"""check_orphan_refcounts.py <pid>

For D3DXMesh instances with NO pointers in heap memory, read their
internal refcount (COM-style at +0x?? — let's check several offsets).
If refcount > 0, something outside heap (stack/static globals)
references them. If refcount == 0, they're truly leaked.
"""
import ctypes, ctypes.wintypes as wt, struct, sys
from collections import Counter

VTABLE = 0x007ed3b0
PROCESS_VM_READ=0x10; PROCESS_QUERY_INFORMATION=0x400
MEM_COMMIT=0x1000; MEM_PRIVATE=0x20000

class MBI(ctypes.Structure):
    _fields_ = [('BaseAddress',ctypes.c_void_p),('AllocationBase',ctypes.c_void_p),
                ('AllocationProtect',wt.DWORD),('PartitionId',wt.WORD),('RegionSize',ctypes.c_size_t),
                ('State',wt.DWORD),('Protect',wt.DWORD),('Type',wt.DWORD)]
k = ctypes.windll.kernel32
k.OpenProcess.argtypes=[wt.DWORD,wt.BOOL,wt.DWORD]; k.OpenProcess.restype=wt.HANDLE
k.ReadProcessMemory.argtypes=[wt.HANDLE,wt.LPCVOID,wt.LPVOID,ctypes.c_size_t,ctypes.POINTER(ctypes.c_size_t)]
k.ReadProcessMemory.restype=wt.BOOL
k.VirtualQueryEx.argtypes=[wt.HANDLE,ctypes.c_void_p,ctypes.POINTER(MBI),ctypes.c_size_t]
k.VirtualQueryEx.restype=ctypes.c_size_t

pid = int(sys.argv[1])
h = k.OpenProcess(PROCESS_VM_READ|PROCESS_QUERY_INFORMATION, False, pid)

# Pass 1: enumerate all RW regions and find mesh addrs + collect data
rw_regions = []
mbi=MBI(); addr=0
while k.VirtualQueryEx(h, addr, ctypes.byref(mbi), ctypes.sizeof(mbi)):
    if mbi.State==MEM_COMMIT and mbi.Type==MEM_PRIVATE and (mbi.Protect&0xff) in (0x04, 0x40):
        buf=(ctypes.c_ubyte*mbi.RegionSize)(); sz=ctypes.c_size_t(0)
        if k.ReadProcessMemory(h, mbi.BaseAddress, buf, mbi.RegionSize, ctypes.byref(sz)):
            rw_regions.append((mbi.BaseAddress, bytes(buf[:sz.value])))
    addr=(mbi.BaseAddress or 0)+mbi.RegionSize
    if addr>=0x80000000: break

# Find mesh addresses + their data
mesh_data = {}  # addr -> first 64 bytes
for base, data in rw_regions:
    end = (len(data)//4)*4
    for off in range(0, end-0x40, 4):
        if struct.unpack_from('<I', data, off)[0] == VTABLE:
            mesh_data[base + off] = data[off:off+0x40]

print(f'D3DXMesh instances: {len(mesh_data)}')

# Pass 2: for each mesh address, count pointers in heap memory
mesh_addr_set = set(mesh_data.keys())
ref_counts = {a: 0 for a in mesh_data}
for base, data in rw_regions:
    end = (len(data)//4)*4
    for off in range(0, end-4, 4):
        v = struct.unpack_from('<I', data, off)[0]
        if v in mesh_addr_set:
            ref_addr = base + off
            if ref_addr in mesh_addr_set: continue  # self
            ref_counts[v] += 1

orphans = [a for a in mesh_data if ref_counts[a] == 0]
held = [a for a in mesh_data if ref_counts[a] > 0]
print(f'orphans (0 heap refs): {len(orphans)}')
print(f'held: {len(held)}')

# For each orphan, dump the first 0x40 bytes and try to find a refcount-looking field
# COM objects typically have a refcount at +0x04 or +0x08
print()
print('=== Orphan mesh refcount candidates (DWORDs at +0x04, +0x08, +0x0c, +0x10, +0x14) ===')
hist_off04 = Counter()
hist_off08 = Counter()
hist_off0c = Counter()
hist_off10 = Counter()
hist_off14 = Counter()
for a in orphans:
    d = mesh_data[a]
    v04 = struct.unpack_from('<I', d, 0x04)[0]
    v08 = struct.unpack_from('<I', d, 0x08)[0]
    v0c = struct.unpack_from('<I', d, 0x0c)[0]
    v10 = struct.unpack_from('<I', d, 0x10)[0]
    v14 = struct.unpack_from('<I', d, 0x14)[0]
    hist_off04[min(v04, 100)] += 1
    hist_off08[min(v08, 100)] += 1
    hist_off0c[min(v0c, 100)] += 1
    hist_off10[min(v10, 100)] += 1
    hist_off14[min(v14, 100)] += 1

print(f'+0x04 distribution (top 5): {hist_off04.most_common(5)}')
print(f'+0x08 distribution (top 5): {hist_off08.most_common(5)}')
print(f'+0x0c distribution (top 5): {hist_off0c.most_common(5)}')
print(f'+0x10 distribution (top 5): {hist_off10.most_common(5)}')
print(f'+0x14 distribution (top 5): {hist_off14.most_common(5)}')

# Sample 5 orphans — dump full 0x40 bytes
print()
print('=== Sample 5 orphan dumps ===')
for a in orphans[:5]:
    print(f'  mesh @ 0x{a:08x}:')
    d = mesh_data[a]
    for i in range(0, 0x40, 16):
        row = d[i:i+16]
        hex_str = ' '.join(f'{b:02x}' for b in row)
        print(f'    +0x{i:02x}: {hex_str}')