Initial commit — leak-hunt project complete

Five bugs identified and patched in retail Asheron's Call client:
- v3b: palette refcount over-increment (3-byte NOP at two sites)
- v5: RenderSurface PurgeResource no-op stub (vtable slot 2 thunk)
- v11: two dangling-pointer crash guards (NULL-check + reorder)
- v14: CEnvCell::Destroy ClipPlaneList leak (18-byte JMP to cleanup thunk)
- v22: unpacker stale-pointer SEH guard (whole-function __try/__except)

All five ship in leakfix.dll (117 KB, SHA d282f23c…) which is loaded
by acclient.exe at process start via PE import table patching by
tools/install_leakfix.py.

Controlled 15-client fleet soak: unpatched control died at 26h with
palette exhaustion; all 14 patched clients survived past that point
and reached ≥5-day uptime.

Residual ~15 MB/h growth traced to d3d9.dll's internal slab allocator
(260KB surface backing buffers retained after Release). See REPORT.md
§10 for the full investigation; conclusion is that it's unfixable from
outside d3d9.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

tools/patch_v13_test.py

@@ -0,0 +1,145 @@
+"""patch_v13_test.py <pid> [--revert]
+
+v13: Hook SmartBox::DoPickupEvent to call unparent_children on the
+unequipped CPhysicsObj's children before continuing.
+
+This fixes the weapon-switch leak: each unequip currently calls
+unset_parent (clearing the weapon's link to player) but never iterates
+the weapon's OWN children (visual effects, sub-physobjs). Those keep
+parent=weapon and accumulate in weapon->children forever.
+
+Mechanism:
+  Replace the `CALL unset_parent` at 0x004522bf with a CALL to a tiny
+  12-byte thunk that does:
+    PUSH ECX
+    CALL unset_parent       (0x00513F70)
+    POP ECX
+    JMP unparent_children   (0x00513FE0)
+  Net effect: both unset_parent AND unparent_children fire, then
+  control returns to DoPickupEvent's next instruction (leave_world).
+"""
+import argparse, ctypes, ctypes.wintypes as wt, struct, sys
+
+
+PATCH_SITE_VA       = 0x004522BF
+ORIG_CALL_BYTES     = bytes([0xE8, 0xAC, 0x1C, 0x0C, 0x00])  # CALL unset_parent
+UNSET_PARENT_VA     = 0x00513F70
+UNPARENT_CHILDREN_VA = 0x00513FE0
+
+PROCESS_VM_READ = 0x10
+PROCESS_VM_WRITE = 0x20
+PROCESS_VM_OPERATION = 0x8
+PROCESS_QUERY_INFORMATION = 0x400
+MEM_COMMIT_RESERVE = 0x1000 | 0x2000
+PAGE_EXECUTE_READWRITE = 0x40
+
+
+k32 = ctypes.windll.kernel32
+OpenProcess = k32.OpenProcess
+OpenProcess.argtypes = [wt.DWORD, wt.BOOL, wt.DWORD]; OpenProcess.restype = wt.HANDLE
+CloseHandle = k32.CloseHandle
+CloseHandle.argtypes = [wt.HANDLE]; CloseHandle.restype = wt.BOOL
+VirtualAllocEx = k32.VirtualAllocEx
+VirtualAllocEx.argtypes = [wt.HANDLE, ctypes.c_void_p, ctypes.c_size_t, wt.DWORD, wt.DWORD]
+VirtualAllocEx.restype = wt.LPVOID
+WriteProcessMemory = k32.WriteProcessMemory
+WriteProcessMemory.argtypes = [wt.HANDLE, wt.LPVOID, wt.LPCVOID, ctypes.c_size_t,
+                               ctypes.POINTER(ctypes.c_size_t)]
+WriteProcessMemory.restype = wt.BOOL
+ReadProcessMemory = k32.ReadProcessMemory
+ReadProcessMemory.argtypes = [wt.HANDLE, wt.LPCVOID, wt.LPVOID, ctypes.c_size_t,
+                              ctypes.POINTER(ctypes.c_size_t)]
+ReadProcessMemory.restype = wt.BOOL
+VirtualProtectEx = k32.VirtualProtectEx
+VirtualProtectEx.argtypes = [wt.HANDLE, wt.LPVOID, ctypes.c_size_t, wt.DWORD,
+                             ctypes.POINTER(wt.DWORD)]
+VirtualProtectEx.restype = wt.BOOL
+
+
+def read_bytes(h, addr, n):
+    buf = (ctypes.c_ubyte * n)()
+    sz = ctypes.c_size_t(0)
+    if not ReadProcessMemory(h, addr, buf, n, ctypes.byref(sz)):
+        raise OSError(f"read 0x{addr:08x} err={ctypes.get_last_error()}")
+    return bytes(buf[:sz.value])
+
+
+def write_bytes(h, addr, data):
+    old = wt.DWORD(0)
+    if not VirtualProtectEx(h, addr, len(data), PAGE_EXECUTE_READWRITE, ctypes.byref(old)):
+        raise OSError(f"VirtualProtectEx 0x{addr:08x} err={ctypes.get_last_error()}")
+    sz = ctypes.c_size_t(0)
+    ok = WriteProcessMemory(h, addr, data, len(data), ctypes.byref(sz))
+    err = ctypes.get_last_error() if not ok else 0
+    restored = wt.DWORD(0)
+    VirtualProtectEx(h, addr, len(data), old.value, ctypes.byref(restored))
+    if not ok:
+        raise OSError(f"write 0x{addr:08x} err={err}")
+
+
+def build_thunk(thunk_va):
+    out = bytearray()
+    out += bytes([0x51])  # push ecx
+    # call unset_parent
+    rel = UNSET_PARENT_VA - (thunk_va + len(out) + 5)
+    out += bytes([0xE8]) + struct.pack("<i", rel)
+    out += bytes([0x59])  # pop ecx
+    # jmp unparent_children
+    rel = UNPARENT_CHILDREN_VA - (thunk_va + len(out) + 5)
+    out += bytes([0xE9]) + struct.pack("<i", rel)
+    return bytes(out)
+
+
+def main():
+    ap = argparse.ArgumentParser()
+    ap.add_argument("pid", type=int)
+    ap.add_argument("--revert", action="store_true")
+    args = ap.parse_args()
+    h = OpenProcess(PROCESS_VM_READ | PROCESS_VM_WRITE | PROCESS_VM_OPERATION |
+                    PROCESS_QUERY_INFORMATION, False, args.pid)
+    if not h:
+        print(f"OpenProcess({args.pid}) err={ctypes.get_last_error()}"); sys.exit(2)
+
+    cur = read_bytes(h, PATCH_SITE_VA, 5)
+    print(f"PID {args.pid}")
+    print(f"  patch site @ 0x{PATCH_SITE_VA:08x}: {cur.hex()}")
+
+    if args.revert:
+        if cur == ORIG_CALL_BYTES:
+            print(f"    already original"); CloseHandle(h); return
+        write_bytes(h, PATCH_SITE_VA, ORIG_CALL_BYTES)
+        print(f"    reverted; now: {read_bytes(h, PATCH_SITE_VA, 5).hex()}")
+        CloseHandle(h); return
+
+    if cur != ORIG_CALL_BYTES:
+        if cur[0] == 0xE8:
+            print(f"    already has a CALL — likely already patched"); CloseHandle(h); sys.exit(3)
+        print(f"    UNEXPECTED — expected {ORIG_CALL_BYTES.hex()}"); CloseHandle(h); sys.exit(4)
+
+    thunk_page = VirtualAllocEx(h, None, 0x40, MEM_COMMIT_RESERVE, PAGE_EXECUTE_READWRITE)
+    if not thunk_page:
+        print(f"VirtualAllocEx failed err={ctypes.get_last_error()}"); sys.exit(5)
+    print(f"  thunk page @ 0x{thunk_page:08x}")
+    thunk = build_thunk(thunk_page)
+    print(f"  thunk bytes: {thunk.hex()}")
+
+    sz = ctypes.c_size_t(0)
+    if not WriteProcessMemory(h, thunk_page, thunk, len(thunk), ctypes.byref(sz)):
+        print(f"write thunk failed err={ctypes.get_last_error()}"); sys.exit(6)
+    after_thunk = read_bytes(h, thunk_page, len(thunk))
+    if after_thunk != thunk:
+        print(f"    thunk MISMATCH"); sys.exit(7)
+
+    rel = thunk_page - (PATCH_SITE_VA + 5)
+    new_call = bytes([0xE8]) + struct.pack("<i", rel)
+    write_bytes(h, PATCH_SITE_VA, new_call)
+    after = read_bytes(h, PATCH_SITE_VA, 5)
+    print(f"    patch site now: {after.hex()}")
+    if after != new_call:
+        print(f"    PATCH MISMATCH"); sys.exit(8)
+    print(f"  OK")
+    CloseHandle(h)
+
+
+if __name__ == "__main__":
+    main()