"""dump_cgfxobj.py <pid>

Enumerate CGfxObj instances (vtable 0x007ca418) in a live process and
classify by:
  - refcount (+0x24): how many references
  - m_pMaintainer (+0x20): NULL = uncached, non-NULL = DBOCache-managed
  - constructed_mesh (+0x6c): mesh holder
"""
import ctypes, ctypes.wintypes as wt, struct, sys
from collections import Counter

VTABLE = 0x007ca418
PROCESS_VM_READ=0x10; PROCESS_QUERY_INFORMATION=0x400
MEM_COMMIT=0x1000; MEM_PRIVATE=0x20000

class MBI(ctypes.Structure):
    _fields_ = [('BaseAddress',ctypes.c_void_p),('AllocationBase',ctypes.c_void_p),
                ('AllocationProtect',wt.DWORD),('PartitionId',wt.WORD),('RegionSize',ctypes.c_size_t),
                ('State',wt.DWORD),('Protect',wt.DWORD),('Type',wt.DWORD)]
k = ctypes.windll.kernel32
k.OpenProcess.argtypes=[wt.DWORD,wt.BOOL,wt.DWORD]; k.OpenProcess.restype=wt.HANDLE
k.ReadProcessMemory.argtypes=[wt.HANDLE,wt.LPCVOID,wt.LPVOID,ctypes.c_size_t,ctypes.POINTER(ctypes.c_size_t)]
k.ReadProcessMemory.restype=wt.BOOL
k.VirtualQueryEx.argtypes=[wt.HANDLE,ctypes.c_void_p,ctypes.POINTER(MBI),ctypes.c_size_t]
k.VirtualQueryEx.restype=ctypes.c_size_t

pid = int(sys.argv[1])
h = k.OpenProcess(PROCESS_VM_READ|PROCESS_QUERY_INFORMATION, False, pid)
if not h:
    print('open fail'); sys.exit(1)

instances = []
mbi=MBI(); addr=0
while k.VirtualQueryEx(h, addr, ctypes.byref(mbi), ctypes.sizeof(mbi)):
    if mbi.State==MEM_COMMIT and mbi.Type==MEM_PRIVATE and (mbi.Protect&0xff) in (0x04,0x40):
        buf=(ctypes.c_ubyte*mbi.RegionSize)(); sz=ctypes.c_size_t(0)
        if k.ReadProcessMemory(h, mbi.BaseAddress, buf, mbi.RegionSize, ctypes.byref(sz)):
            data=bytes(buf[:sz.value]); end=(len(data)//4)*4
            for off in range(0, end-0x80, 4):
                if struct.unpack_from('<I', data, off)[0] == VTABLE:
                    obj_addr = mbi.BaseAddress + off
                    refcount = struct.unpack_from('<I', data, off + 0x24)[0]
                    maintainer = struct.unpack_from('<I', data, off + 0x20)[0]
                    mesh = struct.unpack_from('<I', data, off + 0x6c)[0]
                    dataid = struct.unpack_from('<I', data, off + 0x28)[0]
                    instances.append((obj_addr, refcount, maintainer, mesh, dataid))
    addr=(mbi.BaseAddress or 0)+mbi.RegionSize
    if addr>=0x80000000: break

print(f'PID {pid}: {len(instances)} CGfxObj instances')

# Buckets
maint_null_mesh_null   = 0
maint_null_mesh_set    = 0
maint_set_mesh_null    = 0
maint_set_mesh_set     = 0
rc_hist = Counter()
for addr, rc, m, mesh, did in instances:
    rc_hist[min(rc, 100)] += 1
    if m == 0 and mesh == 0: maint_null_mesh_null += 1
    elif m == 0 and mesh != 0: maint_null_mesh_set += 1
    elif m != 0 and mesh == 0: maint_set_mesh_null += 1
    else: maint_set_mesh_set += 1

print(f'Quadrants (m_pMaintainer, constructed_mesh):')
print(f'  NULL/NULL: {maint_null_mesh_null}')
print(f'  NULL/SET:  {maint_null_mesh_set}  <- ORPHAN MESHES (potential leak)')
print(f'  SET/NULL:  {maint_set_mesh_null}')
print(f'  SET/SET:   {maint_set_mesh_set}   <- cached with mesh (normal)')

print('refcount histogram (top 8):')
for rc, n in rc_hist.most_common(8):
    print(f'  rc={rc}: {n}')

# Show 5 examples of orphan
print('Examples of NULL/SET orphans:')
ex_count = 0
for addr, rc, m, mesh, did in instances:
    if m == 0 and mesh != 0 and ex_count < 5:
        print(f'  obj 0x{addr:08x}  rc={rc}  mesh=0x{mesh:08x}  DataID=0x{did:08x}')
        ex_count += 1