Is safe. It is a normal Inno setup script. However, the two UAX data are actively changed by the patch (using xDelta), which is why some virus scanners can start. In my case Kaspersky said nothing.

Edit: You have to use an installation with uax files not yet edited.

I made a simple template for UE1 packages for 010 Editor

LittleEndian();
typedef struct HeaderStruct {
DWORD UAXHeader <format=hex>; //Always C1 83 2A 9E
int32 FileVersion <format=hex>;
int32 PackageFlags <format=hex>;
int32 NameCount; //Number of names stored in the name table
int32 NameOffset; //Offset into the file of the name table
int32 ExportCount; //Number of exported objects in the export table
int32 ExportOffset; //Offset into the file of the export table
int32 ImportCount; //Number of imported objects in the import table
int32 ImportOffset; //Offset into the file of the import table
GUID PackageGUID;
int32 GenerationCount;
int32 ExportCount;
int32 NameCount;
} HeaderStruct;

typedef struct NameTableStruct {
byte NameLength; //in bytes
char Name[NameLength];
int32 NameFlags <format=hex>;
} NameTableStruct;

typedef struct ImportTableStruct {
byte ClassPackage; //Name table index for the package which this object's class object resides in
byte ClassName; //Name table index for this object's class
DWORD PackageIndex; //The index of the package this object resides in
byte ObjectName; //Name table index for this object
} ImportTableStruct;

HeaderStruct Header;

struct NameTable {
FSeek(Header.NameOffset);
local int i;
for(i = 0; i < Header.NameCount; i++){
NameTableStruct NameTable;
}
} Names;

struct ImportTable {
FSeek(Header.ImportOffset);
local int i;
for(i = 0; i < Header.ImportCount; i++){
ImportTableStruct ImportTable;
}
} Imports;

It works for header, name table and import table (tables that aren't changed between the files), but I can't find a proper structure for export table. I tried two different specifications, but both are wrong for these files. Maybe someone could help?

Export table should use this syntax:
Class Index Compact Index Points to the class object describing the class of this object.
Super Index Compact Index If this is a field (a struct, class, property, or another field subclass), points to the superfield object of the field.
Package Index Long Int Points to the package object describing the package this object resides in.
Object Name Compact Index This object's name.
Object Flags Long Int Bitflags describing the object.
Serial Size Compact Index Size of the object's serialised data, in bytes.
Serial Offset Compact Index If >= 0, offset into this file of the start of the object's serialised data.

or this:
INDEX Class Class of the object, i.e. Texture or Palette etc; stored as a ObjectReference
INDEX Super Object Parent; again a ObjectReference
DWORD Group Internal package/group of the object, i.e. Floor for floor-textures; ObjectReference
INDEX Object Name The name of the object; an index into the name-table
DWORD Object Flags Flags for the object; described in the appendix
INDEX Serial Size Total size of the object
INDEX Serial Offset Offset of the object; this field only exists if the SerialSize is larger 0

The main problem is - I don't know how many bytes each item should be, and I can't figure it out by parsing data

Ok, I found out about compact index format used in these tables. So I will try to rewrite the template to use that indexes.
And the only reason for all this - is to see where two files differ.
Cause it's not header, not name table and not import table. And I belive the whole difference in export table would be the order of its value because of name table reordering. So it's not expert table either.
Maybe there are some properties between the wav files (wavs themselves are identical). But to find them I need to find offsets to the start of each wav from export table.

Ok, I don't know. Export table seems to be legit. Flags are the same.
Headers of the WAVs are the same.

The only difference between files are names order and export table offsets cause they point to that names.

For example, export structure of the first row in table:
ClassIndex = 3
SuperIndex = 0
PackageIndex = 0
NameIndex = 17 (or 29 in subtitled file)
Object Flags = 70004h
Size = 1
Offset is the same

Since names are in different order - export table points to the same name but into changed order. That's normal.
So all the object flags in all the files are the same. I don't see any sign of anything that could point to enabling or disabling subtitles support.

With the help of StrangeAeonz it seems it has been solved.
Between the PCM data (RIFF WAV) there are some object properties which aren't part of the PCM, but some Unreal data.
It's not present in any of the names or export flags - it's just in raw data.

And our flag is in the eleventh byte left from RIFF header (first in this raw).

For example:
XX ???? ???? ???? ???? ???? 5249 4646
5249 4646 is RIFF text
XX is either 00 or 01 (no subtitles or with subtitles).

And interesting fact - in LevelMechanics only one sound has this flag for subtitles. And even in Voiceover not all the files had it. So maybe why that's not every subtitle is visible in game even if it presents in Subtitles.int.

I don't have much programming knowledge to parse name and export tables and change only those PCM properties which had their lines in Subtitles.int.
But I can set this flag for all the WAVs using regexp.
I'll try to find syntax for this data properties, I didn't see in UE documentation (but there is not much documentation for UE1 nowadays)

Hmm, all the hex editors I found can't do a regexp or wildcard mask replace. If someone could do it with a script - you are welcome.

Use hextor hex editor

Finally.
I was able to edit all RIFF properties in three files:

CreatureSFX.uax
LevelMechanics.uax
Voiceover.uax

So every sound from these three files can be subtitled now (and we use this for a few lines from CreatureSFX.uax for Jemaas talking)
Also I updated Subtitles.int fixing one little bug in Keisenger fight thanks to J222

So this is full subtitles patch for Undying. Just unpack into game folder (make a backup)
https://disk.yandex.ru/d/FNVn2bhuHyyQDw

In packages I only changed GUID and 00>01 byte in data properties. There is a little chance of finding other values to the data header, but they aren't interesting (length of the wav, name index from the export table etc).
And used our fixed Subtitles.int file

Credits goes to StrangeAeonz and me.
If you want - you can create an installator with xdelta or anything - there are only about 1500 bytes changed.

P.S. There is a big change that this method can edit sound files and add subtitles to other UE1 games.

Great work! Thank you both for the dedication and the effort you've put into this.

Ok. Here is the small installer for the subtitles. Credits for the creators can be found in the directory selection window. Patch size is about 1,2 MB. https://www.mediafire.com/file/ejqsg8v5mdco74v/Undying+Subtitle-Patch.rar/file

Thx for your work ;-)

I edited PCGW page to include your installer.

During a short play-through I noticed that subtitles are missing. For example, the "Pa_086=Indeed." at the first gardener or the sentence "Mai4_003_1=Jeremiah let go of everyone else and the house is much too large for us to clean." when talking to the first maid. What could be the reason for that?

Well, I'll try to modify Levelmechanics and creatures files to flag only sounds with subtitles.
Maybe that's the issue. Game overlap the subtitles if more than one subtitled lines is played I think.

Try this:
https://disk.yandex.ru/d/d1LHVvx8Z5SAMw

I fixed one error in Subtitles.int and also remade CreatureSFX.uax and LevelMechanics.uax to include flags only for files listed in Subtitles.int.

P.S. I'll remade Voiceover.uax someday too

Ok. Then I wait with the test and a patch update until then ;-).