57b5e43d0e
Five bugs identified and patched in retail Asheron's Call client: - v3b: palette refcount over-increment (3-byte NOP at two sites) - v5: RenderSurface PurgeResource no-op stub (vtable slot 2 thunk) - v11: two dangling-pointer crash guards (NULL-check + reorder) - v14: CEnvCell::Destroy ClipPlaneList leak (18-byte JMP to cleanup thunk) - v22: unpacker stale-pointer SEH guard (whole-function __try/__except) All five ship in leakfix.dll (117 KB, SHA d282f23c…) which is loaded by acclient.exe at process start via PE import table patching by tools/install_leakfix.py. Controlled 15-client fleet soak: unpatched control died at 26h with palette exhaustion; all 14 patched clients survived past that point and reached ≥5-day uptime. Residual ~15 MB/h growth traced to d3d9.dll's internal slab allocator (260KB surface backing buffers retained after Release). See REPORT.md §10 for the full investigation; conclusion is that it's unfixable from outside d3d9. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
96 lines
3.1 KiB
Python
96 lines
3.1 KiB
Python
"""broader_vtable_sweep.py <larsson.dmp> <time.dmp>
|
|
|
|
Find vtables in the acclient image range that have very high count
|
|
in larsson and low count in time, EXCLUDING the already-tracked ones.
|
|
Aim: surface previously-untracked leak classes.
|
|
"""
|
|
import struct, sys
|
|
from collections import Counter
|
|
from minidump.minidumpfile import MinidumpFile
|
|
|
|
# Known/already-investigated vtables
|
|
KNOWN = {
|
|
0x007c0498: "UIElement_UIItem",
|
|
0x007caa08: "Palette",
|
|
0x007c78ec: "CPhysicsObj",
|
|
0x0079a67c: "RenderSurface",
|
|
0x00801a94: "RenderSurfaceD3D",
|
|
0x00801a18: "RenderTextureD3D",
|
|
0x007ca4dc: "CSurface",
|
|
0x007cab04: "ImgTex",
|
|
0x007ca418: "CGfxObj",
|
|
0x007ed3b0: "D3DXMesh",
|
|
0x0079bf64: "GraphicsResource",
|
|
0x007ccb60: "NoticeHandler_subvt",
|
|
0x007c98e8: "CObjCell_primary",
|
|
0x007c9a60: "CEnvCell_primary",
|
|
0x0079385c: "CObjCell_subvt",
|
|
0x00400c08: "CPhys_data_sentinel",
|
|
0x007c9b58: "CPhys_inner", # speculative
|
|
0x0079c198: "RenderTexture",
|
|
}
|
|
|
|
# Acclient image VA range (32-bit)
|
|
IMG_LO = 0x00400000
|
|
IMG_HI = 0x00880000
|
|
|
|
def _ei(v):
|
|
if v is None: return 0
|
|
if hasattr(v, 'value'): return int(v.value)
|
|
return int(v)
|
|
|
|
def scan(dmp_path):
|
|
md = MinidumpFile.parse(dmp_path)
|
|
reader = md.get_reader().get_buffered_reader()
|
|
counts = Counter()
|
|
for r in md.memory_info.infos:
|
|
st, ty, pr = _ei(r.State), _ei(r.Type), _ei(r.Protect) & 0xff
|
|
if st != 0x1000 or ty == 0x1000000 or pr not in (0x04, 0x40):
|
|
continue
|
|
try:
|
|
reader.move(r.BaseAddress)
|
|
buf = reader.read(r.RegionSize)
|
|
except Exception:
|
|
continue
|
|
if not buf: continue
|
|
end = (len(buf) // 4) * 4
|
|
for off in range(0, end, 4):
|
|
v = struct.unpack_from("<I", buf, off)[0]
|
|
if IMG_LO <= v < IMG_HI:
|
|
# filter UTF-16 noise: low byte 0x00 of every other byte
|
|
# rough check: byte 1 is 0 and byte 3 is 0 with letters in bytes 0,2
|
|
b0, b1, b2, b3 = v & 0xff, (v >> 8) & 0xff, (v >> 16) & 0xff, (v >> 24) & 0xff
|
|
if b1 == 0 and b3 == 0 and 0x20 <= b0 <= 0x7e and 0x20 <= b2 <= 0x7e:
|
|
continue # UTF-16 string fragment
|
|
counts[v] += 1
|
|
return counts
|
|
|
|
|
|
def main():
|
|
larsson = sys.argv[1]
|
|
time_path = sys.argv[2]
|
|
print(f"scanning larsson: {larsson}")
|
|
lc = scan(larsson)
|
|
print(f" unique vtables: {len(lc)}")
|
|
print(f"scanning time: {time_path}")
|
|
tc = scan(time_path)
|
|
print(f" unique vtables: {len(tc)}")
|
|
# Compute diff
|
|
rows = []
|
|
for vt, c in lc.items():
|
|
if vt in KNOWN: continue
|
|
if c < 20: continue
|
|
t = tc.get(vt, 0)
|
|
ratio = c / max(t, 0.5)
|
|
delta = c - t
|
|
rows.append((vt, t, c, ratio, delta))
|
|
rows.sort(key=lambda x: -x[4])
|
|
print()
|
|
print("UN-tracked acclient vtables, sorted by absolute delta (larsson - time):")
|
|
print(f"{'vtable':12} {'time':>6} {'larsson':>8} {'ratio':>7} {'delta':>7}")
|
|
for vt, t, c, ratio, delta in rows[:40]:
|
|
print(f"0x{vt:08x} {t:>6} {c:>8} {ratio:>7.1f} {delta:>7}")
|
|
|
|
|
|
if __name__ == "__main__":
|
|
main()
|