57b5e43d0e
Five bugs identified and patched in retail Asheron's Call client: - v3b: palette refcount over-increment (3-byte NOP at two sites) - v5: RenderSurface PurgeResource no-op stub (vtable slot 2 thunk) - v11: two dangling-pointer crash guards (NULL-check + reorder) - v14: CEnvCell::Destroy ClipPlaneList leak (18-byte JMP to cleanup thunk) - v22: unpacker stale-pointer SEH guard (whole-function __try/__except) All five ship in leakfix.dll (117 KB, SHA d282f23c…) which is loaded by acclient.exe at process start via PE import table patching by tools/install_leakfix.py. Controlled 15-client fleet soak: unpatched control died at 26h with palette exhaustion; all 14 patched clients survived past that point and reached ≥5-day uptime. Residual ~15 MB/h growth traced to d3d9.dll's internal slab allocator (260KB surface backing buffers retained after Release). See REPORT.md §10 for the full investigation; conclusion is that it's unfixable from outside d3d9. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
133 lines
4.7 KiB
Python
133 lines
4.7 KiB
Python
"""find_palette_cache.py <pid>
|
|
|
|
Find the live Palette CLOCache instance in a process.
|
|
|
|
Strategy:
|
|
1. Scan all committed RW memory for DWORD == 0x007c6a98 (DBOCacheVtbl)
|
|
2. For each hit, treat (hit - 0) as start of a CLOCache object
|
|
3. Search the next 0x114 bytes for the Palette::Allocator pointer (0x004f7b70)
|
|
4. If found, that CLOCache is Palette's. Print its address + relevant fields.
|
|
|
|
Fields we care about (from FUN_00416b50 / FreelistAdd):
|
|
+0xf1: byte, cache config flag 1 (freelist enabled?)
|
|
+0xf2: byte, cache config flag 2
|
|
+0xfc: freelist MAX size (uint32)
|
|
+0x100: freelist head ptr
|
|
+0x104: freelist tail ptr
|
|
+0x108: freelist current count
|
|
"""
|
|
import ctypes, ctypes.wintypes as wt, struct, sys
|
|
|
|
VTABLE_DBOCACHE = 0x007c6a98
|
|
ALLOCATOR_PALETTE = 0x004f7b70
|
|
|
|
PROCESS_VM_READ = 0x0010
|
|
PROCESS_QUERY_INFORMATION = 0x0400
|
|
|
|
MEM_COMMIT = 0x1000
|
|
MEM_PRIVATE = 0x20000
|
|
MEM_IMAGE = 0x1000000
|
|
PAGE_READWRITE = 0x04
|
|
PAGE_EXECUTE_READWRITE = 0x40
|
|
|
|
class MEMORY_BASIC_INFORMATION(ctypes.Structure):
|
|
_fields_ = [
|
|
("BaseAddress", ctypes.c_void_p),
|
|
("AllocationBase", ctypes.c_void_p),
|
|
("AllocationProtect", wt.DWORD),
|
|
("PartitionId", wt.WORD),
|
|
("RegionSize", ctypes.c_size_t),
|
|
("State", wt.DWORD),
|
|
("Protect", wt.DWORD),
|
|
("Type", wt.DWORD),
|
|
]
|
|
|
|
k32 = ctypes.windll.kernel32
|
|
OpenProcess = k32.OpenProcess
|
|
OpenProcess.argtypes = [wt.DWORD, wt.BOOL, wt.DWORD]; OpenProcess.restype = wt.HANDLE
|
|
CloseHandle = k32.CloseHandle
|
|
CloseHandle.argtypes = [wt.HANDLE]; CloseHandle.restype = wt.BOOL
|
|
ReadProcessMemory = k32.ReadProcessMemory
|
|
ReadProcessMemory.argtypes = [wt.HANDLE, wt.LPCVOID, wt.LPVOID, ctypes.c_size_t,
|
|
ctypes.POINTER(ctypes.c_size_t)]
|
|
ReadProcessMemory.restype = wt.BOOL
|
|
VirtualQueryEx = k32.VirtualQueryEx
|
|
VirtualQueryEx.argtypes = [wt.HANDLE, ctypes.c_void_p,
|
|
ctypes.POINTER(MEMORY_BASIC_INFORMATION), ctypes.c_size_t]
|
|
VirtualQueryEx.restype = ctypes.c_size_t
|
|
|
|
|
|
def read(h, addr, n):
|
|
buf = (ctypes.c_ubyte * n)()
|
|
sz = ctypes.c_size_t(0)
|
|
if not ReadProcessMemory(h, addr, buf, n, ctypes.byref(sz)):
|
|
return None
|
|
return bytes(buf[:sz.value])
|
|
|
|
|
|
def main():
|
|
pid = int(sys.argv[1])
|
|
h = OpenProcess(PROCESS_VM_READ | PROCESS_QUERY_INFORMATION, False, pid)
|
|
if not h:
|
|
print(f"OpenProcess({pid}) err={ctypes.get_last_error()}"); return
|
|
|
|
mbi = MEMORY_BASIC_INFORMATION()
|
|
addr = 0
|
|
candidates = []
|
|
while VirtualQueryEx(h, addr, ctypes.byref(mbi), ctypes.sizeof(mbi)):
|
|
base = mbi.BaseAddress or 0
|
|
size = mbi.RegionSize
|
|
st = mbi.State
|
|
ty = mbi.Type
|
|
pr = mbi.Protect & 0xFF
|
|
if st == MEM_COMMIT and ty == MEM_PRIVATE and pr in (PAGE_READWRITE, PAGE_EXECUTE_READWRITE):
|
|
data = read(h, base, size)
|
|
if data:
|
|
for off in range(0, len(data) - 4, 4):
|
|
v = struct.unpack_from("<I", data, off)[0]
|
|
if v == VTABLE_DBOCACHE:
|
|
candidates.append((base + off, data[off:off+0x120]))
|
|
addr = base + size
|
|
if addr >= 0x80000000: break
|
|
|
|
print(f"DBOCache vtable hits: {len(candidates)}")
|
|
|
|
palette_cache = None
|
|
for addr, blob in candidates:
|
|
# Search the first 0x114 bytes for Palette::Allocator pointer
|
|
for o in range(0, min(len(blob), 0x114) - 4, 4):
|
|
if struct.unpack_from("<I", blob, o)[0] == ALLOCATOR_PALETTE:
|
|
print(f" CLOCache @ 0x{addr:08x} has ALLOCATOR_PALETTE at offset +0x{o:x}")
|
|
palette_cache = (addr, blob)
|
|
break
|
|
|
|
if not palette_cache:
|
|
print("Palette cache NOT found via Allocator pointer. Trying type_id scan...")
|
|
# Try scanning for type_id == 10 at offset +0x?? of each cache
|
|
for addr, blob in candidates:
|
|
for o in range(0, min(len(blob), 0x114) - 4, 4):
|
|
if struct.unpack_from("<I", blob, o)[0] == 0x0a:
|
|
print(f" Cache @ 0x{addr:08x} has type_id=0xa at +0x{o:x}")
|
|
return
|
|
|
|
addr, blob = palette_cache
|
|
print(f"\n=== Palette CLOCache @ 0x{addr:08x} ===")
|
|
# Read key fields
|
|
cfg1 = blob[0xf1]
|
|
cfg2 = blob[0xf2]
|
|
maxsz = struct.unpack_from("<I", blob, 0xfc)[0]
|
|
head = struct.unpack_from("<I", blob, 0x100)[0]
|
|
tail = struct.unpack_from("<I", blob, 0x104)[0]
|
|
count = struct.unpack_from("<I", blob, 0x108)[0]
|
|
print(f" +0xf1 cfg1: 0x{cfg1:02x}")
|
|
print(f" +0xf2 cfg2: 0x{cfg2:02x}")
|
|
print(f" +0xfc freelist_max: {maxsz} (0x{maxsz:x})")
|
|
print(f" +0x100 head: 0x{head:08x}")
|
|
print(f" +0x104 tail: 0x{tail:08x}")
|
|
print(f" +0x108 count: {count}")
|
|
|
|
CloseHandle(h)
|
|
|
|
|
|
if __name__ == "__main__":
|
|
main()
|