"""find_subclasses.py <dump.dmp> <parent_vtable> <noop_addr>

Find vtables that look like subclasses of a parent class (share parent's
slot 1 = CopyInto address, indicating inheritance not overridden).
For each such vtable, report slot 2 — if it equals noop_addr, the
subclass inherits the no-op stub (= leak source).

Used to find GraphicsResource subclasses that inherit the no-op
PurgeResource and therefore leak forever.
"""
import struct, sys
from minidump.minidumpfile import MinidumpFile


def _ei(v):
    if v is None: return 0
    if hasattr(v, 'value'): return int(v.value)
    return int(v)


def main():
    md = MinidumpFile.parse(sys.argv[1])
    parent_vtable = int(sys.argv[2], 0)
    noop_addr = int(sys.argv[3], 0)

    reader = md.get_reader().get_buffered_reader()

    # Read parent's slot 1 - that's the "shared" value to look for
    reader.move(parent_vtable + 4)
    parent_slot1 = struct.unpack("<I", reader.read(4))[0]
    print(f"Parent vtable: 0x{parent_vtable:08x}")
    print(f"Parent slot 1 (CopyInto-like): 0x{parent_slot1:08x}")
    print(f"No-op stub: 0x{noop_addr:08x}")
    print()

    # Image regions to scan (only image-typed RW)
    image_ranges = []
    for r in md.memory_info.infos:
        st, ty, pr = _ei(r.State), _ei(r.Type), _ei(r.Protect) & 0xff
        if st == 0x1000 and ty == 0x1000000 and pr in (0x02, 0x04, 0x40):
            image_ranges.append((r.BaseAddress, r.RegionSize))

    print(f"scanning {len(image_ranges)} image regions...")

    found = []  # (vtable_addr, slot0, slot2, slot3)
    for base, size in image_ranges:
        try:
            reader.move(base)
            buf = reader.read(size)
        except Exception:
            continue
        if not buf: continue
        end = (len(buf) // 4) * 4
        for off in range(0, end - 16, 4):
            slot1 = struct.unpack_from("<I", buf, off + 4)[0]
            if slot1 != parent_slot1:
                continue
            slot0 = struct.unpack_from("<I", buf, off)[0]
            slot2 = struct.unpack_from("<I", buf, off + 8)[0]
            slot3 = struct.unpack_from("<I", buf, off + 12)[0]
            # Sanity: slot 0 (dtor) should be a code pointer in image
            if slot0 < 0x00400000 or slot0 > 0x10000000:
                continue
            # Skip parent itself
            if base + off == parent_vtable:
                continue
            found.append((base + off, slot0, slot2, slot3))

    print(f"candidate subclass vtables: {len(found)}")
    print()
    print(f"{'vtable':<12} {'slot0 dtor':<12} {'slot2 Purge':<12} {'slot3 Restore':<12}  inherits_noop?")
    for vt, s0, s2, s3 in found:
        marker = "*** LEAKS — inherits no-op PurgeResource ***" if s2 == noop_addr else ""
        print(f"0x{vt:08x}   0x{s0:08x}   0x{s2:08x}   0x{s3:08x}  {marker}")


if __name__ == "__main__":
    main()