generalsv.exe' || 'generalszh.exe' }}"
+          $targetPath = "$buildDir\${{ inputs.game }}\$targetExe"
+
+          python scripts/pe_set_nxcompat.py $targetPath
+
       - name: Save vcpkg binary cache
         # Only one job should save to avoid "Unable to reserve cache" conflicts.
         if: ${{ startsWith(inputs.preset, 'win32') && steps.vcpkg_cache.outputs.cache-hit != 'true' && inputs.game == 'Generals' && inputs.preset == 'win32-vcpkg-debug' }}

scripts/pe_set_nxcompat.py

@@ -0,0 +1,99 @@
+#!/usr/bin/env python3
+"""
+Set NX compatibility bit (IMAGE_DLLCHARACTERISTICS_NX_COMPAT) in PE files.
+
+Usage:
+  python scripts/pe_set_nxcompat.py <file> [<file> ...]
+  python scripts/pe_set_nxcompat.py --dry-run <file> [<file> ...]
+"""
+
+from __future__ import annotations
+
+import argparse
+import struct
+import sys
+from pathlib import Path
+
+
+PE_SIGNATURE = b"PE\x00\x00"
+PE32_MAGIC = 0x10B
+PE32_PLUS_MAGIC = 0x20B
+DLL_CHARACTERISTICS_OFFSET = 0x46
+NX_COMPAT_BIT = 0x0100
+
+
+def set_nx_compat(path: Path, dry_run: bool) -> tuple[bool, bool]:
+    data = bytearray(path.read_bytes())
+
+    if len(data) < 0x40 or data[0:2] != b"MZ":
+        raise ValueError("not a valid MZ executable")
+
+    pe_offset = struct.unpack_from("<I", data, 0x3C)[0]
+    if pe_offset + 24 > len(data):
+        raise ValueError("invalid PE header offset")
+
+    if data[pe_offset:pe_offset + 4] != PE_SIGNATURE:
+        raise ValueError("missing PE signature")
+
+    coff_header_offset = pe_offset + 4
+    optional_header_size = struct.unpack_from("<H", data, coff_header_offset + 16)[0]
+    optional_header_offset = coff_header_offset + 20
+    if optional_header_offset + optional_header_size > len(data):
+        raise ValueError("truncated optional header")
+    if optional_header_size <= DLL_CHARACTERISTICS_OFFSET + 1:
+        raise ValueError("optional header is too small for DllCharacteristics")
+
+    magic = struct.unpack_from("<H", data, optional_header_offset)[0]
+    if magic not in (PE32_MAGIC, PE32_PLUS_MAGIC):
+        raise ValueError(f"unsupported optional header magic: 0x{magic:04X}")
+
+    dll_char_offset = optional_header_offset + DLL_CHARACTERISTICS_OFFSET
+    old_value = struct.unpack_from("<H", data, dll_char_offset)[0]
+    new_value = old_value | NX_COMPAT_BIT
+    changed = new_value != old_value
+
+    if changed and not dry_run:
+        struct.pack_into("<H", data, dll_char_offset, new_value)
+        path.write_bytes(data)
+
+    return changed, bool(new_value & NX_COMPAT_BIT)
+
+
+def main() -> int:
+    parser = argparse.ArgumentParser(
+        description="Set the PE NX compatibility bit (DllCharacteristics 0x0100)."
+    )
+    parser.add_argument("files", nargs="+", help="PE files (.exe/.dll) to patch")
+    parser.add_argument(
+        "--dry-run",
+        action="store_true",
+        help="Validate and report changes without modifying files",
+    )
+    args = parser.parse_args()
+
+    had_error = False
+    changed_count = 0
+
+    for file_name in args.files:
+        path = Path(file_name)
+        if not path.is_file():
+            print(f"[ERROR] {path}: file not found", file=sys.stderr)
+            had_error = True
+            continue
+
+        try:
+            changed, nx_enabled = set_nx_compat(path, args.dry_run)
+            if changed:
+                changed_count += 1
+            status = "patched" if changed and not args.dry_run else "would-patch" if changed else "already-set"
+            print(f"[{status}] {path} (nx_compat={'on' if nx_enabled else 'off'})")
+        except Exception as exc:
+            print(f"[ERROR] {path}: {exc}", file=sys.stderr)
+            had_error = True
+
+    print(f"Processed {len(args.files)} file(s), updated {changed_count}.")
+    return 1 if had_error else 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())