"""probe_rs_base_inert.py <pid>
Same probe as probe_rsd3d_lost.py but for RenderSurface base
(vfptr=0x0079a67c). Check if v5's RS::Destroy actually frees anything,
or if RS base instances also have NULL buffers (making v5 inert).

Probes:
  - lost-entry count
  - entry+0x34 (= primary+0x64, first delete in RS::Destroy)
  - entry+0xE4 (= primary+0x114 = m_pSurfaceBits, second delete)"""
import ctypes, ctypes.wintypes as wt, sys, struct

PROCESS_VM_READ = 0x10
PROCESS_QUERY_INFORMATION = 0x400
k = ctypes.windll.kernel32
k.OpenProcess.argtypes = [wt.DWORD, wt.BOOL, wt.DWORD]; k.OpenProcess.restype = wt.HANDLE
k.ReadProcessMemory.argtypes = [wt.HANDLE, wt.LPCVOID, wt.LPVOID, ctypes.c_size_t, ctypes.POINTER(ctypes.c_size_t)]
k.ReadProcessMemory.restype = wt.BOOL

S_RESOURCES_M_DATA = 0x008398C4
S_RESOURCES_M_NUM  = 0x008398CC
RS_BASE_VTABLE     = 0x0079a67c

def rd(h, va, n):
    buf = (ctypes.c_ubyte * n)(); sz = ctypes.c_size_t(0)
    if not k.ReadProcessMemory(h, va, buf, n, ctypes.byref(sz)): return None
    return bytes(buf[:sz.value])

def rd_u32(h, va):
    b = rd(h, va, 4); return struct.unpack('<I', b)[0] if b else None

pid = int(sys.argv[1])
h = k.OpenProcess(PROCESS_VM_READ | PROCESS_QUERY_INFORMATION, False, pid)
if not h: print(f"OpenProcess err={ctypes.get_last_error()}"); sys.exit(2)

m_data = rd_u32(h, S_RESOURCES_M_DATA)
m_num  = rd_u32(h, S_RESOURCES_M_NUM)
print(f"pid {pid}: s_Resources m_data=0x{m_data:08x} m_num={m_num}")

total = 0; lost = 0; live = 0
buf1_nn = 0; buf2_nn = 0; either_nn = 0
samples = []

# Also separately scan LIVE entries (not lost) to see what buffers look like before v5 fires
live_buf1_nn = 0; live_buf2_nn = 0; live_either_nn = 0

for i in range(min(m_num, 100000)):
    entry = rd_u32(h, m_data + i * 4)
    if not entry: continue
    vt = rd_u32(h, entry)
    if vt != RS_BASE_VTABLE: continue
    total += 1
    bIsLost_word = rd_u32(h, entry + 8)
    is_lost = (bIsLost_word & 0xFF) != 0
    buf1 = rd_u32(h, entry + 0x34)   # primary+0x64
    buf2 = rd_u32(h, entry + 0xE4)   # primary+0x114
    if buf1 is None or buf2 is None: continue

    if is_lost:
        lost += 1
        if buf1 != 0: buf1_nn += 1
        if buf2 != 0: buf2_nn += 1
        if buf1 != 0 or buf2 != 0:
            either_nn += 1
            if len(samples) < 5:
                samples.append(('LOST', entry, buf1, buf2))
    else:
        live += 1
        if buf1 != 0: live_buf1_nn += 1
        if buf2 != 0: live_buf2_nn += 1
        if buf1 != 0 or buf2 != 0:
            live_either_nn += 1
            if len(samples) < 10:
                samples.append(('LIVE', entry, buf1, buf2))

print(f"RS base: total={total} lost={lost} live={live}")
print(f"  LOST entries:")
print(f"    buf1 (primary+0x64) non-NULL:    {buf1_nn:5d} / {lost} ({100*buf1_nn//max(lost,1)}%)")
print(f"    buf2 (m_pSurfaceBits) non-NULL:  {buf2_nn:5d} / {lost} ({100*buf2_nn//max(lost,1)}%)")
print(f"    either non-NULL:                 {either_nn:5d} / {lost} ({100*either_nn//max(lost,1)}%)")
print(f"  LIVE entries:")
print(f"    buf1 (primary+0x64) non-NULL:    {live_buf1_nn:5d} / {live} ({100*live_buf1_nn//max(live,1)}%)")
print(f"    buf2 (m_pSurfaceBits) non-NULL:  {live_buf2_nn:5d} / {live} ({100*live_buf2_nn//max(live,1)}%)")
print(f"    either non-NULL:                 {live_either_nn:5d} / {live} ({100*live_either_nn//max(live,1)}%)")
print(f"  Sample non-NULL entries:")
for status, entry, b1, b2 in samples:
    print(f"    [{status}] entry=0x{entry:08x} buf1=0x{b1:08x} buf2=0x{b2:08x}")