import ctypes
import struct

PROCESS_ALL_ACCESS = 0x1F0FFF
kernel32 = ctypes.windll.kernel32
h_proc = kernel32.OpenProcess(PROCESS_ALL_ACCESS, False, 43084)

def rpm(addr, size):
    buf = ctypes.create_string_buffer(size)
    bytes_read = ctypes.c_size_t(0)
    if kernel32.ReadProcessMemory(h_proc, ctypes.c_void_p(addr), buf, size, ctypes.byref(bytes_read)):
        return buf.raw
    return None

def rpm_u64(addr):
    d = rpm(addr, 8)
    return struct.unpack("<Q", d)[0] if d else 0

def rpm_u32(addr):
    d = rpm(addr, 4)
    return struct.unpack("<I", d)[0] if d else 0

mod_base = 0x7FF6AFC20000
igs = rpm_u64(mod_base + 0x4430108)
area = rpm_u64(igs + 0x290)
print(f"AreaInstance: {hex(area)}")

# Scan all fields from 0x0 to 0x1200
for off in range(0x0, 0x1200, 8):
    p1 = rpm_u64(area + off)
    p2 = rpm_u64(area + off + 8)
    p3 = rpm_u64(area + off + 16)
    
    # Check if this looks like std::vector (start, end, capacity)
    if 0x20000000000 <= p1 <= 0x30000000000 and p1 <= p2 <= p3:
        sz = p2 - p1
        if 500 < sz < 50000000:
            b16 = rpm(p1, 16)
            hex_str = b16.hex() if b16 else ""
            print(f"Vector at +{hex(off)}: size={sz:,} bytes (0x{sz:x}), start={hex(p1)}, first16={hex_str}")

kernel32.CloseHandle(h_proc)