57b5e43d0e
Five bugs identified and patched in retail Asheron's Call client: - v3b: palette refcount over-increment (3-byte NOP at two sites) - v5: RenderSurface PurgeResource no-op stub (vtable slot 2 thunk) - v11: two dangling-pointer crash guards (NULL-check + reorder) - v14: CEnvCell::Destroy ClipPlaneList leak (18-byte JMP to cleanup thunk) - v22: unpacker stale-pointer SEH guard (whole-function __try/__except) All five ship in leakfix.dll (117 KB, SHA d282f23c…) which is loaded by acclient.exe at process start via PE import table patching by tools/install_leakfix.py. Controlled 15-client fleet soak: unpatched control died at 26h with palette exhaustion; all 14 patched clients survived past that point and reached ≥5-day uptime. Residual ~15 MB/h growth traced to d3d9.dll's internal slab allocator (260KB surface backing buffers retained after Release). See REPORT.md §10 for the full investigation; conclusion is that it's unfixable from outside d3d9. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
119 lines
3.8 KiB
Python
119 lines
3.8 KiB
Python
"""physobj_owner_tight.py <dump.dmp> <owner_vtable> [object_size]
|
|
|
|
Same as physobj_owner_inspect but with tight per-instance window: stops at
|
|
the next image-pointer (vtable boundary).
|
|
"""
|
|
import struct, sys
|
|
from collections import Counter
|
|
from minidump.minidumpfile import MinidumpFile
|
|
|
|
CPHYSOBJ_VT = 0x007c78e0
|
|
|
|
|
|
def _ei(v):
|
|
if v is None: return 0
|
|
if hasattr(v, 'value'): return int(v.value)
|
|
return int(v)
|
|
|
|
|
|
def main():
|
|
dump_path = sys.argv[1]
|
|
target_vt = int(sys.argv[2], 0)
|
|
obj_size = int(sys.argv[3], 0) if len(sys.argv) > 3 else None
|
|
md = MinidumpFile.parse(dump_path)
|
|
reader = md.get_reader().get_buffered_reader()
|
|
|
|
image_ranges = []
|
|
for r in md.memory_info.infos:
|
|
st, ty = _ei(r.State), _ei(r.Type)
|
|
if st == 0x1000 and ty == 0x1000000:
|
|
image_ranges.append((r.BaseAddress, r.BaseAddress + r.RegionSize))
|
|
image_ranges.sort()
|
|
|
|
def is_image(addr):
|
|
for lo, hi in image_ranges:
|
|
if lo <= addr < hi:
|
|
return True
|
|
if addr < lo:
|
|
return False
|
|
return False
|
|
|
|
scan_regions = []
|
|
for r in md.memory_info.infos:
|
|
st, ty, pr = _ei(r.State), _ei(r.Type), _ei(r.Protect) & 0xff
|
|
if st != 0x1000: continue
|
|
if ty == 0x1000000: continue
|
|
if pr not in (0x04, 0x40): continue
|
|
scan_regions.append((r.BaseAddress, r.RegionSize))
|
|
|
|
region_bufs = []
|
|
physobj_addrs = set()
|
|
owner_locations = [] # (va, base, off, buf)
|
|
for base, size in scan_regions:
|
|
try:
|
|
reader.move(base)
|
|
buf = reader.read(size)
|
|
except Exception:
|
|
continue
|
|
if not buf: continue
|
|
region_bufs.append((base, buf))
|
|
end = (len(buf) // 4) * 4
|
|
for off in range(0, end, 4):
|
|
v = struct.unpack_from("<I", buf, off)[0]
|
|
if v == CPHYSOBJ_VT:
|
|
physobj_addrs.add(base + off)
|
|
elif v == target_vt:
|
|
owner_locations.append((base + off, base, off, buf))
|
|
|
|
print(f"physobj instances: {len(physobj_addrs)}")
|
|
print(f"owner instances (vt 0x{target_vt:08x}): {len(owner_locations)}")
|
|
|
|
if not owner_locations:
|
|
return
|
|
|
|
MAX_WINDOW = obj_size if obj_size else 0x400
|
|
pfields = Counter()
|
|
nonzero_per_owner = []
|
|
|
|
for ova, base, off, buf in owner_locations:
|
|
# Determine tight window: stop at next image pointer or fixed obj_size
|
|
if obj_size:
|
|
stop = off + obj_size
|
|
else:
|
|
stop = off + 4
|
|
limit = min(len(buf), off + MAX_WINDOW)
|
|
while stop < limit:
|
|
v = struct.unpack_from("<I", buf, stop)[0]
|
|
if is_image(v):
|
|
break
|
|
stop += 4
|
|
nphys = 0
|
|
for fo in range(0, stop - off, 4):
|
|
v = struct.unpack_from("<I", buf, off + fo)[0]
|
|
if v in physobj_addrs:
|
|
pfields[fo] += 1
|
|
nphys += 1
|
|
nonzero_per_owner.append((ova, nphys, stop - off))
|
|
|
|
sizes = Counter(s for _, _, s in nonzero_per_owner)
|
|
print(f"\ninstance-size distribution (top 10 by count):")
|
|
for sz, cnt in sizes.most_common(10):
|
|
print(f" size~0x{sz:03x} count={cnt}")
|
|
|
|
print(f"\nphysobj-ptr field offsets within owner (top 20):")
|
|
for fo, cnt in pfields.most_common(20):
|
|
print(f" +0x{fo:03x} count={cnt}")
|
|
|
|
nz = [n for _, n, _ in nonzero_per_owner if n > 0]
|
|
if nz:
|
|
print(f"\nowners with >=1 physobj: {len(nz)} / {len(owner_locations)}")
|
|
print(f"avg physobj/owner: {sum(nz)/len(nz):.2f}")
|
|
print(f"total physobj-edges: {sum(nz)}")
|
|
cnts = Counter(n for _, n, _ in nonzero_per_owner)
|
|
print(f"\nphysobjs-per-owner distribution:")
|
|
for n, cnt in sorted(cnts.most_common(15)):
|
|
print(f" {n} physobjs: {cnt} owners")
|
|
|
|
|
|
if __name__ == "__main__":
|
|
main()
|