ElChinito copies more Crafty bugs

[Paul Hunter]

Geschrieben von:/Posted by: Paul Hunter at 22 August 2004 13:33:13:

I posted this note on CCC. Just wanted to share it here too.
Below is the function EvaluateMate() in Crafty and the section of Evaluate() that calls it. Below is also the disassembly of ElChinito.
Wow. Exactly the same. But wait, that is not the evidence yet. You see, EvaluateMate() will never return a value of 99999. This is a Crafty coding bug. Evaluate() checks for the return value of 99999 (hex, 01869Fh in the assembly code) from EvaluateMate() even though that function will never return such a value.
EvaluateMate() get its result from the signed byte arrays b_n_mate_dark_squares, b_n_mate_light_squares and mate. Their values will never exceed 128. You can add the value of "(Distance(WhiteKingSQ, BlackKingSQ) - 3) * KING_KING_TROPISM" which is at most 4 * 15 = 60, and the maximum return value of this function can be 188. 188 max vs 99999?
Copying code, some might argue, is "smart" thing to do, because you benefit from the sweat of someone else, and still get credit. Society calls it plagiarism. However, to copy the bug, is "stupid".


// portion of Evaluate()
  if ((TotalWhitePawns+TotalBlackPawns) == 0) do {
    int ms=EvaluateMate(tree)&#59;
    if (ms == 99999) break&#59;
    score+=ms&#59;
    if (score>DrawScore(1) && drawn_ending==-1) return(DrawScore(wtm))&#59;
    if (score<DrawScore(1) && drawn_ending==-2) return(DrawScore(wtm))&#59;
    return((wtm) ? score : -score)&#59;
  } while(0)&#59;
// EvalauteMate()
int EvaluateMate(TREE *tree) {
  register int mate_score=DrawScore(1)&#59;
  if ((TotalBlackPieces==0) && (TotalWhitePieces==6) &&
      (!WhitePawns) && (!BlackPawns) && WhiteBishops && WhiteKnights) {
    if (dark_squares&WhiteBishops)
      mate_score=b_n_mate_dark_squares[BlackKingSQ]&#59;
    else
      mate_score=b_n_mate_light_squares[BlackKingSQ]&#59;
  }
  if ((TotalBlackPieces==6) && (TotalWhitePieces==0) &&
      (!WhitePawns) && (!BlackPawns) && BlackBishops && BlackKnights) {
    if (dark_squares&BlackBishops)
      mate_score=-b_n_mate_dark_squares[WhiteKingSQ]&#59;
    else
      mate_score=-b_n_mate_light_squares[WhiteKingSQ]&#59;
  }
  if (!mate_score) {
    if (Material >0) {
      mate_score=mate[BlackKingSQ]&#59;
      mate_score-=(Distance(WhiteKingSQ,BlackKingSQ)-3)*KING_KING_TROPISM&#59;
    }
    else if (Material < 0) {
      mate_score=-mate[WhiteKingSQ]&#59;
      mate_score+=(Distance(WhiteKingSQ,BlackKingSQ)-3)*KING_KING_TROPISM&#59;
    }
  }
  return(mate_score)&#59;
}
// --------------------------------------------------------------------------
// section of Evaluate() that calls EvaluateMate() in ElChinito 3.25
// --------------------------------------------------------------------------
...
mov  edx , dword ptr [ Data4b3520 ]
mov eax ,  dword ptr [ Data4b34f8 ]
mov  ecx , dword ptr [ Data4b3524 ]
or eax , edx
movsx edx ,byte ptr [ Data4b35a1 ]
mov dword ptr [ Data4b42f0 ] ,  eax
mov eax ,  dword ptr [ Data4b34fc ]
or eax , ecx
movsx ecx ,byte ptr [ Data4b35a5 ]
add ecx , edx
mov dword ptr [ Data4b42f4 ] ,  eax
jne Label425038
call Fun42a380
cmp eax , 01869Fh
je Label425038
add ebx , eax
mov eax ,  dword ptr [ Data441be4 ]
cmp ebx , eax
jle Label42500e
cmp esi , 0FFFFFFFFh
jne Label42500c
...
// --------------------------------------------------------------------------
// EvaluateMate() in ElChinito 3.25
// --------------------------------------------------------------------------
Fun42a380 :: &#59; proc near // EvaluateMate()
mov  cl , byte ptr [ Data4b35a2 ]
test cl , cl
mov eax ,  dword ptr [ Data441be4 ]
mov  dl , byte ptr [ Data4b355d ]
push ebx
push esi
push edi
jne Label42a426
cmp  byte ptr [ Data4b359e ] , 06h
jne Label42a4a7
mov  ecx , dword ptr [ Data4b34f8 ]
or  ecx , dword ptr [ Data4b34fc ]
jne Label42a4a7
mov  ecx , dword ptr [ Data4b3520 ]
or  ecx , dword ptr [ Data4b3524 ]
jne Label42a4a7
mov  ecx , dword ptr [ Data4b3508 ]
mov  esi , dword ptr [ Data4b350c ]
mov edi , ecx
or edi , esi
je Label42a4a7
mov  edi , dword ptr [ Data4b3500 ]
or  edi , dword ptr [ Data4b3504 ]
je Label42a4a7
mov eax ,  dword ptr [ Data46ad40 ]
and eax , ecx
mov  ecx , dword ptr [ Data46ad44 ]
and ecx , esi
or eax , ecx
je Label42a417
movsx eax , dl
movsx eax ,byte ptr [ eax + 043C738h ]
jmp Label42a4a7
Label42a417 ::
movsx ecx , dl
movsx eax ,byte ptr [ ecx + 043C6B8h ]
jmp Label42a4a7
Label42a426 ::
cmp cl , 06h
jne Label42a4a7
mov  cl , byte ptr [ Data4b359e ]
test cl , cl
jne Label42a4a7
mov  ecx , dword ptr [ Data4b34f8 ]
or  ecx , dword ptr [ Data4b34fc ]
jne Label42a4a7
mov  ecx , dword ptr [ Data4b3520 ]
or  ecx , dword ptr [ Data4b3524 ]
jne Label42a4a7
mov  ecx , dword ptr [ Data4b3530 ]
mov  esi , dword ptr [ Data4b3534 ]
mov edi , ecx
or edi , esi
je Label42a4a7
mov  edi , dword ptr [ Data4b3528 ]
or  edi , dword ptr [ Data4b352c ]
je Label42a4a7
mov  ebx , dword ptr [ Data46ad40 ]
mov  edi , dword ptr [ Data46ad44 ]
and ecx , ebx
and esi , edi
mov eax , ecx
or eax , esi
je Label42a497
movsx eax ,byte ptr [ Data4b355c ]
movsx eax ,byte ptr [ eax + 043C738h ]
jmp Label42a4a5
Label42a497 ::
movsx ecx ,byte ptr [ Data4b355c ]
movsx eax ,byte ptr [ ecx + 043C6B8h ]
Label42a4a5 ::
neg eax
Label42a4a7 ::
test eax , eax
jne Label42a54d
mov  ecx , dword ptr [ Data4b3558 ]
test ecx , ecx
jle Label42a506
movsx edi ,byte ptr [ Data4b355c ]
movsx ecx , dl
movsx ebx ,byte ptr [ ecx + 043C6F8h ]
mov edx , ecx
and edx , 07h
mov eax , edi
and eax , 07h
sub eax , edx
cdq
mov esi , eax
xor esi , edx
mov eax , edi
sar eax , 03h
sar ecx , 03h
sub eax , ecx
sub esi , edx
cdq
xor eax , edx
sub eax , edx
cmp esi , eax
jle Label42a4f2
mov eax , esi
Label42a4f2 ::
mov ecx , 03h
sub ecx , eax
lea eax ,  dword ptr [ ecx + 2 * ecx ]
pop edi
lea ecx ,  dword ptr [ eax + ebx ]
pop esi
lea eax ,  dword ptr [ ecx + 4 * eax ]
pop ebx
ret
Label42a506 ::
jnl Label42a54d
movsx edi ,byte ptr [ Data4b355c ]
movsx ebx ,byte ptr [ edi + 043C6F8h ]
movsx esi , dl
mov edx , esi
and edx , 07h
mov eax , edi
and eax , 07h
sub eax , edx
cdq
mov ecx , eax
xor ecx , edx
mov eax , edi
sar eax , 03h
sar esi , 03h
sub eax , esi
sub ecx , edx
cdq
xor eax , edx
sub eax , edx
neg ebx
cmp ecx , eax
jle Label42a543
mov eax , ecx
Label42a543 ::
lea eax ,  dword ptr [ eax + 2 * eax - 9 ]
lea ecx ,  dword ptr [ eax + ebx ]
lea eax ,  dword ptr [ ecx + 4 * eax ]
Label42a54d ::
pop edi
pop esi
pop ebx
ret

[Bryan Hofmann]

Geschrieben von:/Posted by: Bryan Hofmann at 22 August 2004 20:35:39:
Als Antwort auf:/In reply to: ElChinito copies more Crafty bugs geschrieben von:/posted by: Paul Hunter at 22 August 2004 13:33:13:

I posted this note on CCC. Just wanted to share it here too.

Great work in pointing these out, I know this takes a lot of time to go thru and verify. I did a real quick look at the .exe and found that the TBDIR of ./TB is in the code when it does not use EGTBs and the Noise command is present with out a Kibitz or Whisper. So it would appear the the chess.h & option.c files were not cleaned up to removes these.




Alternative Crafty Compiles

[Paul Hunter]

Geschrieben von:/Posted by: Paul Hunter at 22 August 2004 22:08:27:
Als Antwort auf:/In reply to: Re: ElChinito copies more Crafty bugs geschrieben von:/posted by: Bryan Hofmann at 22 August 2004 20:35:39:

I posted this note on CCC. Just wanted to share it here too.

Great work in pointing these out, I know this takes a lot of time to go thru and verify. I did a real quick look at the .exe and found that the TBDIR of ./TB is in the code when it does not use EGTBs and the Noise command is present with out a Kibitz or Whisper. So it would appear the the chess.h & option.c files were not cleaned up to removes these.

Good point. One gets to realize even more that this is a quick-and-dirty kind of cloning.
Attempts were made to remove some Crafty options to make it appear that the program is different. And again, it just makes the author look even more stupid.

[capgadget]

Geschrieben von:/Posted by: capgadget at 23. August 2004 00:02:
Als Antwort auf:/In reply to: Re: ElChinito copies more Crafty bugs geschrieben von:/posted by: Paul Hunter at 22 August 2004 22:08:27:

All I can say is:
GET A ROPE!
It seems like some additional verification should be done before crooks
like these get their programs added to Arena?

I posted this note on CCC. Just wanted to share it here too.

Great work in pointing these out, I know this takes a lot of time to go thru and verify. I did a real quick look at the .exe and found that the TBDIR of ./TB is in the code when it does not use EGTBs and the Noise command is present with out a Kibitz or Whisper. So it would appear the the chess.h & option.c files were not cleaned up to removes these.

Good point. One gets to realize even more that this is a quick-and-dirty kind of cloning.
Attempts were made to remove some Crafty options to make it appear that the program is different. And again, it just makes the author look even more stupid.