"""Patch J: bypass the init-flag error gate at 0x020277.

The instruction at 0x020277 is JNZ +0x2e (75 2e). When the init flag at
VA 0x475425 is zero the fall-through path shows the 'corrupt files' error.
The jump target (0x0202a7) is the success return stub:
  b0 01        MOV AL, 1
  5d 5f 5e 5b  POP EBP/EDI/ESI/EBX
  83 c4 44     ADD ESP, 0x44
  c2 0c 00     RET 0x0c

Changing 75->eb turns JNZ into JMP so execution always takes the success path.
"""
import struct

with open("HAVOC_NOCD.EXE", "rb") as f:
    exe = bytearray(f.read())

PATCH_FO = 0x020277
# Verify expected bytes
expected = bytes([0x75, 0x2e])
actual   = bytes(exe[PATCH_FO:PATCH_FO+2])
if actual != expected:
    print(f"ERROR: expected {expected.hex(' ')} at 0x{PATCH_FO:06x}, got {actual.hex(' ')}")
    raise SystemExit(1)

exe[PATCH_FO] = 0xeb   # JNZ -> JMP

# Verify target bytes at 0x0202a7
target_bytes = bytes(exe[0x0202a7:0x0202a7+12])
print(f"Patch J target bytes at 0x0202a7: {target_bytes.hex(' ')}")
# should be: b0 01 5d 5f 5e 5b 83 c4 44 c2 0c 00

with open("HAVOC_NOCD.EXE", "wb") as f:
    f.write(exe)

print(f"Patch J applied: 0x{PATCH_FO:06x}: 75 2e -> eb 2e  (JNZ -> JMP, bypass init-flag check)")