57b5e43d0e
Five bugs identified and patched in retail Asheron's Call client: - v3b: palette refcount over-increment (3-byte NOP at two sites) - v5: RenderSurface PurgeResource no-op stub (vtable slot 2 thunk) - v11: two dangling-pointer crash guards (NULL-check + reorder) - v14: CEnvCell::Destroy ClipPlaneList leak (18-byte JMP to cleanup thunk) - v22: unpacker stale-pointer SEH guard (whole-function __try/__except) All five ship in leakfix.dll (117 KB, SHA d282f23c…) which is loaded by acclient.exe at process start via PE import table patching by tools/install_leakfix.py. Controlled 15-client fleet soak: unpatched control died at 26h with palette exhaustion; all 14 patched clients survived past that point and reached ≥5-day uptime. Residual ~15 MB/h growth traced to d3d9.dll's internal slab allocator (260KB surface backing buffers retained after Release). See REPORT.md §10 for the full investigation; conclusion is that it's unfixable from outside d3d9. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
78 lines
2.8 KiB
Python
78 lines
2.8 KiB
Python
"""find_subclasses.py <dump.dmp> <parent_vtable> <noop_addr>
|
|
|
|
Find vtables that look like subclasses of a parent class (share parent's
|
|
slot 1 = CopyInto address, indicating inheritance not overridden).
|
|
For each such vtable, report slot 2 — if it equals noop_addr, the
|
|
subclass inherits the no-op stub (= leak source).
|
|
|
|
Used to find GraphicsResource subclasses that inherit the no-op
|
|
PurgeResource and therefore leak forever.
|
|
"""
|
|
import struct, sys
|
|
from minidump.minidumpfile import MinidumpFile
|
|
|
|
|
|
def _ei(v):
|
|
if v is None: return 0
|
|
if hasattr(v, 'value'): return int(v.value)
|
|
return int(v)
|
|
|
|
|
|
def main():
|
|
md = MinidumpFile.parse(sys.argv[1])
|
|
parent_vtable = int(sys.argv[2], 0)
|
|
noop_addr = int(sys.argv[3], 0)
|
|
|
|
reader = md.get_reader().get_buffered_reader()
|
|
|
|
# Read parent's slot 1 - that's the "shared" value to look for
|
|
reader.move(parent_vtable + 4)
|
|
parent_slot1 = struct.unpack("<I", reader.read(4))[0]
|
|
print(f"Parent vtable: 0x{parent_vtable:08x}")
|
|
print(f"Parent slot 1 (CopyInto-like): 0x{parent_slot1:08x}")
|
|
print(f"No-op stub: 0x{noop_addr:08x}")
|
|
print()
|
|
|
|
# Image regions to scan (only image-typed RW)
|
|
image_ranges = []
|
|
for r in md.memory_info.infos:
|
|
st, ty, pr = _ei(r.State), _ei(r.Type), _ei(r.Protect) & 0xff
|
|
if st == 0x1000 and ty == 0x1000000 and pr in (0x02, 0x04, 0x40):
|
|
image_ranges.append((r.BaseAddress, r.RegionSize))
|
|
|
|
print(f"scanning {len(image_ranges)} image regions...")
|
|
|
|
found = [] # (vtable_addr, slot0, slot2, slot3)
|
|
for base, size in image_ranges:
|
|
try:
|
|
reader.move(base)
|
|
buf = reader.read(size)
|
|
except Exception:
|
|
continue
|
|
if not buf: continue
|
|
end = (len(buf) // 4) * 4
|
|
for off in range(0, end - 16, 4):
|
|
slot1 = struct.unpack_from("<I", buf, off + 4)[0]
|
|
if slot1 != parent_slot1:
|
|
continue
|
|
slot0 = struct.unpack_from("<I", buf, off)[0]
|
|
slot2 = struct.unpack_from("<I", buf, off + 8)[0]
|
|
slot3 = struct.unpack_from("<I", buf, off + 12)[0]
|
|
# Sanity: slot 0 (dtor) should be a code pointer in image
|
|
if slot0 < 0x00400000 or slot0 > 0x10000000:
|
|
continue
|
|
# Skip parent itself
|
|
if base + off == parent_vtable:
|
|
continue
|
|
found.append((base + off, slot0, slot2, slot3))
|
|
|
|
print(f"candidate subclass vtables: {len(found)}")
|
|
print()
|
|
print(f"{'vtable':<12} {'slot0 dtor':<12} {'slot2 Purge':<12} {'slot3 Restore':<12} inherits_noop?")
|
|
for vt, s0, s2, s3 in found:
|
|
marker = "*** LEAKS — inherits no-op PurgeResource ***" if s2 == noop_addr else ""
|
|
print(f"0x{vt:08x} 0x{s0:08x} 0x{s2:08x} 0x{s3:08x} {marker}")
|
|
|
|
|
|
if __name__ == "__main__":
|
|
main()
|