57b5e43d0e
Five bugs identified and patched in retail Asheron's Call client: - v3b: palette refcount over-increment (3-byte NOP at two sites) - v5: RenderSurface PurgeResource no-op stub (vtable slot 2 thunk) - v11: two dangling-pointer crash guards (NULL-check + reorder) - v14: CEnvCell::Destroy ClipPlaneList leak (18-byte JMP to cleanup thunk) - v22: unpacker stale-pointer SEH guard (whole-function __try/__except) All five ship in leakfix.dll (117 KB, SHA d282f23c…) which is loaded by acclient.exe at process start via PE import table patching by tools/install_leakfix.py. Controlled 15-client fleet soak: unpatched control died at 26h with palette exhaustion; all 14 patched clients survived past that point and reached ≥5-day uptime. Residual ~15 MB/h growth traced to d3d9.dll's internal slab allocator (260KB surface backing buffers retained after Release). See REPORT.md §10 for the full investigation; conclusion is that it's unfixable from outside d3d9. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
111 lines
4.5 KiB
Python
111 lines
4.5 KiB
Python
"""find_mesh_holders.py <pid>
|
|
|
|
Find what classes hold D3DXMesh (vtable 0x007ed3b0) references in a
|
|
live process.
|
|
|
|
Method:
|
|
1. Enumerate D3DXMesh instances (DWORDs equal to vtable 0x007ed3b0)
|
|
2. Scan all committed RW memory for DWORDs equal to a D3DXMesh
|
|
instance address — those are pointers TO meshes
|
|
3. For each pointer hit, walk backwards up to 0x100 bytes within
|
|
the same region to find the containing object's vtable
|
|
4. Histogram by (owner_vtable, offset_of_mesh_pointer_within_owner)
|
|
"""
|
|
import ctypes, ctypes.wintypes as wt, struct, sys
|
|
from collections import Counter
|
|
|
|
VTABLE = 0x007ed3b0
|
|
PROCESS_VM_READ=0x10; PROCESS_QUERY_INFORMATION=0x400
|
|
MEM_COMMIT=0x1000; MEM_PRIVATE=0x20000; MEM_IMAGE=0x1000000
|
|
|
|
class MBI(ctypes.Structure):
|
|
_fields_ = [('BaseAddress',ctypes.c_void_p),('AllocationBase',ctypes.c_void_p),
|
|
('AllocationProtect',wt.DWORD),('PartitionId',wt.WORD),('RegionSize',ctypes.c_size_t),
|
|
('State',wt.DWORD),('Protect',wt.DWORD),('Type',wt.DWORD)]
|
|
k = ctypes.windll.kernel32
|
|
k.OpenProcess.argtypes=[wt.DWORD,wt.BOOL,wt.DWORD]; k.OpenProcess.restype=wt.HANDLE
|
|
k.ReadProcessMemory.argtypes=[wt.HANDLE,wt.LPCVOID,wt.LPVOID,ctypes.c_size_t,ctypes.POINTER(ctypes.c_size_t)]
|
|
k.ReadProcessMemory.restype=wt.BOOL
|
|
k.VirtualQueryEx.argtypes=[wt.HANDLE,ctypes.c_void_p,ctypes.POINTER(MBI),ctypes.c_size_t]
|
|
k.VirtualQueryEx.restype=ctypes.c_size_t
|
|
|
|
pid = int(sys.argv[1])
|
|
h = k.OpenProcess(PROCESS_VM_READ|PROCESS_QUERY_INFORMATION, False, pid)
|
|
if not h: print('open fail'); sys.exit(1)
|
|
|
|
# Pass 1: enumerate regions and snapshot RW + image
|
|
rw_regions = [] # (base, data)
|
|
image_ranges = []
|
|
mbi=MBI(); addr=0
|
|
while k.VirtualQueryEx(h, addr, ctypes.byref(mbi), ctypes.sizeof(mbi)):
|
|
if mbi.State==MEM_COMMIT and (mbi.Protect&0xff) != 0x01:
|
|
if mbi.Type==MEM_IMAGE:
|
|
image_ranges.append((mbi.BaseAddress, mbi.BaseAddress+mbi.RegionSize))
|
|
elif mbi.Type==MEM_PRIVATE and (mbi.Protect&0xff) in (0x04, 0x40):
|
|
buf=(ctypes.c_ubyte*mbi.RegionSize)(); sz=ctypes.c_size_t(0)
|
|
if k.ReadProcessMemory(h, mbi.BaseAddress, buf, mbi.RegionSize, ctypes.byref(sz)) and sz.value:
|
|
rw_regions.append((mbi.BaseAddress, bytes(buf[:sz.value])))
|
|
addr=(mbi.BaseAddress or 0)+mbi.RegionSize
|
|
if addr>=0x80000000: break
|
|
|
|
def is_image(p):
|
|
for lo, hi in image_ranges:
|
|
if lo <= p < hi: return True
|
|
return False
|
|
|
|
# Pass 2: find all D3DXMesh instance addresses
|
|
mesh_addrs = set()
|
|
for base, data in rw_regions:
|
|
end = (len(data)//4)*4
|
|
for off in range(0, end-4, 4):
|
|
if struct.unpack_from('<I', data, off)[0] == VTABLE:
|
|
mesh_addrs.add(base + off)
|
|
print(f'D3DXMesh instances: {len(mesh_addrs)}')
|
|
|
|
# Pass 3: scan all RW memory for DWORDs equal to a mesh address (= pointer to a mesh)
|
|
hits = [] # list of (referring_addr, mesh_addr)
|
|
mesh_addr_set = mesh_addrs
|
|
for base, data in rw_regions:
|
|
end = (len(data)//4)*4
|
|
for off in range(0, end-4, 4):
|
|
v = struct.unpack_from('<I', data, off)[0]
|
|
if v in mesh_addr_set:
|
|
# exclude self-references (vtable slot inside the mesh's own object data)
|
|
if base + off in mesh_addr_set: continue
|
|
hits.append((base + off, v, base, off, data))
|
|
print(f'pointers TO meshes: {len(hits)}')
|
|
|
|
# Pass 4: for each hit, look backwards within same region for vtable (image-resident DWORD)
|
|
LOOKBACK = 0x100
|
|
vtable_hits = Counter()
|
|
field_offsets = Counter()
|
|
examples = {}
|
|
no_vt = 0
|
|
for hit_va, ptr_val, base, off, data in hits:
|
|
found = False
|
|
start = max(0, off - LOOKBACK)
|
|
for back in range(off - 4, start - 4, -4):
|
|
if back < 0: break
|
|
v = struct.unpack_from('<I', data, back)[0]
|
|
if 0x00400000 <= v < 0x10000000 and is_image(v):
|
|
field_off = off - back
|
|
vtable_hits[(v, field_off)] += 1
|
|
field_offsets[v] += 1
|
|
ex = examples.setdefault((v, field_off), [])
|
|
if len(ex) < 2:
|
|
ex.append((hit_va, ptr_val))
|
|
found = True
|
|
break
|
|
if not found:
|
|
no_vt += 1
|
|
|
|
print(f'pointers with no preceding vtable in 0x100 lookback: {no_vt}')
|
|
print()
|
|
print('=== Top owner vtables (D3DXMesh refs) ===')
|
|
for vt, cnt in field_offsets.most_common(15):
|
|
print(f' 0x{vt:08x} total refs: {cnt}')
|
|
print()
|
|
print('=== Top (vtable, field_offset) pairs ===')
|
|
for (vt, fo), cnt in vtable_hits.most_common(20):
|
|
ex = examples[(vt, fo)][0]
|
|
print(f' 0x{vt:08x} +0x{fo:03x} count={cnt} e.g. hit@0x{ex[0]:08x} -> mesh@0x{ex[1]:08x}')
|