57b5e43d0e
Five bugs identified and patched in retail Asheron's Call client: - v3b: palette refcount over-increment (3-byte NOP at two sites) - v5: RenderSurface PurgeResource no-op stub (vtable slot 2 thunk) - v11: two dangling-pointer crash guards (NULL-check + reorder) - v14: CEnvCell::Destroy ClipPlaneList leak (18-byte JMP to cleanup thunk) - v22: unpacker stale-pointer SEH guard (whole-function __try/__except) All five ship in leakfix.dll (117 KB, SHA d282f23c…) which is loaded by acclient.exe at process start via PE import table patching by tools/install_leakfix.py. Controlled 15-client fleet soak: unpatched control died at 26h with palette exhaustion; all 14 patched clients survived past that point and reached ≥5-day uptime. Residual ~15 MB/h growth traced to d3d9.dll's internal slab allocator (260KB surface backing buffers retained after Release). See REPORT.md §10 for the full investigation; conclusion is that it's unfixable from outside d3d9. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
102 lines
4.2 KiB
Python
102 lines
4.2 KiB
Python
"""compare_mesh_templates.py <pid>
|
|
|
|
Compare the byte signature (+0x04 to +0x18) of orphan vs held meshes
|
|
to figure out what +0x04 means and whether orphans share a template.
|
|
"""
|
|
import ctypes, ctypes.wintypes as wt, struct, sys
|
|
from collections import Counter
|
|
|
|
VTABLE = 0x007ed3b0
|
|
PROCESS_VM_READ=0x10; PROCESS_QUERY_INFORMATION=0x400
|
|
MEM_COMMIT=0x1000; MEM_PRIVATE=0x20000
|
|
|
|
class MBI(ctypes.Structure):
|
|
_fields_ = [('BaseAddress',ctypes.c_void_p),('AllocationBase',ctypes.c_void_p),
|
|
('AllocationProtect',wt.DWORD),('PartitionId',wt.WORD),('RegionSize',ctypes.c_size_t),
|
|
('State',wt.DWORD),('Protect',wt.DWORD),('Type',wt.DWORD)]
|
|
k = ctypes.windll.kernel32
|
|
k.OpenProcess.argtypes=[wt.DWORD,wt.BOOL,wt.DWORD]; k.OpenProcess.restype=wt.HANDLE
|
|
k.ReadProcessMemory.argtypes=[wt.HANDLE,wt.LPCVOID,wt.LPVOID,ctypes.c_size_t,ctypes.POINTER(ctypes.c_size_t)]
|
|
k.ReadProcessMemory.restype=wt.BOOL
|
|
k.VirtualQueryEx.argtypes=[wt.HANDLE,ctypes.c_void_p,ctypes.POINTER(MBI),ctypes.c_size_t]
|
|
k.VirtualQueryEx.restype=ctypes.c_size_t
|
|
|
|
pid = int(sys.argv[1])
|
|
h = k.OpenProcess(PROCESS_VM_READ|PROCESS_QUERY_INFORMATION, False, pid)
|
|
|
|
rw_regions = []
|
|
mbi=MBI(); addr=0
|
|
while k.VirtualQueryEx(h, addr, ctypes.byref(mbi), ctypes.sizeof(mbi)):
|
|
if mbi.State==MEM_COMMIT and mbi.Type==MEM_PRIVATE and (mbi.Protect&0xff) in (0x04, 0x40):
|
|
buf=(ctypes.c_ubyte*mbi.RegionSize)(); sz=ctypes.c_size_t(0)
|
|
if k.ReadProcessMemory(h, mbi.BaseAddress, buf, mbi.RegionSize, ctypes.byref(sz)):
|
|
rw_regions.append((mbi.BaseAddress, bytes(buf[:sz.value])))
|
|
addr=(mbi.BaseAddress or 0)+mbi.RegionSize
|
|
if addr>=0x80000000: break
|
|
|
|
mesh_data = {}
|
|
for base, data in rw_regions:
|
|
end = (len(data)//4)*4
|
|
for off in range(0, end-0x40, 4):
|
|
if struct.unpack_from('<I', data, off)[0] == VTABLE:
|
|
mesh_data[base + off] = data[off:off+0x40]
|
|
|
|
mesh_addrs = set(mesh_data.keys())
|
|
ref_counts = {a: 0 for a in mesh_data}
|
|
for base, data in rw_regions:
|
|
end = (len(data)//4)*4
|
|
for off in range(0, end-4, 4):
|
|
v = struct.unpack_from('<I', data, off)[0]
|
|
if v in mesh_addrs:
|
|
ra = base + off
|
|
if ra in mesh_addrs: continue
|
|
ref_counts[v] += 1
|
|
|
|
orphans = [a for a in mesh_data if ref_counts[a] == 0]
|
|
held = [a for a in mesh_data if ref_counts[a] > 0]
|
|
print(f'orphans: {len(orphans)} held: {len(held)}')
|
|
|
|
# Histogram +0x04 for orphans vs held
|
|
def hist_off(addrs, offset, top_n=10):
|
|
c = Counter()
|
|
for a in addrs:
|
|
v = struct.unpack_from('<I', mesh_data[a], offset)[0]
|
|
c[v] += 1
|
|
return c.most_common(top_n)
|
|
|
|
for off in [0x04, 0x08, 0x0c, 0x10, 0x14, 0x18, 0x1c, 0x20]:
|
|
o = hist_off(orphans, off, 5)
|
|
h_ = hist_off(held, off, 5)
|
|
print(f'+0x{off:02x} orphans top5: {[(hex(v), n) for v,n in o]}')
|
|
print(f'+0x{off:02x} held top5: {[(hex(v), n) for v,n in h_]}')
|
|
|
|
# Show: do MULTIPLE distinct held meshes share the same +0x04 = 0x252?
|
|
held_with_252 = [a for a in held if struct.unpack_from('<I', mesh_data[a], 0x04)[0] == 0x252]
|
|
orphans_with_252 = [a for a in orphans if struct.unpack_from('<I', mesh_data[a], 0x04)[0] == 0x252]
|
|
print(f'+0x04=0x252: orphans={len(orphans_with_252)} held={len(held_with_252)}')
|
|
|
|
# Now: among orphans, find any "interior" field that differentiates (sample several orphans, look for non-identical bytes)
|
|
print()
|
|
print('=== Are all orphans byte-identical for first 0x40? ===')
|
|
if orphans:
|
|
first = mesh_data[orphans[0]]
|
|
distinct = sum(1 for a in orphans if mesh_data[a] != first)
|
|
print(f'orphans with bytes != first: {distinct} / {len(orphans)}')
|
|
|
|
# Find positions where bytes differ
|
|
if distinct > 0:
|
|
for i in range(0x40):
|
|
byte_set = set(mesh_data[a][i] for a in orphans)
|
|
if len(byte_set) > 1:
|
|
print(f' +0x{i:02x}: varies — sample values: {sorted(byte_set)[:5]}')
|
|
|
|
# Pick an orphan and read its +0x2c field — that's the buffer pointer per earlier analysis
|
|
print()
|
|
print('=== Buffer pointer (+0x2c) of orphans ===')
|
|
buf_addrs = []
|
|
for a in orphans:
|
|
bp = struct.unpack_from('<I', mesh_data[a], 0x2c)[0]
|
|
buf_addrs.append(bp)
|
|
unique_bufs = len(set(buf_addrs))
|
|
print(f'orphans: {len(orphans)}, unique +0x2c values: {unique_bufs}')
|
|
print(f'sample: {[hex(x) for x in buf_addrs[:5]]}')
|