import struct

path = r"C:/Users/locpham/AppData/Local/Temp/sf_dumps/bridge_crash_1696.dmp"
data = open(path, "rb").read()

sig, ver, numstreams, sdir = struct.unpack_from("<IIIIIIQ", data, 0)[:4]
streams = {}
for i in range(numstreams):
    stype, datasize, rva = struct.unpack_from("<III", data, sdir + i * 12)
    streams[stype] = (rva, datasize)

mods = []
rva, sz = streams[4]
n = struct.unpack_from("<I", data, rva)[0]
pos = rva + 4
for i in range(n):
    base, imgsz, cksum, ts, name_rva = struct.unpack_from("<QIIII", data, pos)
    nlen = struct.unpack_from("<I", data, name_rva)[0]
    name = data[name_rva + 4:name_rva + 4 + nlen].decode("utf-16-le", "replace").rstrip("\x00")
    mods.append((base, imgsz, name))
    pos += 108

def mod_for(addr):
    for base, szz, name in mods:
        if base <= addr < base + szz:
            return base, name
    return None, None

# dump all memory regions, scan for qwords inside DUNE 3.dll or bridge exe
targets = []
for base, szz, name in mods:
    if "DUNE" in name or "daw_vst_bridge" in name:
        targets.append((base, szz, name))

print("targets:", [(hex(b), s, n.split("\\")[-1]) for b, s, n in targets])

rva, sz = streams[5]
n = struct.unpack_from("<I", data, rva)[0]
pos = rva + 4
hits = {}
for i in range(n):
    start, msz, mrva = struct.unpack_from("<QII", data, pos)
    pos += 16
    chunk = data[mrva:mrva + msz]
    for j in range(0, len(chunk) - 8, 8):
        val = struct.unpack_from("<Q", chunk, j)[0]
        for tb, tsz, tn in targets:
            if tb <= val < tb + tsz:
                hits.setdefault((val, tn, val - tb), []).append((start + j, msz))
                break

print("\nunique qwords pointing into DUNE/bridge (addr, module, offset, count):")
for (val, tn, off), locs in sorted(hits.items()):
    print("  %016x %s+%x  (seen %d times, e.g. mem@%016x size %x)" % (val, tn.split("\\")[-1], off, len(locs), locs[0][0], locs[0][1]))