leakhunt/tools/physobj_owner_diff.py

"""physobj_owner_diff.py <low_dmp> <high_dmp>

Run owner-vtable scan on both dumps and report HIGH - LOW (instances delta).
Only counts real vtable hits (slot 0 must be a function in .text).
"""
import struct, sys
from collections import Counter
from minidump.minidumpfile import MinidumpFile

CPHYSOBJ_VT = 0x007c78e0


def _ei(v):
    if v is None: return 0
    if hasattr(v, 'value'): return int(v.value)
    return int(v)


def scan(dump_path):
    md = MinidumpFile.parse(dump_path)
    reader = md.get_reader().get_buffered_reader()

    text_ranges = []
    image_ranges = []
    for r in md.memory_info.infos:
        st, ty, pr = _ei(r.State), _ei(r.Type), _ei(r.Protect) & 0xff
        if st != 0x1000: continue
        if ty == 0x1000000:
            image_ranges.append((r.BaseAddress, r.BaseAddress + r.RegionSize))
            if pr in (0x20, 0x10, 0x40, 0x02):  # execute
                text_ranges.append((r.BaseAddress, r.BaseAddress + r.RegionSize))
    image_ranges.sort()
    text_ranges.sort()

    def in_text(addr):
        for lo, hi in text_ranges:
            if lo <= addr < hi:
                return True
        return False

    def in_image(addr):
        for lo, hi in image_ranges:
            if lo <= addr < hi:
                return True
        return False

    scan_regions = []
    for r in md.memory_info.infos:
        st, ty, pr = _ei(r.State), _ei(r.Type), _ei(r.Protect) & 0xff
        if st != 0x1000: continue
        if ty == 0x1000000: continue
        if pr not in (0x04, 0x40): continue
        scan_regions.append((r.BaseAddress, r.RegionSize))

    # Helper to read DWORD from anywhere
    def read_dword(va):
        try:
            reader.move(va)
            data = reader.read(4)
            if len(data) == 4:
                return struct.unpack('<I', data)[0]
        except Exception:
            return None

    region_bufs = []
    physobj_addrs = set()
    for base, size in scan_regions:
        try:
            reader.move(base)
            buf = reader.read(size)
        except Exception:
            continue
        if not buf: continue
        region_bufs.append((base, buf))
        end = (len(buf) // 4) * 4
        for off in range(0, end, 4):
            v = struct.unpack_from("<I", buf, off)[0]
            if v == CPHYSOBJ_VT:
                physobj_addrs.add(base + off)

    LOOKBACK = 0x200
    vtable_unique_owners = Counter()  # vtable -> distinct owner-instance addresses
    seen_owners = set()  # to dedupe per (vtable, owner_base)

    for base, buf in region_bufs:
        end = (len(buf) // 4) * 4
        for off in range(0, end, 4):
            v = struct.unpack_from("<I", buf, off)[0]
            if v not in physobj_addrs:
                continue
            hit_va = base + off
            if hit_va == v:
                continue
            start = max(0, off - LOOKBACK)
            for back in range(off - 4, start - 4, -4):
                if back < 0: break
                vv = struct.unpack_from("<I", buf, back)[0]
                if not in_image(vv):
                    continue
                # validate: slot 0 must point to executable code
                slot0 = read_dword(vv)
                if slot0 is None or not in_text(slot0):
                    continue
                owner_base = base + back
                key = (vv, owner_base)
                if key in seen_owners:
                    break
                seen_owners.add(key)
                vtable_unique_owners[vv] += 1
                break

    return physobj_addrs, vtable_unique_owners


def main():
    low_path, high_path = sys.argv[1], sys.argv[2]
    print("=== LOW dump scan ===")
    low_p, low_v = scan(low_path)
    print(f"low: physobjs={len(low_p)}, unique-owner-instances tracked across {len(low_v)} vtables")
    print("=== HIGH dump scan ===")
    high_p, high_v = scan(high_path)
    print(f"high: physobjs={len(high_p)}, unique-owner-instances tracked across {len(high_v)} vtables")

    all_vt = set(low_v.keys()) | set(high_v.keys())
    deltas = [(vt, high_v[vt] - low_v[vt], low_v[vt], high_v[vt]) for vt in all_vt]
    deltas.sort(key=lambda x: -x[1])

    print(f"\n=== Owners growing the most (high - low) — top 30 ===")
    print(f"{'vtable':>10}  {'delta':>8}  {'low':>6}  {'high':>6}")
    for vt, d, lo, hi in deltas[:30]:
        print(f"  0x{vt:08x}  {d:>8}  {lo:>6}  {hi:>6}")


if __name__ == "__main__":
    main()