57b5e43d0e
Five bugs identified and patched in retail Asheron's Call client: - v3b: palette refcount over-increment (3-byte NOP at two sites) - v5: RenderSurface PurgeResource no-op stub (vtable slot 2 thunk) - v11: two dangling-pointer crash guards (NULL-check + reorder) - v14: CEnvCell::Destroy ClipPlaneList leak (18-byte JMP to cleanup thunk) - v22: unpacker stale-pointer SEH guard (whole-function __try/__except) All five ship in leakfix.dll (117 KB, SHA d282f23c…) which is loaded by acclient.exe at process start via PE import table patching by tools/install_leakfix.py. Controlled 15-client fleet soak: unpatched control died at 26h with palette exhaustion; all 14 patched clients survived past that point and reached ≥5-day uptime. Residual ~15 MB/h growth traced to d3d9.dll's internal slab allocator (260KB surface backing buffers retained after Release). See REPORT.md §10 for the full investigation; conclusion is that it's unfixable from outside d3d9. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
113 lines
4.8 KiB
Python
113 lines
4.8 KiB
Python
"""probe_imgtex.py <pid>
|
|
Walk s_Resources, find ImgTex entries (vfptr=0x007cab04 — GR-view).
|
|
Split live vs lost, sample which fields are still non-NULL when "lost".
|
|
|
|
ImgTex members (primary-relative):
|
|
+0x58 m_SourceLevels.m_data (SmartArray<DataID>) => entry+0x28 (heap buffer)
|
|
+0x5c m_SourceLevels.m_sizeAndDeallocate => entry+0x2c
|
|
+0x60 m_SourceLevels.m_num => entry+0x30
|
|
+0x64 m_pImageData (RenderSurface*) => entry+0x34 (PurgeResource releases)
|
|
+0x68 m_pPalette (Palette*) => entry+0x38 (PurgeResource MISSES)
|
|
+0x6c m_cPitch
|
|
+0x70 m_TextureCode (8 bytes)
|
|
+0x78 m_pD3DTexture => entry+0x48 (PurgeResource releases)
|
|
+0x7c m_pRenderTexture => entry+0x4c (PurgeResource releases)
|
|
+0x80 m_pSystemMemTexture => entry+0x50 (PurgeResource MISSES)
|
|
"""
|
|
import ctypes, ctypes.wintypes as wt, sys, struct
|
|
|
|
PROCESS_VM_READ = 0x10
|
|
PROCESS_QUERY_INFORMATION = 0x400
|
|
k = ctypes.windll.kernel32
|
|
k.OpenProcess.argtypes = [wt.DWORD, wt.BOOL, wt.DWORD]; k.OpenProcess.restype = wt.HANDLE
|
|
k.ReadProcessMemory.argtypes = [wt.HANDLE, wt.LPCVOID, wt.LPVOID, ctypes.c_size_t, ctypes.POINTER(ctypes.c_size_t)]
|
|
k.ReadProcessMemory.restype = wt.BOOL
|
|
|
|
S_RESOURCES_M_DATA = 0x008398C4
|
|
S_RESOURCES_M_NUM = 0x008398CC
|
|
IMGTEX_GR_VTABLE = 0x007cab04
|
|
|
|
def rd_u32(h, va):
|
|
buf = (ctypes.c_ubyte * 4)(); sz = ctypes.c_size_t(0)
|
|
if not k.ReadProcessMemory(h, va, buf, 4, ctypes.byref(sz)) or sz.value != 4: return None
|
|
return struct.unpack('<I', bytes(buf))[0]
|
|
|
|
pid = int(sys.argv[1])
|
|
h = k.OpenProcess(PROCESS_VM_READ | PROCESS_QUERY_INFORMATION, False, pid)
|
|
if not h: print(f"OpenProcess err={ctypes.get_last_error()}"); sys.exit(2)
|
|
|
|
m_data = rd_u32(h, S_RESOURCES_M_DATA)
|
|
m_num = rd_u32(h, S_RESOURCES_M_NUM)
|
|
print(f"pid {pid}: s_Resources m_data=0x{m_data:08x} m_num={m_num}")
|
|
|
|
total = 0; lost = 0; live = 0
|
|
# Per-field non-NULL counters (lost only — what's leaked)
|
|
L_sl_data = L_imgdata = L_pal = L_d3dtex = L_rt = L_sysmem = 0
|
|
V_sl_data = V_imgdata = V_pal = V_d3dtex = V_rt = V_sysmem = 0
|
|
samples_lost = []
|
|
samples_live = []
|
|
|
|
for i in range(min(m_num, 200000)):
|
|
entry = rd_u32(h, m_data + i * 4)
|
|
if not entry: continue
|
|
vt = rd_u32(h, entry)
|
|
if vt != IMGTEX_GR_VTABLE: continue
|
|
total += 1
|
|
bIsLost_word = rd_u32(h, entry + 8)
|
|
is_lost = (bIsLost_word & 0xFF) != 0
|
|
sl_data = rd_u32(h, entry + 0x28)
|
|
sl_size = rd_u32(h, entry + 0x2c)
|
|
imgdata = rd_u32(h, entry + 0x34)
|
|
pal = rd_u32(h, entry + 0x38)
|
|
d3dtex = rd_u32(h, entry + 0x48)
|
|
rt = rd_u32(h, entry + 0x4c)
|
|
sysmem = rd_u32(h, entry + 0x50)
|
|
if any(x is None for x in (sl_data, imgdata, pal, d3dtex, rt, sysmem)): continue
|
|
if is_lost:
|
|
lost += 1
|
|
if sl_data != 0: L_sl_data += 1
|
|
if imgdata != 0: L_imgdata += 1
|
|
if pal != 0: L_pal += 1
|
|
if d3dtex != 0: L_d3dtex += 1
|
|
if rt != 0: L_rt += 1
|
|
if sysmem != 0: L_sysmem += 1
|
|
if (sl_data | imgdata | pal | d3dtex | rt | sysmem) and len(samples_lost) < 5:
|
|
samples_lost.append((entry, sl_data, sl_size, imgdata, pal, d3dtex, rt, sysmem))
|
|
else:
|
|
live += 1
|
|
if sl_data != 0: V_sl_data += 1
|
|
if imgdata != 0: V_imgdata += 1
|
|
if pal != 0: V_pal += 1
|
|
if d3dtex != 0: V_d3dtex += 1
|
|
if rt != 0: V_rt += 1
|
|
if sysmem != 0: V_sysmem += 1
|
|
if len(samples_live) < 3:
|
|
samples_live.append((entry, sl_data, sl_size, imgdata, pal, d3dtex, rt, sysmem))
|
|
|
|
print(f"ImgTex entries: total={total} live={live} lost={lost}")
|
|
def report(prefix, n, vals):
|
|
print(f" {prefix}:")
|
|
for label, c in vals:
|
|
print(f" {label:24s} non-NULL {c}/{n} ({100*c//max(n,1)}%)")
|
|
report("LOST (potential leaks)", lost, [
|
|
("m_SourceLevels.m_data", L_sl_data),
|
|
("m_pImageData (released)", L_imgdata),
|
|
("m_pPalette (MISSED?)", L_pal),
|
|
("m_pD3DTexture (rel'd)", L_d3dtex),
|
|
("m_pRenderTexture (rel'd)",L_rt),
|
|
("m_pSysMemTexture (MISS?)",L_sysmem),
|
|
])
|
|
report("LIVE", live, [
|
|
("m_SourceLevels.m_data", V_sl_data),
|
|
("m_pImageData", V_imgdata),
|
|
("m_pPalette", V_pal),
|
|
("m_pD3DTexture", V_d3dtex),
|
|
("m_pRenderTexture", V_rt),
|
|
("m_pSysMemTexture", V_sysmem),
|
|
])
|
|
print(f" LOST samples (entry, sl_data, sl_size, imgdata, pal, d3dtex, rt, sysmem):")
|
|
for s in samples_lost:
|
|
print(f" 0x{s[0]:08x} sl=0x{s[1]:08x}|{s[2]:x} img=0x{s[3]:08x} pal=0x{s[4]:08x} d3d=0x{s[5]:08x} rt=0x{s[6]:08x} sm=0x{s[7]:08x}")
|
|
print(f" LIVE samples:")
|
|
for s in samples_live:
|
|
print(f" 0x{s[0]:08x} sl=0x{s[1]:08x}|{s[2]:x} img=0x{s[3]:08x} pal=0x{s[4]:08x} d3d=0x{s[5]:08x} rt=0x{s[6]:08x} sm=0x{s[7]:08x}")
|