@jshookmcp/jshook 0.1.2

package/dist/modules/process/memory/injector.js

@@ -0,0 +1,252 @@
+import { logger } from '../../../utils/logger.js';
+import { executePowerShellScript } from '../../process/memory/types.js';
+function buildDllInjectionScript(pid, dllPath) {
+    return `
+Add-Type @"
+using System;
+using System.Runtime.InteropServices;
+using System.ComponentModel;
+using System.IO;
+
+public class DllInjector {
+    [DllImport("kernel32.dll", SetLastError = true)]
+    public static extern IntPtr OpenProcess(int access, bool inherit, int pid);
+
+    [DllImport("kernel32.dll", SetLastError = true)]
+    public static extern IntPtr VirtualAllocEx(IntPtr hProcess, IntPtr addr, int size, int allocType, int protect);
+
+    [DllImport("kernel32.dll", SetLastError = true)]
+    public static extern bool WriteProcessMemory(IntPtr hProcess, IntPtr addr, byte[] buffer, int size, out int written);
+
+    [DllImport("kernel32.dll", SetLastError = true)]
+    public static extern IntPtr CreateRemoteThread(IntPtr hProcess, IntPtr attr, int stackSize, IntPtr startAddr, IntPtr param, int flags, out int threadId);
+
+    [DllImport("kernel32.dll", SetLastError = true)]
+    public static extern IntPtr GetModuleHandle(string name);
+
+    [DllImport("kernel32.dll", SetLastError = true)]
+    public static extern IntPtr GetProcAddress(IntPtr hModule, string name);
+
+    [DllImport("kernel32.dll", SetLastError = true)]
+    public static extern bool CloseHandle(IntPtr handle);
+
+    [DllImport("kernel32.dll", SetLastError = true)]
+    public static extern bool VirtualFreeEx(IntPtr hProcess, IntPtr addr, int size, int freeType);
+
+    const int PROCESS_CREATE_THREAD = 0x0002;
+    const int PROCESS_QUERY_INFORMATION = 0x0400;
+    const int PROCESS_VM_OPERATION = 0x0008;
+    const int PROCESS_VM_WRITE = 0x0020;
+    const int MEM_COMMIT = 0x1000;
+    const int MEM_RESERVE = 0x2000;
+    const int PAGE_READWRITE = 0x04;
+    const int MEM_RELEASE = 0x8000;
+
+    public static object Inject(int pid, string dllPath) {
+        if (!File.Exists(dllPath)) {
+            return new { success = false, error = "DLL not found: " + dllPath };
+        }
+
+        IntPtr hProcess = OpenProcess(PROCESS_CREATE_THREAD | PROCESS_QUERY_INFORMATION | PROCESS_VM_OPERATION | PROCESS_VM_WRITE, false, pid);
+        if (hProcess == IntPtr.Zero) {
+            int error = Marshal.GetLastWin32Error();
+            throw new Win32Exception(error, "Failed to open process. Run as Administrator.");
+        }
+
+        try {
+            byte[] dllBytes = System.Text.Encoding.ASCII.GetBytes(dllPath + "\\0");
+            IntPtr remoteMem = VirtualAllocEx(hProcess, IntPtr.Zero, dllBytes.Length, MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE);
+            if (remoteMem == IntPtr.Zero) {
+                int error = Marshal.GetLastWin32Error();
+                throw new Win32Exception(error, "Failed to allocate memory in target");
+            }
+
+            try {
+                int written;
+                if (!WriteProcessMemory(hProcess, remoteMem, dllBytes, dllBytes.Length, out written)) {
+                    int error = Marshal.GetLastWin32Error();
+                    throw new Win32Exception(error, "Failed to write DLL path to target");
+                }
+
+                IntPtr hKernel32 = GetModuleHandle("kernel32.dll");
+                IntPtr loadLibraryAddr = GetProcAddress(hKernel32, "LoadLibraryA");
+                if (loadLibraryAddr == IntPtr.Zero) {
+                    throw new Exception("Failed to get LoadLibraryA address");
+                }
+
+                int threadId;
+                IntPtr hThread = CreateRemoteThread(hProcess, IntPtr.Zero, 0, loadLibraryAddr, remoteMem, 0, out threadId);
+                if (hThread == IntPtr.Zero) {
+                    int error = Marshal.GetLastWin32Error();
+                    throw new Win32Exception(error, "Failed to create remote thread");
+                }
+
+                CloseHandle(hThread);
+                return new { success = true, remoteThreadId = threadId };
+            } finally {
+                VirtualFreeEx(hProcess, remoteMem, 0, MEM_RELEASE);
+            }
+        } finally {
+            CloseHandle(hProcess);
+        }
+    }
+}
+"@
+
+try {
+    $result = [DllInjector]::Inject(${pid}, "${dllPath.replace(/\\/g, '\\\\').replace(/"/g, '`"').replace(/`/g, '``').replace(/\$/g, '`$')}")
+    $result | ConvertTo-Json -Compress
+} catch {
+    @{ success = $false; error = $_.Exception.Message } | ConvertTo-Json -Compress
+}
+  `.trim();
+}
+export async function injectDll(platform, pid, dllPath) {
+    if (platform !== 'win32') {
+        return { success: false, error: 'DLL injection currently only implemented for Windows' };
+    }
+    try {
+        const psScript = buildDllInjectionScript(pid, dllPath);
+        const { stdout } = await executePowerShellScript(psScript, { maxBuffer: 1024 * 1024, timeout: 30000 });
+        const _trimmed = stdout.trim();
+        if (!_trimmed)
+            throw new Error('PowerShell returned empty output');
+        const result = JSON.parse(_trimmed);
+        return {
+            success: result.success,
+            remoteThreadId: result.remoteThreadId,
+            error: result.error,
+        };
+    }
+    catch (error) {
+        logger.error('DLL injection failed:', error);
+        return {
+            success: false,
+            error: error instanceof Error ? error.message : 'PowerShell execution failed',
+        };
+    }
+}
+function buildShellcodeInjectionScript(pid, shellcode) {
+    return `
+Add-Type @"
+using System;
+using System.Runtime.InteropServices;
+using System.ComponentModel;
+
+public class ShellcodeInjector {
+    [DllImport("kernel32.dll", SetLastError = true)]
+    public static extern IntPtr OpenProcess(int access, bool inherit, int pid);
+
+    [DllImport("kernel32.dll", SetLastError = true)]
+    public static extern IntPtr VirtualAllocEx(IntPtr hProcess, IntPtr addr, int size, int allocType, int protect);
+
+    [DllImport("kernel32.dll", SetLastError = true)]
+    public static extern bool WriteProcessMemory(IntPtr hProcess, IntPtr addr, byte[] buffer, int size, out int written);
+
+    [DllImport("kernel32.dll", SetLastError = true)]
+    public static extern IntPtr CreateRemoteThread(IntPtr hProcess, IntPtr attr, int stackSize, IntPtr startAddr, IntPtr param, int flags, out int threadId);
+
+    [DllImport("kernel32.dll", SetLastError = true)]
+    public static extern bool CloseHandle(IntPtr handle);
+
+    [DllImport("kernel32.dll", SetLastError = true)]
+    public static extern bool VirtualProtectEx(IntPtr hProcess, IntPtr addr, int size, int newProtect, out int oldProtect);
+
+    const int PROCESS_CREATE_THREAD = 0x0002;
+    const int PROCESS_QUERY_INFORMATION = 0x0400;
+    const int PROCESS_VM_OPERATION = 0x0008;
+    const int PROCESS_VM_WRITE = 0x0020;
+    const int MEM_COMMIT = 0x1000;
+    const int MEM_RESERVE = 0x2000;
+    const int PAGE_READWRITE = 0x04;
+    const int PAGE_EXECUTE_READWRITE = 0x40;
+
+    public static object Inject(int pid, byte[] shellcode) {
+        IntPtr hProcess = OpenProcess(PROCESS_CREATE_THREAD | PROCESS_QUERY_INFORMATION | PROCESS_VM_OPERATION | PROCESS_VM_WRITE, false, pid);
+        if (hProcess == IntPtr.Zero) {
+            int error = Marshal.GetLastWin32Error();
+            throw new Win32Exception(error, "Failed to open process. Run as Administrator.");
+        }
+
+        try {
+            IntPtr remoteMem = VirtualAllocEx(hProcess, IntPtr.Zero, shellcode.Length, MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE);
+            if (remoteMem == IntPtr.Zero) {
+                int error = Marshal.GetLastWin32Error();
+                throw new Win32Exception(error, "Failed to allocate memory in target");
+            }
+
+            try {
+                int written;
+                if (!WriteProcessMemory(hProcess, remoteMem, shellcode, shellcode.Length, out written)) {
+                    int error = Marshal.GetLastWin32Error();
+                    throw new Win32Exception(error, "Failed to write shellcode to target");
+                }
+
+                int oldProtect;
+                if (!VirtualProtectEx(hProcess, remoteMem, shellcode.Length, PAGE_EXECUTE_READWRITE, out oldProtect)) {
+                    int error = Marshal.GetLastWin32Error();
+                    throw new Win32Exception(error, "Failed to change memory protection to executable");
+                }
+
+                int threadId;
+                IntPtr hThread = CreateRemoteThread(hProcess, IntPtr.Zero, 0, remoteMem, IntPtr.Zero, 0, out threadId);
+                if (hThread == IntPtr.Zero) {
+                    int error = Marshal.GetLastWin32Error();
+                    throw new Win32Exception(error, "Failed to create remote thread");
+                }
+
+                CloseHandle(hThread);
+                return new { success = true, remoteThreadId = threadId };
+            } finally {
+                // Note: Memory is not freed to allow shellcode to execute
+            }
+        } finally {
+            CloseHandle(hProcess);
+        }
+    }
+}
+"@
+
+try {
+    $shellcode = @(${Array.from(shellcode).join(',')})
+    $result = [ShellcodeInjector]::Inject(${pid}, $shellcode)
+    $result | ConvertTo-Json -Compress
+} catch {
+    @{ success = $false; error = $_.Exception.Message } | ConvertTo-Json -Compress
+}
+  `.trim();
+}
+export async function injectShellcode(platform, pid, shellcode, encoding = 'hex') {
+    if (platform !== 'win32') {
+        return { success: false, error: 'Shellcode injection currently only implemented for Windows' };
+    }
+    try {
+        let shellcodeBytes;
+        if (encoding === 'base64') {
+            shellcodeBytes = Buffer.from(shellcode, 'base64');
+        }
+        else {
+            const cleanHex = shellcode.replace(/\s/g, '');
+            shellcodeBytes = Buffer.from(cleanHex, 'hex');
+        }
+        const psScript = buildShellcodeInjectionScript(pid, shellcodeBytes);
+        const { stdout } = await executePowerShellScript(psScript, { maxBuffer: 1024 * 1024, timeout: 30000 });
+        const _trimmed = stdout.trim();
+        if (!_trimmed)
+            throw new Error('PowerShell returned empty output');
+        const result = JSON.parse(_trimmed);
+        return {
+            success: result.success,
+            remoteThreadId: result.remoteThreadId,
+            error: result.error,
+        };
+    }
+    catch (error) {
+        logger.error('Shellcode injection failed:', error);
+        return {
+            success: false,
+            error: error instanceof Error ? error.message : 'PowerShell execution failed',
+        };
+    }
+}
+//# sourceMappingURL=injector.js.map

package/dist/modules/process/memory/injector.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"injector.js","sourceRoot":"","sources":["../../../../src/modules/process/memory/injector.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AACvC,OAAO,EAAE,uBAAuB,EAAiB,MAAM,+BAA+B,CAAC;AAMvF,SAAS,uBAAuB,CAAC,GAAW,EAAE,OAAe;IAC3D,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;sCA6F6B,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC;;;;;GAKvI,CAAC,IAAI,EAAE,CAAC;AACX,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,QAAkB,EAClB,GAAW,EACX,OAAe;IAEf,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;QACzB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,sDAAsD,EAAE,CAAC;IAC3F,CAAC;IAED,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,uBAAuB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QAEvD,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,uBAAuB,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;QAEvG,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;QAC/B,IAAI,CAAC,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;QACnE,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACpC,OAAO;YACL,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,cAAc,EAAE,MAAM,CAAC,cAAc;YACrC,KAAK,EAAE,MAAM,CAAC,KAAK;SACpB,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,KAAK,CAAC,uBAAuB,EAAE,KAAK,CAAC,CAAC;QAC7C,OAAO;YACL,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,6BAA6B;SAC9E,CAAC;IACJ,CAAC;AACH,CAAC;AAMD,SAAS,6BAA6B,CAAC,GAAW,EAAE,SAAiB;IACnE,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;qBAiFY,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;4CACR,GAAG;;;;;GAK5C,CAAC,IAAI,EAAE,CAAC;AACX,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,QAAkB,EAClB,GAAW,EACX,SAAiB,EACjB,WAA6B,KAAK;IAElC,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;QACzB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,4DAA4D,EAAE,CAAC;IACjG,CAAC;IAED,IAAI,CAAC;QACH,IAAI,cAAsB,CAAC;QAC3B,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAC1B,cAAc,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;QACpD,CAAC;aAAM,CAAC;YACN,MAAM,QAAQ,GAAG,SAAS,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;YAC9C,cAAc,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QAChD,CAAC;QAED,MAAM,QAAQ,GAAG,6BAA6B,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;QAEpE,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,uBAAuB,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;QAEvG,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;QAC/B,IAAI,CAAC,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;QACnE,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACpC,OAAO;YACL,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,cAAc,EAAE,MAAM,CAAC,cAAc;YACrC,KAAK,EAAE,MAAM,CAAC,KAAK;SACpB,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,KAAK,CAAC,6BAA6B,EAAE,KAAK,CAAC,CAAC;QACnD,OAAO;YACL,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,6BAA6B;SAC9E,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/modules/process/memory/monitor.d.ts

@@ -0,0 +1,7 @@
+import { type MemoryReadResult } from '../../process/memory/types.js';
+export declare class MemoryMonitorManager {
+    private activeMonitors;
+    start(pid: number, address: string, size: number | undefined, intervalMs: number | undefined, readMemoryFn: (pid: number, address: string, size: number) => Promise<MemoryReadResult>, onChange?: (oldValue: string, newValue: string) => void): string;
+    stop(monitorId: string): boolean;
+}
+//# sourceMappingURL=monitor.d.ts.map

package/dist/modules/process/memory/monitor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"monitor.d.ts","sourceRoot":"","sources":["../../../../src/modules/process/memory/monitor.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,KAAK,gBAAgB,EAA2B,MAAM,+BAA+B,CAAC;AAE/F,qBAAa,oBAAoB;IAC/B,OAAO,CAAC,cAAc,CAA8C;IAEpE,KAAK,CACH,GAAG,EAAE,MAAM,EACX,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,MAAM,YAAI,EAChB,UAAU,EAAE,MAAM,YAAO,EACzB,YAAY,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,gBAAgB,CAAC,EACvF,QAAQ,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,KAAK,IAAI,GACtD,MAAM;IA6BT,IAAI,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO;CASjC"}

package/dist/modules/process/memory/monitor.js

@@ -0,0 +1,38 @@
+export class MemoryMonitorManager {
+    activeMonitors = new Map();
+    start(pid, address, size = 4, intervalMs = 1000, readMemoryFn, onChange) {
+        const monitorId = `monitor_${Date.now()}_${Math.random().toString(36).substr(2, 9)}`;
+        const timer = setInterval(async () => {
+            const monitor = this.activeMonitors.get(monitorId);
+            if (!monitor)
+                return;
+            const result = await readMemoryFn(pid, address, size);
+            if (result.success && result.data) {
+                if (monitor.lastValue !== result.data) {
+                    if (onChange && monitor.lastValue !== '') {
+                        onChange(monitor.lastValue, result.data);
+                    }
+                    monitor.lastValue = result.data;
+                }
+            }
+        }, intervalMs);
+        this.activeMonitors.set(monitorId, {
+            pid,
+            address,
+            interval: intervalMs,
+            lastValue: '',
+            timer,
+        });
+        return monitorId;
+    }
+    stop(monitorId) {
+        const monitor = this.activeMonitors.get(monitorId);
+        if (monitor) {
+            clearInterval(monitor.timer);
+            this.activeMonitors.delete(monitorId);
+            return true;
+        }
+        return false;
+    }
+}
+//# sourceMappingURL=monitor.js.map

package/dist/modules/process/memory/monitor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"monitor.js","sourceRoot":"","sources":["../../../../src/modules/process/memory/monitor.ts"],"names":[],"mappings":"AAMA,MAAM,OAAO,oBAAoB;IACvB,cAAc,GAAoC,IAAI,GAAG,EAAE,CAAC;IAEpE,KAAK,CACH,GAAW,EACX,OAAe,EACf,OAAe,CAAC,EAChB,aAAqB,IAAI,EACzB,YAAuF,EACvF,QAAuD;QAEvD,MAAM,SAAS,GAAG,WAAW,IAAI,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;QAErF,MAAM,KAAK,GAAG,WAAW,CAAC,KAAK,IAAI,EAAE;YACnC,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YACnD,IAAI,CAAC,OAAO;gBAAE,OAAO;YAErB,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;YACtD,IAAI,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;gBAClC,IAAI,OAAO,CAAC,SAAS,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC;oBACtC,IAAI,QAAQ,IAAI,OAAO,CAAC,SAAS,KAAK,EAAE,EAAE,CAAC;wBACzC,QAAQ,CAAC,OAAO,CAAC,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;oBAC3C,CAAC;oBACD,OAAO,CAAC,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC;gBAClC,CAAC;YACH,CAAC;QACH,CAAC,EAAE,UAAU,CAAC,CAAC;QAEf,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,SAAS,EAAE;YACjC,GAAG;YACH,OAAO;YACP,QAAQ,EAAE,UAAU;YACpB,SAAS,EAAE,EAAE;YACb,KAAK;SACN,CAAC,CAAC;QAEH,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,IAAI,CAAC,SAAiB;QACpB,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACnD,IAAI,OAAO,EAAE,CAAC;YACZ,aAAa,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YAC7B,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YACtC,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;CACF"}

package/dist/modules/process/memory/reader.d.ts

@@ -0,0 +1,3 @@
+import { type Platform, type MemoryReadResult, type MemoryProtectionInfo } from '../../process/memory/types.js';
+export declare function readMemory(platform: Platform, pid: number, address: string, size: number, checkProtectionFn: (pid: number, address: string) => Promise<MemoryProtectionInfo>): Promise<MemoryReadResult>;
+//# sourceMappingURL=reader.d.ts.map

package/dist/modules/process/memory/reader.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"reader.d.ts","sourceRoot":"","sources":["../../../../src/modules/process/memory/reader.ts"],"names":[],"mappings":"AAQA,OAAO,EAGL,KAAK,QAAQ,EACb,KAAK,gBAAgB,EACrB,KAAK,oBAAoB,EAC1B,MAAM,+BAA+B,CAAC;AAoKvC,wBAAsB,UAAU,CAC9B,QAAQ,EAAE,QAAQ,EAClB,GAAG,EAAE,MAAM,EACX,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,MAAM,EACZ,iBAAiB,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,oBAAoB,CAAC,GACjF,OAAO,CAAC,gBAAgB,CAAC,CAmC3B"}

package/dist/modules/process/memory/reader.js

@@ -0,0 +1,172 @@
+import { promises as fs } from 'node:fs';
+import { logger } from '../../../utils/logger.js';
+import { nativeMemoryManager } from '../../../native/NativeMemoryManager.js';
+import { isKoffiAvailable } from '../../../native/Win32API.js';
+import { execAsync, executePowerShellScript, } from '../../process/memory/types.js';
+async function readMemoryWindows(pid, address, size) {
+    try {
+        const psScript = `
+        Add-Type @"
+          using System;
+          using System.Runtime.InteropServices;
+          using System.ComponentModel;
+
+          public class MemoryReader {
+            [DllImport("kernel32.dll", SetLastError = true)]
+            public static extern IntPtr OpenProcess(int access, bool inherit, int pid);
+
+            [DllImport("kernel32.dll", SetLastError = true)]
+            public static extern bool ReadProcessMemory(IntPtr hProcess, IntPtr addr, byte[] buffer, int size, out int read);
+
+            [DllImport("kernel32.dll", SetLastError = true)]
+            public static extern bool CloseHandle(IntPtr handle);
+
+            const int PROCESS_VM_READ = 0x0010;
+            const int PROCESS_QUERY_INFORMATION = 0x0400;
+
+            public static string ReadMemory(int pid, long address, int size) {
+              IntPtr hProcess = OpenProcess(PROCESS_VM_READ | PROCESS_QUERY_INFORMATION, false, pid);
+              if (hProcess == IntPtr.Zero) {
+                int error = Marshal.GetLastWin32Error();
+                throw new Win32Exception(error, "Failed to open process. Run as Administrator.");
+              }
+
+              try {
+                byte[] buffer = new byte[size];
+                int bytesRead;
+                bool success = ReadProcessMemory(hProcess, (IntPtr)address, buffer, size, out bytesRead);
+
+                if (!success) {
+                  int error = Marshal.GetLastWin32Error();
+                  throw new Win32Exception(error, "Failed to read memory");
+                }
+
+                return BitConverter.ToString(buffer, 0, bytesRead).Replace("-", " ");
+              } finally {
+                CloseHandle(hProcess);
+              }
+            }
+          }
+"@
+
+        try {
+          $result = [MemoryReader]::ReadMemory(${pid}, ${address}, ${size})
+          @{ success = $true; data = $result } | ConvertTo-Json -Compress
+        } catch {
+          @{ success = $false; error = $_.Exception.Message } | ConvertTo-Json -Compress
+        }
+      `;
+        const { stdout } = await executePowerShellScript(psScript, { maxBuffer: 1024 * 1024 * 10 });
+        const _trimmed = stdout.trim();
+        if (!_trimmed)
+            throw new Error('PowerShell returned empty output');
+        const result = JSON.parse(_trimmed);
+        return {
+            success: result.success,
+            data: result.data,
+            error: result.error,
+        };
+    }
+    catch (error) {
+        logger.error('Windows memory read failed:', error);
+        return {
+            success: false,
+            error: error instanceof Error ? error.message : 'PowerShell execution failed. Run as Administrator.',
+        };
+    }
+}
+async function readMemoryLinux(pid, address, size) {
+    try {
+        const { stdout } = await execAsync(`sudo dd if=/proc/${pid}/mem bs=1 skip=${address} count=${size} 2>/dev/null | xxd -p | tr -d '\\n' || echo ""`, { maxBuffer: 1024 * 1024 * 10, timeout: 10000 });
+        if (!stdout.trim()) {
+            return {
+                success: false,
+                error: 'Failed to read memory. Requires root privileges or ptrace access.',
+            };
+        }
+        const hexData = stdout.trim().match(/.{1,2}/g)?.join(' ') || stdout.trim();
+        return {
+            success: true,
+            data: hexData.toUpperCase(),
+        };
+    }
+    catch (error) {
+        logger.error('Linux memory read failed:', error);
+        return {
+            success: false,
+            error: 'Memory read failed. Run as root or use ptrace.',
+        };
+    }
+}
+async function readMemoryMac(pid, address, size, checkProtectionFn) {
+    if (address === 0) {
+        return { success: false, error: 'Invalid address: null pointer (0x0)' };
+    }
+    const MAX_READ_SIZE = 16 * 1024 * 1024;
+    if (size <= 0 || size > MAX_READ_SIZE) {
+        return { success: false, error: `Invalid size: must be 1–${MAX_READ_SIZE} bytes` };
+    }
+    const addrHex = `0x${address.toString(16)}`;
+    const prot = await checkProtectionFn(pid, addrHex);
+    if (!prot.success) {
+        return { success: false, error: `Cannot verify memory region: ${prot.error}` };
+    }
+    if (!prot.isReadable) {
+        return { success: false, error: `Address ${addrHex} is not readable (protection: ${prot.protection ?? 'unknown'})` };
+    }
+    const tmpFile = `/tmp/mread_${pid}_${Date.now()}.bin`;
+    try {
+        const { stdout } = await execAsync(`lldb --batch -p ${pid} -o "memory read --outfile ${tmpFile} --binary ${addrHex} -c ${size}" -o "process detach"`, { timeout: 15000, maxBuffer: 1024 * 1024 * 10 });
+        if (!stdout.includes('bytes written')) {
+            const errLine = stdout.split('\n').find(l => l.includes('error:')) ?? stdout;
+            return { success: false, error: `lldb memory read failed: ${errLine.trim()}` };
+        }
+        const data = await fs.readFile(tmpFile);
+        const hex = Array.from(data)
+            .map(b => b.toString(16).padStart(2, '0').toUpperCase())
+            .join(' ');
+        return { success: true, data: hex };
+    }
+    catch (error) {
+        return { success: false, error: error instanceof Error ? error.message : String(error) };
+    }
+    finally {
+        await fs.unlink(tmpFile).catch(() => { });
+    }
+}
+export async function readMemory(platform, pid, address, size, checkProtectionFn) {
+    try {
+        const addrNum = parseInt(address, 16);
+        if (isNaN(addrNum)) {
+            return { success: false, error: 'Invalid address format. Use hex like "0x12345678"' };
+        }
+        if (platform === 'win32' && isKoffiAvailable()) {
+            try {
+                const result = await nativeMemoryManager.readMemory(pid, address, size);
+                if (result.success) {
+                    logger.debug('Native memory read succeeded');
+                    return result;
+                }
+                logger.warn('Native memory read failed, falling back to PowerShell:', result.error);
+            }
+            catch (nativeError) {
+                logger.warn('Native memory read error, falling back to PowerShell:', nativeError);
+            }
+        }
+        switch (platform) {
+            case 'win32':
+                return readMemoryWindows(pid, addrNum, size);
+            case 'linux':
+                return readMemoryLinux(pid, addrNum, size);
+            case 'darwin':
+                return readMemoryMac(pid, addrNum, size, checkProtectionFn);
+            default:
+                return { success: false, error: `Memory operations not supported on platform: ${platform}` };
+        }
+    }
+    catch (error) {
+        logger.error('Memory read failed:', error);
+        return { success: false, error: error instanceof Error ? error.message : String(error) };
+    }
+}
+//# sourceMappingURL=reader.js.map

package/dist/modules/process/memory/reader.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"reader.js","sourceRoot":"","sources":["../../../../src/modules/process/memory/reader.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,QAAQ,IAAI,EAAE,EAAE,MAAM,SAAS,CAAC;AACzC,OAAO,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AACvC,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,EACL,SAAS,EACT,uBAAuB,GAIxB,MAAM,+BAA+B,CAAC;AAMvC,KAAK,UAAU,iBAAiB,CAAC,GAAW,EAAE,OAAe,EAAE,IAAY;IACzE,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iDA6C4B,GAAG,KAAK,OAAO,KAAK,IAAI;;;;;OAKlE,CAAC;QAEJ,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,uBAAuB,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,GAAG,IAAI,GAAG,EAAE,EAAE,CAAC,CAAC;QAE5F,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;QAC/B,IAAI,CAAC,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;QACnE,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACpC,OAAO;YACL,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,KAAK,EAAE,MAAM,CAAC,KAAK;SACpB,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,KAAK,CAAC,6BAA6B,EAAE,KAAK,CAAC,CAAC;QACnD,OAAO;YACL,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,oDAAoD;SACrG,CAAC;IACJ,CAAC;AACH,CAAC;AAMD,KAAK,UAAU,eAAe,CAAC,GAAW,EAAE,OAAe,EAAE,IAAY;IACvE,IAAI,CAAC;QACH,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,SAAS,CAChC,oBAAoB,GAAG,kBAAkB,OAAO,UAAU,IAAI,gDAAgD,EAC9G,EAAE,SAAS,EAAE,IAAI,GAAG,IAAI,GAAG,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,CAChD,CAAC;QAEF,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;YACnB,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,mEAAmE;aAC3E,CAAC;QACJ,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;QAE3E,OAAO;YACL,OAAO,EAAE,IAAI;YACb,IAAI,EAAE,OAAO,CAAC,WAAW,EAAE;SAC5B,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,KAAK,CAAC,2BAA2B,EAAE,KAAK,CAAC,CAAC;QACjD,OAAO;YACL,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,gDAAgD;SACxD,CAAC;IACJ,CAAC;AACH,CAAC;AAMD,KAAK,UAAU,aAAa,CAC1B,GAAW,EACX,OAAe,EACf,IAAY,EACZ,iBAAkF;IAElF,IAAI,OAAO,KAAK,CAAC,EAAE,CAAC;QAClB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,qCAAqC,EAAE,CAAC;IAC1E,CAAC;IACD,MAAM,aAAa,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;IACvC,IAAI,IAAI,IAAI,CAAC,IAAI,IAAI,GAAG,aAAa,EAAE,CAAC;QACtC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,2BAA2B,aAAa,QAAQ,EAAE,CAAC;IACrF,CAAC;IACD,MAAM,OAAO,GAAG,KAAK,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC;IAC5C,MAAM,IAAI,GAAG,MAAM,iBAAiB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IACnD,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;QAClB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,gCAAgC,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC;IACjF,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;QACrB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,OAAO,iCAAiC,IAAI,CAAC,UAAU,IAAI,SAAS,GAAG,EAAE,CAAC;IACvH,CAAC;IAED,MAAM,OAAO,GAAG,cAAc,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC;IACtD,IAAI,CAAC;QACH,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,SAAS,CAChC,mBAAmB,GAAG,8BAA8B,OAAO,aAAa,OAAO,OAAO,IAAI,uBAAuB,EACjH,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,GAAG,IAAI,GAAG,EAAE,EAAE,CAChD,CAAC;QACF,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC;YACtC,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,IAAI,MAAM,CAAC;YAC7E,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,4BAA4B,OAAO,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC;QACjF,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QACxC,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC;aACzB,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;aACvD,IAAI,CAAC,GAAG,CAAC,CAAC;QACb,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;IACtC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;IAC3F,CAAC;YAAS,CAAC;QACT,MAAM,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IAC3C,CAAC;AACH,CAAC;AAMD,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,QAAkB,EAClB,GAAW,EACX,OAAe,EACf,IAAY,EACZ,iBAAkF;IAElF,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;QACtC,IAAI,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;YACnB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,mDAAmD,EAAE,CAAC;QACxF,CAAC;QAGD,IAAI,QAAQ,KAAK,OAAO,IAAI,gBAAgB,EAAE,EAAE,CAAC;YAC/C,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,UAAU,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;gBACxE,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;oBACnB,MAAM,CAAC,KAAK,CAAC,8BAA8B,CAAC,CAAC;oBAC7C,OAAO,MAAM,CAAC;gBAChB,CAAC;gBACD,MAAM,CAAC,IAAI,CAAC,wDAAwD,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;YACtF,CAAC;YAAC,OAAO,WAAW,EAAE,CAAC;gBACrB,MAAM,CAAC,IAAI,CAAC,uDAAuD,EAAE,WAAW,CAAC,CAAC;YACpF,CAAC;QACH,CAAC;QAED,QAAQ,QAAQ,EAAE,CAAC;YACjB,KAAK,OAAO;gBACV,OAAO,iBAAiB,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;YAC/C,KAAK,OAAO;gBACV,OAAO,eAAe,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;YAC7C,KAAK,QAAQ;gBACX,OAAO,aAAa,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,iBAAiB,CAAC,CAAC;YAC9D;gBACE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,gDAAgD,QAAQ,EAAE,EAAE,CAAC;QACjG,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,KAAK,CAAC,qBAAqB,EAAE,KAAK,CAAC,CAAC;QAC3C,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;IAC3F,CAAC;AACH,CAAC"}

package/dist/modules/process/memory/regions.d.ts

@@ -0,0 +1,2 @@
+export { dumpMemoryRegion, enumerateRegions, checkMemoryProtection, enumerateModules, } from '../../process/memory/regions.impl.js';
+//# sourceMappingURL=regions.d.ts.map

package/dist/modules/process/memory/regions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"regions.d.ts","sourceRoot":"","sources":["../../../../src/modules/process/memory/regions.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,gBAAgB,EAChB,gBAAgB,EAChB,qBAAqB,EACrB,gBAAgB,GACjB,MAAM,sCAAsC,CAAC"}

package/dist/modules/process/memory/regions.dump.d.ts

@@ -0,0 +1,6 @@
+import { type Platform } from '../../process/memory/types.js';
+export declare function dumpMemoryRegion(platform: Platform, pid: number, startAddress: string, size: number, outputPath: string): Promise<{
+    success: boolean;
+    error?: string;
+}>;
+//# sourceMappingURL=regions.dump.d.ts.map

package/dist/modules/process/memory/regions.dump.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"regions.dump.d.ts","sourceRoot":"","sources":["../../../../src/modules/process/memory/regions.dump.ts"],"names":[],"mappings":"AACA,OAAO,EAA0C,KAAK,QAAQ,EAAE,MAAM,+BAA+B,CAAC;AAyDtG,wBAAsB,gBAAgB,CACpC,QAAQ,EAAE,QAAQ,EAClB,GAAG,EAAE,MAAM,EACX,YAAY,EAAE,MAAM,EACpB,IAAI,EAAE,MAAM,EACZ,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAuD/C"}

package/dist/modules/process/memory/regions.dump.js

@@ -0,0 +1,114 @@
+import { logger } from '../../../utils/logger.js';
+import { execFileAsync, executePowerShellScript } from '../../process/memory/types.js';
+function buildMemoryDumpScript(pid, address, size, outputPath) {
+    return `
+Add-Type @"
+using System;
+using System.Runtime.InteropServices;
+using System.IO;
+using System.ComponentModel;
+
+public class MemoryDumper {
+    [DllImport("kernel32.dll", SetLastError = true)]
+    public static extern IntPtr OpenProcess(int access, bool inherit, int pid);
+
+    [DllImport("kernel32.dll", SetLastError = true)]
+    public static extern bool ReadProcessMemory(IntPtr hProcess, IntPtr addr, byte[] buffer, int size, out int read);
+
+    [DllImport("kernel32.dll", SetLastError = true)]
+    public static extern bool CloseHandle(IntPtr handle);
+
+    const int PROCESS_VM_READ = 0x0010;
+    const int PROCESS_QUERY_INFORMATION = 0x0400;
+
+    public static string DumpMemory(int pid, long address, int size, string outputPath) {
+        IntPtr hProcess = OpenProcess(PROCESS_VM_READ | PROCESS_QUERY_INFORMATION, false, pid);
+        if (hProcess == IntPtr.Zero) {
+            int error = Marshal.GetLastWin32Error();
+            throw new Win32Exception(error, "Failed to open process. Run as Administrator.");
+        }
+
+        try {
+            byte[] buffer = new byte[size];
+            int bytesRead;
+
+            if (!ReadProcessMemory(hProcess, (IntPtr)address, buffer, size, out bytesRead)) {
+                int error = Marshal.GetLastWin32Error();
+                throw new Win32Exception(error, "Failed to read memory");
+            }
+
+            File.WriteAllBytes(outputPath, buffer);
+            return "Dumped " + bytesRead + " bytes to " + outputPath;
+        } finally {
+            CloseHandle(hProcess);
+        }
+    }
+}
+"@
+
+try {
+    $result = [MemoryDumper]::DumpMemory(${pid}, ${address}, ${size}, "${outputPath.replace(/\\/g, '\\\\').replace(/"/g, '`"').replace(/\$/g, '`$')}")
+    @{ success = $true; message = $result } | ConvertTo-Json -Compress
+} catch {
+    @{ success = $false; error = $_.Exception.Message } | ConvertTo-Json -Compress
+}
+  `.trim();
+}
+export async function dumpMemoryRegion(platform, pid, startAddress, size, outputPath) {
+    if (platform !== 'win32' && platform !== 'darwin') {
+        return { success: false, error: 'Memory dump currently only implemented for Windows and macOS' };
+    }
+    if (platform === 'darwin') {
+        const addrNum = parseInt(startAddress, 16);
+        if (isNaN(addrNum))
+            return { success: false, error: 'Invalid address format' };
+        if (!Number.isInteger(pid) || pid <= 0)
+            return { success: false, error: 'Invalid pid' };
+        if (!Number.isInteger(size) || size <= 0)
+            return { success: false, error: 'Invalid size' };
+        const addrHex = `0x${addrNum.toString(16)}`;
+        try {
+            const { stdout } = await execFileAsync('lldb', [
+                '--batch',
+                '-p',
+                String(pid),
+                '-o',
+                `memory read --outfile ${outputPath} --binary ${addrHex} -c ${size}`,
+                '-o',
+                'process detach',
+            ], { timeout: 60000, maxBuffer: 1024 * 1024 });
+            if (!stdout.includes('bytes written')) {
+                const errLine = stdout.split('\n').find((l) => l.includes('error:')) ?? stdout;
+                return { success: false, error: `lldb dump failed: ${errLine.trim()}` };
+            }
+            return { success: true };
+        }
+        catch (error) {
+            return { success: false, error: error instanceof Error ? error.message : String(error) };
+        }
+    }
+    try {
+        const addrNum = parseInt(startAddress, 16);
+        if (isNaN(addrNum))
+            return { success: false, error: 'Invalid address format' };
+        if (!Number.isInteger(pid) || pid <= 0)
+            return { success: false, error: 'Invalid pid' };
+        if (!Number.isInteger(size) || size <= 0)
+            return { success: false, error: 'Invalid size' };
+        const psScript = buildMemoryDumpScript(pid, addrNum, size, outputPath);
+        const { stdout } = await executePowerShellScript(psScript, { maxBuffer: 1024 * 1024, timeout: 60000 });
+        const _trimmed = stdout.trim();
+        if (!_trimmed)
+            throw new Error('PowerShell returned empty output');
+        const result = JSON.parse(_trimmed);
+        return { success: result.success, error: result.error };
+    }
+    catch (error) {
+        logger.error('Memory dump failed:', error);
+        return {
+            success: false,
+            error: error instanceof Error ? error.message : 'PowerShell execution failed',
+        };
+    }
+}
+//# sourceMappingURL=regions.dump.js.map

package/dist/modules/process/memory/regions.dump.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"regions.dump.js","sourceRoot":"","sources":["../../../../src/modules/process/memory/regions.dump.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AACvC,OAAO,EAAE,aAAa,EAAE,uBAAuB,EAAiB,MAAM,+BAA+B,CAAC;AAEtG,SAAS,qBAAqB,CAAC,GAAW,EAAE,OAAe,EAAE,IAAY,EAAE,UAAkB;IAC3F,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;2CA8CkC,GAAG,KAAK,OAAO,KAAK,IAAI,MAAM,UAAU,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC;;;;;GAKhJ,CAAC,IAAI,EAAE,CAAC;AACX,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,QAAkB,EAClB,GAAW,EACX,YAAoB,EACpB,IAAY,EACZ,UAAkB;IAElB,IAAI,QAAQ,KAAK,OAAO,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAClD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,8DAA8D,EAAE,CAAC;IACnG,CAAC;IAED,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC1B,MAAM,OAAO,GAAG,QAAQ,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;QAC3C,IAAI,KAAK,CAAC,OAAO,CAAC;YAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,wBAAwB,EAAE,CAAC;QAC/E,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC;YAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC;QACxF,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC;YAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC;QAC3F,MAAM,OAAO,GAAG,KAAK,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC;QAC5C,IAAI,CAAC;YACH,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,aAAa,CACpC,MAAM,EACN;gBACE,SAAS;gBACT,IAAI;gBACJ,MAAM,CAAC,GAAG,CAAC;gBACX,IAAI;gBACJ,yBAAyB,UAAU,aAAa,OAAO,OAAO,IAAI,EAAE;gBACpE,IAAI;gBACJ,gBAAgB;aACjB,EACD,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,GAAG,IAAI,EAAE,CAC3C,CAAC;YACF,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC;gBACtC,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,IAAI,MAAM,CAAC;gBAC/E,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,qBAAqB,OAAO,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC;YAC1E,CAAC;YACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAC3B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;QAC3F,CAAC;IACH,CAAC;IAED,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,QAAQ,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;QAC3C,IAAI,KAAK,CAAC,OAAO,CAAC;YAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,wBAAwB,EAAE,CAAC;QAC/E,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC;YAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC;QACxF,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC;YAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC;QAE3F,MAAM,QAAQ,GAAG,qBAAqB,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC;QACvE,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,uBAAuB,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;QAEvG,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;QAC/B,IAAI,CAAC,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;QACnE,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACpC,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;IAC1D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,KAAK,CAAC,qBAAqB,EAAE,KAAK,CAAC,CAAC;QAC3C,OAAO;YACL,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,6BAA6B;SAC9E,CAAC;IACJ,CAAC;AACH,CAAC"}