57b5e43d0e
Five bugs identified and patched in retail Asheron's Call client: - v3b: palette refcount over-increment (3-byte NOP at two sites) - v5: RenderSurface PurgeResource no-op stub (vtable slot 2 thunk) - v11: two dangling-pointer crash guards (NULL-check + reorder) - v14: CEnvCell::Destroy ClipPlaneList leak (18-byte JMP to cleanup thunk) - v22: unpacker stale-pointer SEH guard (whole-function __try/__except) All five ship in leakfix.dll (117 KB, SHA d282f23c…) which is loaded by acclient.exe at process start via PE import table patching by tools/install_leakfix.py. Controlled 15-client fleet soak: unpatched control died at 26h with palette exhaustion; all 14 patched clients survived past that point and reached ≥5-day uptime. Residual ~15 MB/h growth traced to d3d9.dll's internal slab allocator (260KB surface backing buffers retained after Release). See REPORT.md §10 for the full investigation; conclusion is that it's unfixable from outside d3d9. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
104 lines
4.2 KiB
Python
104 lines
4.2 KiB
Python
"""check_orphan_refcounts.py <pid>
|
|
|
|
For D3DXMesh instances with NO pointers in heap memory, read their
|
|
internal refcount (COM-style at +0x?? — let's check several offsets).
|
|
If refcount > 0, something outside heap (stack/static globals)
|
|
references them. If refcount == 0, they're truly leaked.
|
|
"""
|
|
import ctypes, ctypes.wintypes as wt, struct, sys
|
|
from collections import Counter
|
|
|
|
VTABLE = 0x007ed3b0
|
|
PROCESS_VM_READ=0x10; PROCESS_QUERY_INFORMATION=0x400
|
|
MEM_COMMIT=0x1000; MEM_PRIVATE=0x20000
|
|
|
|
class MBI(ctypes.Structure):
|
|
_fields_ = [('BaseAddress',ctypes.c_void_p),('AllocationBase',ctypes.c_void_p),
|
|
('AllocationProtect',wt.DWORD),('PartitionId',wt.WORD),('RegionSize',ctypes.c_size_t),
|
|
('State',wt.DWORD),('Protect',wt.DWORD),('Type',wt.DWORD)]
|
|
k = ctypes.windll.kernel32
|
|
k.OpenProcess.argtypes=[wt.DWORD,wt.BOOL,wt.DWORD]; k.OpenProcess.restype=wt.HANDLE
|
|
k.ReadProcessMemory.argtypes=[wt.HANDLE,wt.LPCVOID,wt.LPVOID,ctypes.c_size_t,ctypes.POINTER(ctypes.c_size_t)]
|
|
k.ReadProcessMemory.restype=wt.BOOL
|
|
k.VirtualQueryEx.argtypes=[wt.HANDLE,ctypes.c_void_p,ctypes.POINTER(MBI),ctypes.c_size_t]
|
|
k.VirtualQueryEx.restype=ctypes.c_size_t
|
|
|
|
pid = int(sys.argv[1])
|
|
h = k.OpenProcess(PROCESS_VM_READ|PROCESS_QUERY_INFORMATION, False, pid)
|
|
|
|
# Pass 1: enumerate all RW regions and find mesh addrs + collect data
|
|
rw_regions = []
|
|
mbi=MBI(); addr=0
|
|
while k.VirtualQueryEx(h, addr, ctypes.byref(mbi), ctypes.sizeof(mbi)):
|
|
if mbi.State==MEM_COMMIT and mbi.Type==MEM_PRIVATE and (mbi.Protect&0xff) in (0x04, 0x40):
|
|
buf=(ctypes.c_ubyte*mbi.RegionSize)(); sz=ctypes.c_size_t(0)
|
|
if k.ReadProcessMemory(h, mbi.BaseAddress, buf, mbi.RegionSize, ctypes.byref(sz)):
|
|
rw_regions.append((mbi.BaseAddress, bytes(buf[:sz.value])))
|
|
addr=(mbi.BaseAddress or 0)+mbi.RegionSize
|
|
if addr>=0x80000000: break
|
|
|
|
# Find mesh addresses + their data
|
|
mesh_data = {} # addr -> first 64 bytes
|
|
for base, data in rw_regions:
|
|
end = (len(data)//4)*4
|
|
for off in range(0, end-0x40, 4):
|
|
if struct.unpack_from('<I', data, off)[0] == VTABLE:
|
|
mesh_data[base + off] = data[off:off+0x40]
|
|
|
|
print(f'D3DXMesh instances: {len(mesh_data)}')
|
|
|
|
# Pass 2: for each mesh address, count pointers in heap memory
|
|
mesh_addr_set = set(mesh_data.keys())
|
|
ref_counts = {a: 0 for a in mesh_data}
|
|
for base, data in rw_regions:
|
|
end = (len(data)//4)*4
|
|
for off in range(0, end-4, 4):
|
|
v = struct.unpack_from('<I', data, off)[0]
|
|
if v in mesh_addr_set:
|
|
ref_addr = base + off
|
|
if ref_addr in mesh_addr_set: continue # self
|
|
ref_counts[v] += 1
|
|
|
|
orphans = [a for a in mesh_data if ref_counts[a] == 0]
|
|
held = [a for a in mesh_data if ref_counts[a] > 0]
|
|
print(f'orphans (0 heap refs): {len(orphans)}')
|
|
print(f'held: {len(held)}')
|
|
|
|
# For each orphan, dump the first 0x40 bytes and try to find a refcount-looking field
|
|
# COM objects typically have a refcount at +0x04 or +0x08
|
|
print()
|
|
print('=== Orphan mesh refcount candidates (DWORDs at +0x04, +0x08, +0x0c, +0x10, +0x14) ===')
|
|
hist_off04 = Counter()
|
|
hist_off08 = Counter()
|
|
hist_off0c = Counter()
|
|
hist_off10 = Counter()
|
|
hist_off14 = Counter()
|
|
for a in orphans:
|
|
d = mesh_data[a]
|
|
v04 = struct.unpack_from('<I', d, 0x04)[0]
|
|
v08 = struct.unpack_from('<I', d, 0x08)[0]
|
|
v0c = struct.unpack_from('<I', d, 0x0c)[0]
|
|
v10 = struct.unpack_from('<I', d, 0x10)[0]
|
|
v14 = struct.unpack_from('<I', d, 0x14)[0]
|
|
hist_off04[min(v04, 100)] += 1
|
|
hist_off08[min(v08, 100)] += 1
|
|
hist_off0c[min(v0c, 100)] += 1
|
|
hist_off10[min(v10, 100)] += 1
|
|
hist_off14[min(v14, 100)] += 1
|
|
|
|
print(f'+0x04 distribution (top 5): {hist_off04.most_common(5)}')
|
|
print(f'+0x08 distribution (top 5): {hist_off08.most_common(5)}')
|
|
print(f'+0x0c distribution (top 5): {hist_off0c.most_common(5)}')
|
|
print(f'+0x10 distribution (top 5): {hist_off10.most_common(5)}')
|
|
print(f'+0x14 distribution (top 5): {hist_off14.most_common(5)}')
|
|
|
|
# Sample 5 orphans — dump full 0x40 bytes
|
|
print()
|
|
print('=== Sample 5 orphan dumps ===')
|
|
for a in orphans[:5]:
|
|
print(f' mesh @ 0x{a:08x}:')
|
|
d = mesh_data[a]
|
|
for i in range(0, 0x40, 16):
|
|
row = d[i:i+16]
|
|
hex_str = ' '.join(f'{b:02x}' for b in row)
|
|
print(f' +0x{i:02x}: {hex_str}')
|