57b5e43d0e
Five bugs identified and patched in retail Asheron's Call client: - v3b: palette refcount over-increment (3-byte NOP at two sites) - v5: RenderSurface PurgeResource no-op stub (vtable slot 2 thunk) - v11: two dangling-pointer crash guards (NULL-check + reorder) - v14: CEnvCell::Destroy ClipPlaneList leak (18-byte JMP to cleanup thunk) - v22: unpacker stale-pointer SEH guard (whole-function __try/__except) All five ship in leakfix.dll (117 KB, SHA d282f23c…) which is loaded by acclient.exe at process start via PE import table patching by tools/install_leakfix.py. Controlled 15-client fleet soak: unpatched control died at 26h with palette exhaustion; all 14 patched clients survived past that point and reached ≥5-day uptime. Residual ~15 MB/h growth traced to d3d9.dll's internal slab allocator (260KB surface backing buffers retained after Release). See REPORT.md §10 for the full investigation; conclusion is that it's unfixable from outside d3d9. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
96 lines
4.2 KiB
Python
96 lines
4.2 KiB
Python
"""trace_mesh_holder.py <pid>
|
|
|
|
Find ONE D3DXMesh instance, locate all pointers to it, and dump the
|
|
surrounding bytes for each pointer location so we can identify the
|
|
container by direct inspection (not heuristic vtable-walking).
|
|
"""
|
|
import ctypes, ctypes.wintypes as wt, struct, sys
|
|
from collections import Counter
|
|
|
|
VTABLE = 0x007ed3b0
|
|
PROCESS_VM_READ=0x10; PROCESS_QUERY_INFORMATION=0x400
|
|
MEM_COMMIT=0x1000; MEM_PRIVATE=0x20000; MEM_IMAGE=0x1000000
|
|
|
|
class MBI(ctypes.Structure):
|
|
_fields_ = [('BaseAddress',ctypes.c_void_p),('AllocationBase',ctypes.c_void_p),
|
|
('AllocationProtect',wt.DWORD),('PartitionId',wt.WORD),('RegionSize',ctypes.c_size_t),
|
|
('State',wt.DWORD),('Protect',wt.DWORD),('Type',wt.DWORD)]
|
|
k = ctypes.windll.kernel32
|
|
k.OpenProcess.argtypes=[wt.DWORD,wt.BOOL,wt.DWORD]; k.OpenProcess.restype=wt.HANDLE
|
|
k.ReadProcessMemory.argtypes=[wt.HANDLE,wt.LPCVOID,wt.LPVOID,ctypes.c_size_t,ctypes.POINTER(ctypes.c_size_t)]
|
|
k.ReadProcessMemory.restype=wt.BOOL
|
|
k.VirtualQueryEx.argtypes=[wt.HANDLE,ctypes.c_void_p,ctypes.POINTER(MBI),ctypes.c_size_t]
|
|
k.VirtualQueryEx.restype=ctypes.c_size_t
|
|
|
|
pid = int(sys.argv[1])
|
|
h = k.OpenProcess(PROCESS_VM_READ|PROCESS_QUERY_INFORMATION, False, pid)
|
|
if not h: sys.exit('open fail')
|
|
|
|
# Enum all regions
|
|
rw_regions = []
|
|
image_ranges = []
|
|
mbi=MBI(); addr=0
|
|
while k.VirtualQueryEx(h, addr, ctypes.byref(mbi), ctypes.sizeof(mbi)):
|
|
if mbi.State==MEM_COMMIT and (mbi.Protect&0xff) != 0x01:
|
|
if mbi.Type==MEM_IMAGE:
|
|
image_ranges.append((mbi.BaseAddress, mbi.BaseAddress+mbi.RegionSize))
|
|
elif mbi.Type==MEM_PRIVATE and (mbi.Protect&0xff) in (0x04, 0x40):
|
|
buf=(ctypes.c_ubyte*mbi.RegionSize)(); sz=ctypes.c_size_t(0)
|
|
if k.ReadProcessMemory(h, mbi.BaseAddress, buf, mbi.RegionSize, ctypes.byref(sz)):
|
|
rw_regions.append((mbi.BaseAddress, bytes(buf[:sz.value])))
|
|
addr=(mbi.BaseAddress or 0)+mbi.RegionSize
|
|
if addr>=0x80000000: break
|
|
|
|
def is_image(p):
|
|
for lo, hi in image_ranges:
|
|
if lo <= p < hi: return True
|
|
return False
|
|
|
|
# Find first D3DXMesh instance
|
|
mesh_addrs = []
|
|
for base, data in rw_regions:
|
|
end = (len(data)//4)*4
|
|
for off in range(0, end-4, 4):
|
|
if struct.unpack_from('<I', data, off)[0] == VTABLE:
|
|
mesh_addrs.append(base + off)
|
|
print(f'total D3DXMesh instances: {len(mesh_addrs)}')
|
|
|
|
# Pick an "orphan" mesh that isn't held by any CGfxObj.
|
|
# CGfxObj vtable 0x007ca418 has constructed_mesh at +0x6c. The pointer at +0x6c is a MeshBuffer*.
|
|
# So a mesh held by CGfxObj is reached as: cgfxobj+0x6c -> meshbuffer+0x00 -> mesh
|
|
# Direct pointers to meshes (NOT through MeshBuffer) are the orphans.
|
|
|
|
# First: find MeshBuffer addresses (every CGfxObj's +0x6c points to one)
|
|
# We'll just find ALL pointers to mesh addresses and let user inspect.
|
|
|
|
# Take first 10 mesh addresses and find all pointers to each
|
|
mesh_addr_set = set(mesh_addrs)
|
|
print(f'Analysing first 20 mesh instances and their referrers:')
|
|
for mesh_addr in mesh_addrs[:20]:
|
|
refs = []
|
|
for base, data in rw_regions:
|
|
end = (len(data)//4)*4
|
|
for off in range(0, end-4, 4):
|
|
if struct.unpack_from('<I', data, off)[0] == mesh_addr:
|
|
ref_va = base + off
|
|
if ref_va in mesh_addr_set: continue # skip self
|
|
refs.append((ref_va, base, data, off))
|
|
print(f' mesh @ 0x{mesh_addr:08x}: {len(refs)} pointers to it')
|
|
for ref_va, rb, rd, ro in refs[:2]:
|
|
# Dump 0x40 bytes BEFORE and 0x10 after the reference
|
|
ctx_start = max(0, ro - 0x40)
|
|
ctx_end = min(len(rd), ro + 0x10)
|
|
ctx_bytes = rd[ctx_start:ctx_end]
|
|
hex_str = ' '.join(f'{b:02x}' for b in ctx_bytes)
|
|
# Locate any vtable-looking DWORD in the preceding 0x40 bytes
|
|
nearest_vt = None
|
|
nearest_vt_offset = None
|
|
for back in range(ro - 4, max(0, ro - 0x100) - 4, -4):
|
|
if back < 0: break
|
|
v = struct.unpack_from('<I', rd, back)[0]
|
|
if is_image(v) and v >= 0x00400000 and v < 0x01000000:
|
|
nearest_vt = v
|
|
nearest_vt_offset = ro - back
|
|
break
|
|
vt_str = f' nearest vtable 0x{nearest_vt:08x} at -0x{nearest_vt_offset:x}' if nearest_vt else ' no vtable in 0x100 lookback'
|
|
print(f' ref@0x{ref_va:08x}:{vt_str}')
|