"""find_mesh_holders.py <pid>

Find what classes hold D3DXMesh (vtable 0x007ed3b0) references in a
live process.

Method:
  1. Enumerate D3DXMesh instances (DWORDs equal to vtable 0x007ed3b0)
  2. Scan all committed RW memory for DWORDs equal to a D3DXMesh
     instance address — those are pointers TO meshes
  3. For each pointer hit, walk backwards up to 0x100 bytes within
     the same region to find the containing object's vtable
  4. Histogram by (owner_vtable, offset_of_mesh_pointer_within_owner)
"""
import ctypes, ctypes.wintypes as wt, struct, sys
from collections import Counter

VTABLE = 0x007ed3b0
PROCESS_VM_READ=0x10; PROCESS_QUERY_INFORMATION=0x400
MEM_COMMIT=0x1000; MEM_PRIVATE=0x20000; MEM_IMAGE=0x1000000

class MBI(ctypes.Structure):
    _fields_ = [('BaseAddress',ctypes.c_void_p),('AllocationBase',ctypes.c_void_p),
                ('AllocationProtect',wt.DWORD),('PartitionId',wt.WORD),('RegionSize',ctypes.c_size_t),
                ('State',wt.DWORD),('Protect',wt.DWORD),('Type',wt.DWORD)]
k = ctypes.windll.kernel32
k.OpenProcess.argtypes=[wt.DWORD,wt.BOOL,wt.DWORD]; k.OpenProcess.restype=wt.HANDLE
k.ReadProcessMemory.argtypes=[wt.HANDLE,wt.LPCVOID,wt.LPVOID,ctypes.c_size_t,ctypes.POINTER(ctypes.c_size_t)]
k.ReadProcessMemory.restype=wt.BOOL
k.VirtualQueryEx.argtypes=[wt.HANDLE,ctypes.c_void_p,ctypes.POINTER(MBI),ctypes.c_size_t]
k.VirtualQueryEx.restype=ctypes.c_size_t

pid = int(sys.argv[1])
h = k.OpenProcess(PROCESS_VM_READ|PROCESS_QUERY_INFORMATION, False, pid)
if not h: print('open fail'); sys.exit(1)

# Pass 1: enumerate regions and snapshot RW + image
rw_regions = []  # (base, data)
image_ranges = []
mbi=MBI(); addr=0
while k.VirtualQueryEx(h, addr, ctypes.byref(mbi), ctypes.sizeof(mbi)):
    if mbi.State==MEM_COMMIT and (mbi.Protect&0xff) != 0x01:
        if mbi.Type==MEM_IMAGE:
            image_ranges.append((mbi.BaseAddress, mbi.BaseAddress+mbi.RegionSize))
        elif mbi.Type==MEM_PRIVATE and (mbi.Protect&0xff) in (0x04, 0x40):
            buf=(ctypes.c_ubyte*mbi.RegionSize)(); sz=ctypes.c_size_t(0)
            if k.ReadProcessMemory(h, mbi.BaseAddress, buf, mbi.RegionSize, ctypes.byref(sz)) and sz.value:
                rw_regions.append((mbi.BaseAddress, bytes(buf[:sz.value])))
    addr=(mbi.BaseAddress or 0)+mbi.RegionSize
    if addr>=0x80000000: break

def is_image(p):
    for lo, hi in image_ranges:
        if lo <= p < hi: return True
    return False

# Pass 2: find all D3DXMesh instance addresses
mesh_addrs = set()
for base, data in rw_regions:
    end = (len(data)//4)*4
    for off in range(0, end-4, 4):
        if struct.unpack_from('<I', data, off)[0] == VTABLE:
            mesh_addrs.add(base + off)
print(f'D3DXMesh instances: {len(mesh_addrs)}')

# Pass 3: scan all RW memory for DWORDs equal to a mesh address (= pointer to a mesh)
hits = []  # list of (referring_addr, mesh_addr)
mesh_addr_set = mesh_addrs
for base, data in rw_regions:
    end = (len(data)//4)*4
    for off in range(0, end-4, 4):
        v = struct.unpack_from('<I', data, off)[0]
        if v in mesh_addr_set:
            # exclude self-references (vtable slot inside the mesh's own object data)
            if base + off in mesh_addr_set: continue
            hits.append((base + off, v, base, off, data))
print(f'pointers TO meshes: {len(hits)}')

# Pass 4: for each hit, look backwards within same region for vtable (image-resident DWORD)
LOOKBACK = 0x100
vtable_hits = Counter()
field_offsets = Counter()
examples = {}
no_vt = 0
for hit_va, ptr_val, base, off, data in hits:
    found = False
    start = max(0, off - LOOKBACK)
    for back in range(off - 4, start - 4, -4):
        if back < 0: break
        v = struct.unpack_from('<I', data, back)[0]
        if 0x00400000 <= v < 0x10000000 and is_image(v):
            field_off = off - back
            vtable_hits[(v, field_off)] += 1
            field_offsets[v] += 1
            ex = examples.setdefault((v, field_off), [])
            if len(ex) < 2:
                ex.append((hit_va, ptr_val))
            found = True
            break
    if not found:
        no_vt += 1

print(f'pointers with no preceding vtable in 0x100 lookback: {no_vt}')
print()
print('=== Top owner vtables (D3DXMesh refs) ===')
for vt, cnt in field_offsets.most_common(15):
    print(f'  0x{vt:08x}  total refs: {cnt}')
print()
print('=== Top (vtable, field_offset) pairs ===')
for (vt, fo), cnt in vtable_hits.most_common(20):
    ex = examples[(vt, fo)][0]
    print(f'  0x{vt:08x}  +0x{fo:03x}  count={cnt}  e.g. hit@0x{ex[0]:08x} -> mesh@0x{ex[1]:08x}')