#!/usr/bin/env python3
"""hunt2.py — enumerate ALL soothe2 module instances during offline render.

Chunk-correct full-heap scan (rendersnap-style) collecting EVERY ctx candidate
(vtable 0x1824AC210 or m48 marker), not just the first. Per candidate: sens,
fir43/fir171 (via ctx+0x540668 ptr), scalar bank snapshot. Goal: find the
GUI/DSP pair (24c/24j): visible instance holds shallow kernel while audio is
processed by another instance with the deep one.
"""
import hashlib
import os
import signal
import struct
import subprocess
import sys
import time

import numpy as np

VT = struct.pack('<Q', 0x1824AC210)
M48 = struct.pack('<I', 0x473b8000)


def find_host():
    import glob
    for p in glob.glob('/proc/[0-9]*'):
        pid = int(os.path.basename(p))
        try:
            cmd = open(f'/proc/{pid}/cmdline', 'rb').read().replace(b'\0', b' ').decode('utf8', 'replace')
            maps = open(f'/proc/{pid}/maps').read()
        except Exception:
            continue
        if 'soothe2' in maps and 'reaper' not in cmd:
            return pid
    return None


def main():
    rpp = sys.argv[1] if len(sys.argv) > 1 else '/tmp/opencode/multi.rpp'
    subprocess.run("pkill -9 -x reaper; pkill -9 -f '[y]abridge'; "
                   "rm -rf /run/user/1000/yabridge-soothe2_x64-*; sleep 1", shell=True)
    proc = subprocess.Popen(['/usr/bin/reaper', '-nosplash', '-ignoreerrors',
                             '-renderproject', rpp],
                            stdout=open('/dev/null', 'w'), stderr=subprocess.STDOUT)
    t0 = time.time()
    host = None
    while time.time() - t0 < 30 and not host:
        host = find_host()
        time.sleep(0.001)
    if not host:
        print('NO HOST')
        return 1
    fd = os.open(f'/proc/{host}/mem', os.O_RDONLY)

    def rd(a, n):
        try:
            return os.pread(fd, n, a)
        except OSError:
            return None

    def scan_all():
        found = {}
        for line in open(f'/proc/{host}/maps'):
            parts = line.split()
            if 'rw' not in parts[1]:
                continue
            lo, hi = (int(x, 16) for x in parts[0].split('-'))
            CH = 16 * 1024 * 1024
            a = lo
            while a < hi:
                d = rd(a, min(CH + 4096, hi - a))
                if not d:
                    break
                for pat, off in ((VT, 0), (M48, -0x24)):
                    j = d.find(pat)
                    while j >= 0:
                        cand = a + j + off
                        if cand not in found:
                            sb = rd(cand + 0x540870, 4)
                            if sb and struct.unpack('<f', sb)[0] > 100:
                                found[cand] = True
                        j = d.find(pat, j + 1)
                a += CH
        return list(found)

    known = {}
    rounds = 0
    while time.time() - t0 < 25:
        rounds += 1
        try:
            os.kill(host, signal.SIGSTOP)
        except ProcessLookupError:
            break
        try:
            cands = scan_all()
            new = [c for c in cands if c not in known]
            for c in new:
                known[c] = rounds
                pb = rd(c + 0x540668, 8)
                m43 = m171 = -1
                if pb:
                    p = struct.unpack('<Q', pb)[0]
                    if p > 0x10000:
                        fb = rd(p, 2049 * 8)
                        if fb:
                            arr = np.frombuffer(fb[:2049 * 8], dtype='<f4')
                            mag = np.hypot(arr[0::2], arr[1::2])
                            m43, m171 = float(mag[43]), float(mag[171])
                sb = rd(c + 0x540888, 4)
                s888 = struct.unpack('<f', sb)[0] if sb else -1
                print('NEW ctx %#x @r%d t=%.2f fir43=%.4f fir171=%.4f s888=%.4f'
                      % (c, rounds, time.time() - t0, m43, m171, s888), flush=True)
            # status of known ones every round
            for c in known:
                pb = rd(c + 0x540668, 8)
                if pb:
                    p = struct.unpack('<Q', pb)[0]
                    if p > 0x10000:
                        fb = rd(p, 2049 * 8)
                        if fb:
                            arr = np.frombuffer(fb[:2049 * 8], dtype='<f4')
                            mag = np.hypot(arr[0::2], arr[1::2])
                            print('  st ctx %#x t=%.2f fir43=%.4f' % (c, time.time() - t0, mag[43]), flush=True)
        finally:
            try:
                os.kill(host, signal.SIGCONT)
            except ProcessLookupError:
                pass
        time.sleep(0.05)
    print('total instances: %d' % len(known))
    proc.kill()
    return 0


if __name__ == '__main__':
    sys.exit(main())