#!/usr/bin/env python3
import subprocess, os, glob, sys, time, struct

RPP = sys.argv[1] if len(sys.argv) > 1 else "/home/m/soothe-bt/render_long.rpp"

VCAND = list(range(0x1824abb60, 0x1824abc20, 8))  # wide vtable range
CTOR = 0x180529610

proc = subprocess.Popen(
    ['reaper', '-nosplash', '-renderproject', RPP],
    stdout=open('/tmp/rtov.log', 'w'), stderr=subprocess.STDOUT)
print('reaper', proc.pid, flush=True)


def find_hosts():
    out = []
    for p in glob.glob('/proc/[0-9]*'):
        try:
            pid = int(os.path.basename(p))
            maps = open(f'/proc/{pid}/maps').read()
            if 'soothe2' in maps and 'yabridge-host' in open(f'/proc/{pid}/cmdline','rb').read().decode('utf8','replace'):
                out.append(pid)
        except Exception:
            pass
    return out


def scan(pid):
    mem = os.open(f'/proc/{pid}/mem', os.O_RDONLY)
    found = []
    pats = {v: struct.pack('<Q', v) for v in VCAND}
    ctor = struct.pack('<Q', CTOR)
    maps = open(f'/proc/{pid}/maps').read()
    for line in maps.splitlines():
        parts = line.split()
        lo, hi = (int(x, 16) for x in parts[0].split('-'))
        if 'r' not in parts[1]:
            continue
        try:
            d = os.pread(mem, hi - lo, lo)
        except Exception:
            continue
        for v, p in pats.items():
            i = 0
            while True:
                i = d.find(p, i)
                if i < 0:
                    break
                found.append((v, lo + i))
                i += 1
    os.close(mem)
    return found

hosts = None
found = []
t0 = time.time()
while time.time() - t0 < 60:
    hosts = find_hosts()
    if hosts:
        for h in hosts:
            f = scan(h)
            if f:
                found += [(h, a, b) for a, b in f]
                if len(found) > 0:
                    print('HITS', host if 'host' in dir() else h, len(found), flush=True)
                    with open('/tmp/inst2.txt', 'w') as fo:
                        for hh, va, a in found:
                            fo.write(f'{hh} {va:#x} {a:#x}\n')
                    if not hosts:
                        proc.kill()
                    sys.exit(0)
    time.sleep(0.3)
print('none', flush=True)
proc.kill()