57b5e43d0e
Five bugs identified and patched in retail Asheron's Call client: - v3b: palette refcount over-increment (3-byte NOP at two sites) - v5: RenderSurface PurgeResource no-op stub (vtable slot 2 thunk) - v11: two dangling-pointer crash guards (NULL-check + reorder) - v14: CEnvCell::Destroy ClipPlaneList leak (18-byte JMP to cleanup thunk) - v22: unpacker stale-pointer SEH guard (whole-function __try/__except) All five ship in leakfix.dll (117 KB, SHA d282f23c…) which is loaded by acclient.exe at process start via PE import table patching by tools/install_leakfix.py. Controlled 15-client fleet soak: unpatched control died at 26h with palette exhaustion; all 14 patched clients survived past that point and reached ≥5-day uptime. Residual ~15 MB/h growth traced to d3d9.dll's internal slab allocator (260KB surface backing buffers retained after Release). See REPORT.md §10 for the full investigation; conclusion is that it's unfixable from outside d3d9. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
52 lines
1.9 KiB
Python
52 lines
1.9 KiB
Python
"""histogram_region_for_vt.py <dump> <vt>
|
|
Show distribution of regions containing the given vtable signature, with region sizes.
|
|
Also pick 5 hit addresses and read 0x40 bytes after the vtable to see what fields look like.
|
|
"""
|
|
import struct, sys
|
|
from collections import Counter
|
|
from minidump.minidumpfile import MinidumpFile
|
|
|
|
def _ei(v):
|
|
if v is None: return 0
|
|
if hasattr(v, 'value'): return int(v.value)
|
|
return int(v)
|
|
|
|
md = MinidumpFile.parse(sys.argv[1])
|
|
target = int(sys.argv[2], 16)
|
|
reader = md.get_reader().get_buffered_reader()
|
|
region_sizes = Counter()
|
|
hit_addrs = []
|
|
total_hits = 0
|
|
for r in md.memory_info.infos:
|
|
st, ty, pr = _ei(r.State), _ei(r.Type), _ei(r.Protect) & 0xff
|
|
if st != 0x1000 or ty == 0x1000000 or pr not in (0x04, 0x40):
|
|
continue
|
|
try:
|
|
reader.move(r.BaseAddress)
|
|
buf = reader.read(r.RegionSize)
|
|
except Exception:
|
|
continue
|
|
if not buf: continue
|
|
end = (len(buf) // 4) * 4
|
|
hits_here = 0
|
|
for off in range(0, end, 4):
|
|
if struct.unpack_from("<I", buf, off)[0] == target:
|
|
hits_here += 1
|
|
total_hits += 1
|
|
if len(hit_addrs) < 30:
|
|
hit_addrs.append((r.BaseAddress + off, buf[off:off+0x40] if off+0x40 <= len(buf) else b''))
|
|
if hits_here:
|
|
region_sizes[(r.RegionSize, hits_here)] += 1
|
|
|
|
print(f"Total hits: {total_hits}")
|
|
print(f"\nRegions containing this vtable (region_size, hits_per_region, count):")
|
|
for (rs, hph), c in sorted(region_sizes.items(), key=lambda x: -x[1])[:30]:
|
|
density = hph / (rs / 0x100) # hits per 256 bytes
|
|
print(f" region_size={rs:>8} hits_per_region={hph:>5} count={c:>5} density={density:.3f}/256B")
|
|
|
|
print(f"\nFirst 10 hit addresses + 0x40 bytes after the vtable:")
|
|
for addr, data in hit_addrs[:10]:
|
|
print(f" 0x{addr:08x}: ", end="")
|
|
for i in range(0, min(0x40, len(data)), 4):
|
|
print(f"{struct.unpack_from('<I', data, i)[0]:08x} ", end="")
|
|
print()
|