"""count_position_live.py [pid...]
Count Position-class instances in live acclient processes.
Position vtable = 0x00797910 (EoR).
"""
import ctypes, ctypes.wintypes as wt, struct, sys, subprocess

POSITION_VT = 0x00797910

if len(sys.argv) > 1:
    pids = [int(p) for p in sys.argv[1:]]
else:
    out = subprocess.check_output(
        ["powershell.exe", "-NoProfile", "-Command",
         "Get-Process acclient -EA SilentlyContinue | "
         "ForEach-Object { \"$($_.Id)|$($_.MainWindowTitle)\" }"],
        text=True).strip()
    pids = []
    titles = {}
    for ln in out.splitlines():
        if "|" not in ln: continue
        a, b = ln.split("|", 1)
        try:
            pid = int(a)
            pids.append(pid)
            titles[pid] = b
        except ValueError:
            pass

PROCESS_VM_READ = 0x10
PROCESS_QUERY_INFORMATION = 0x400
class MBI(ctypes.Structure):
    _fields_ = [('BaseAddress', ctypes.c_void_p),
                ('AllocationBase', ctypes.c_void_p),
                ('AllocationProtect', wt.DWORD),
                ('PartitionId', wt.WORD),
                ('RegionSize', ctypes.c_size_t),
                ('State', wt.DWORD),
                ('Protect', wt.DWORD),
                ('Type', wt.DWORD)]
k = ctypes.windll.kernel32
k.OpenProcess.argtypes = [wt.DWORD, wt.BOOL, wt.DWORD]; k.OpenProcess.restype = wt.HANDLE
k.CloseHandle.argtypes = [wt.HANDLE]; k.CloseHandle.restype = wt.BOOL
k.ReadProcessMemory.argtypes = [wt.HANDLE, wt.LPCVOID, wt.LPVOID, ctypes.c_size_t,
                                ctypes.POINTER(ctypes.c_size_t)]
k.ReadProcessMemory.restype = wt.BOOL
k.VirtualQueryEx.argtypes = [wt.HANDLE, ctypes.c_void_p, ctypes.POINTER(MBI), ctypes.c_size_t]
k.VirtualQueryEx.restype = ctypes.c_size_t

def count_pid(pid):
    h = k.OpenProcess(PROCESS_VM_READ | PROCESS_QUERY_INFORMATION, False, pid)
    if not h: return None
    cnt = 0
    mbi = MBI()
    addr = 0
    while k.VirtualQueryEx(h, addr, ctypes.byref(mbi), ctypes.sizeof(mbi)):
        pr = mbi.Protect & 0xff
        if mbi.State == 0x1000 and mbi.Type == 0x20000 and pr in (0x04, 0x40):
            buf = (ctypes.c_ubyte * mbi.RegionSize)()
            sz = ctypes.c_size_t(0)
            if k.ReadProcessMemory(h, mbi.BaseAddress, buf, mbi.RegionSize, ctypes.byref(sz)):
                data = bytes(buf[:sz.value])
                end = (len(data) // 4) * 4
                for off in range(0, end, 4):
                    if struct.unpack_from("<I", data, off)[0] == POSITION_VT:
                        cnt += 1
        addr = (mbi.BaseAddress or 0) + mbi.RegionSize
        if addr >= 0x80000000: break
    k.CloseHandle(h)
    return cnt

print(f"{'pid':>6} {'positions':>10}  title")
for pid in sorted(pids):
    n = count_pid(pid)
    if n is None:
        print(f"{pid:>6}  NOACCESS")
    else:
        try:
            print(f"{pid:>6} {n:>10}  {titles.get(pid, '')}")
        except NameError:
            print(f"{pid:>6} {n:>10}")