57b5e43d0e
Five bugs identified and patched in retail Asheron's Call client: - v3b: palette refcount over-increment (3-byte NOP at two sites) - v5: RenderSurface PurgeResource no-op stub (vtable slot 2 thunk) - v11: two dangling-pointer crash guards (NULL-check + reorder) - v14: CEnvCell::Destroy ClipPlaneList leak (18-byte JMP to cleanup thunk) - v22: unpacker stale-pointer SEH guard (whole-function __try/__except) All five ship in leakfix.dll (117 KB, SHA d282f23c…) which is loaded by acclient.exe at process start via PE import table patching by tools/install_leakfix.py. Controlled 15-client fleet soak: unpatched control died at 26h with palette exhaustion; all 14 patched clients survived past that point and reached ≥5-day uptime. Residual ~15 MB/h growth traced to d3d9.dll's internal slab allocator (260KB surface backing buffers retained after Release). See REPORT.md §10 for the full investigation; conclusion is that it's unfixable from outside d3d9. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
41 lines
1.5 KiB
Python
41 lines
1.5 KiB
Python
"""
|
|
read_function_bytes.py <pid> <addr_hex> [bytes]
|
|
Reads N bytes from a remote process at a given address. Used to inspect what
|
|
function actually lives at a vtable slot's target.
|
|
"""
|
|
import ctypes, ctypes.wintypes as wt, sys
|
|
|
|
PROCESS_VM_READ = 0x0010
|
|
PROCESS_QUERY_INFORMATION = 0x0400
|
|
|
|
k32 = ctypes.windll.kernel32
|
|
OpenProcess = k32.OpenProcess
|
|
OpenProcess.argtypes = [wt.DWORD, wt.BOOL, wt.DWORD]; OpenProcess.restype = wt.HANDLE
|
|
CloseHandle = k32.CloseHandle
|
|
CloseHandle.argtypes = [wt.HANDLE]; CloseHandle.restype = wt.BOOL
|
|
ReadProcessMemory = k32.ReadProcessMemory
|
|
ReadProcessMemory.argtypes = [wt.HANDLE, wt.LPCVOID, wt.LPVOID, ctypes.c_size_t,
|
|
ctypes.POINTER(ctypes.c_size_t)]
|
|
ReadProcessMemory.restype = wt.BOOL
|
|
|
|
pid = int(sys.argv[1])
|
|
addr = int(sys.argv[2], 0)
|
|
n = int(sys.argv[3]) if len(sys.argv) > 3 else 64
|
|
|
|
h = OpenProcess(PROCESS_VM_READ | PROCESS_QUERY_INFORMATION, False, pid)
|
|
if not h:
|
|
print(f"OpenProcess failed: err={ctypes.get_last_error()}"); sys.exit(2)
|
|
|
|
buf = (ctypes.c_ubyte * n)()
|
|
sz = ctypes.c_size_t(0)
|
|
if not ReadProcessMemory(h, addr, buf, n, ctypes.byref(sz)):
|
|
print(f"ReadProcessMemory failed: err={ctypes.get_last_error()}"); CloseHandle(h); sys.exit(3)
|
|
|
|
print(f"PID {pid} addr 0x{addr:08x} bytes read: {sz.value}")
|
|
data = bytes(buf[:sz.value])
|
|
for i in range(0, len(data), 16):
|
|
chunk = data[i:i+16]
|
|
hexs = " ".join(f"{b:02x}" for b in chunk)
|
|
asci = "".join(chr(b) if 32 <= b < 127 else "." for b in chunk)
|
|
print(f" 0x{addr+i:08x} {hexs:<47} {asci}")
|
|
CloseHandle(h)
|