"""dump_leaked_objects.py <dump.dmp>

For each object with primary vtable 0x007caa08, dump full state.
Also dump the first 256 bytes of the buffer it points to (if any).
"""
import struct, sys
from collections import Counter
from minidump.minidumpfile import MinidumpFile


VTABLE_PRIMARY = 0x007caa08
VTABLE_SECONDARY = 0x007ca9f4
SECONDARY_OFFSET = 0x30


def _ei(v):
    if v is None: return 0
    if hasattr(v, 'value'): return int(v.value)
    return int(v)


def main():
    md = MinidumpFile.parse(sys.argv[1])
    reader = md.get_reader().get_buffered_reader()

    # Leaked regions
    leaked = []
    leaked_set = set()
    for r in md.memory_info.infos:
        st, ty, pr = _ei(r.State), _ei(r.Type), _ei(r.Protect) & 0xff
        if st == 0x1000 and ty == 0x20000 and pr in (0x04, 0x40) \
                and 256*1024 <= r.RegionSize < 512*1024:
            leaked.append((r.BaseAddress, r.RegionSize))
            leaked_set.add(r.BaseAddress)
    def in_leaked(p):
        if p in leaked_set: return True
        for b, s in leaked:
            if b <= p < b + s: return (b, s)
        return False

    # Find all instances of vtable 0x007caa08 at offset 0
    scan = []
    for r in md.memory_info.infos:
        st, ty, pr = _ei(r.State), _ei(r.Type), _ei(r.Protect) & 0xff
        if st != 0x1000 or ty == 0x1000000 or pr not in (0x04, 0x40): continue
        scan.append((r.BaseAddress, r.RegionSize))

    objs = []
    for base, size in scan:
        try:
            reader.move(base); buf = reader.read(size)
        except Exception: continue
        if not buf: continue
        end = (len(buf) // 4) * 4
        for off in range(0, end - 0x48, 4):
            if struct.unpack_from("<I", buf, off)[0] != VTABLE_PRIMARY: continue
            # Verify secondary vtable at +0x30
            sec = struct.unpack_from("<I", buf, off + SECONDARY_OFFSET)[0]
            if sec != VTABLE_SECONDARY: continue
            obj_addr = base + off
            fields = [struct.unpack_from("<I", buf, off + i*4)[0] for i in range(18)]
            objs.append((obj_addr, fields))

    print(f"objects with primary vtable 0x{VTABLE_PRIMARY:08x}: {len(objs)}")
    print()

    # Histogram +0x38 (size field) and +0x40 (buffer) leaked-in
    size_hist = Counter()
    buf_leaked = 0
    buf_null = 0
    refcount_hist = Counter()
    for addr, f in objs:
        # +0x10 = refcount per DBObj (slot 4 of 0x007caa08 is AddRef at refcount +0x10 ... actually
        # DBObj refcount per DBObj::AddRef decompile is at +0x24)
        rc = f[9]   # +0x24
        sz_field = f[0xe]  # +0x38
        buf_ptr  = f[0x10]  # +0x40
        refcount_hist[rc] += 1
        size_hist[sz_field] += 1
        if buf_ptr == 0:
            buf_null += 1
        else:
            r = in_leaked(buf_ptr)
            if r:
                buf_leaked += 1

    print(f"+0x40 buffer pointer: null={buf_null}, in_leaked_256-512KB={buf_leaked}")
    print(f"+0x38 size field top 10:")
    for sz, n in size_hist.most_common(10):
        print(f"  size=0x{sz:x} ({sz})  count={n}")
    print(f"+0x24 refcount top 10:")
    for rc, n in refcount_hist.most_common(10):
        print(f"  rc={rc}  count={n}")

    # Show first 10 examples
    print()
    print("first 10 objects (addr, vtbl, +4..+0x44):")
    for addr, f in objs[:10]:
        flds = " ".join(f"{v:08x}" for v in f)
        print(f"  0x{addr:08x}  {flds}")

    # For objects with non-null +0x40, dump first bytes of that buffer
    print()
    print("=== sample buffers at +0x40 (first 64 bytes) ===")
    n_dumped = 0
    for addr, f in objs:
        if n_dumped >= 8: break
        buf_ptr = f[0x10]
        if buf_ptr == 0: continue
        try:
            reader.move(buf_ptr); raw = reader.read(64)
        except Exception:
            continue
        if not raw: continue
        h = " ".join(f"{b:02x}" for b in raw)
        print(f"  obj 0x{addr:08x} +0x40 -> 0x{buf_ptr:08x}:  {h}")
        n_dumped += 1


if __name__ == "__main__":
    main()