@jshookmcp/jshook 0.1.2

package/dist/modules/process/memory/regions.enumerate.d.ts

@@ -0,0 +1,19 @@
+import { type MemoryRegion, type Platform } from '../../process/memory/types.js';
+interface DarwinMemoryRegion {
+    baseAddress: string;
+    size: number;
+    type: string;
+    protect: string;
+    maxProtect: string;
+    isReadable: boolean;
+    isWritable: boolean;
+    isExecutable: boolean;
+}
+export type EnumeratedRegion = MemoryRegion | DarwinMemoryRegion;
+export declare function enumerateRegions(platform: Platform, pid: number): Promise<{
+    success: boolean;
+    regions?: EnumeratedRegion[];
+    error?: string;
+}>;
+export {};
+//# sourceMappingURL=regions.enumerate.d.ts.map

package/dist/modules/process/memory/regions.enumerate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"regions.enumerate.d.ts","sourceRoot":"","sources":["../../../../src/modules/process/memory/regions.enumerate.ts"],"names":[],"mappings":"AACA,OAAO,EAAsC,KAAK,YAAY,EAAE,KAAK,QAAQ,EAAE,MAAM,+BAA+B,CAAC;AAErH,UAAU,kBAAkB;IAC1B,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,OAAO,CAAC;IACpB,UAAU,EAAE,OAAO,CAAC;IACpB,YAAY,EAAE,OAAO,CAAC;CACvB;AAED,MAAM,MAAM,gBAAgB,GAAG,YAAY,GAAG,kBAAkB,CAAC;AAiHjE,wBAAsB,gBAAgB,CACpC,QAAQ,EAAE,QAAQ,EAClB,GAAG,EAAE,MAAM,GACV,OAAO,CAAC;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,OAAO,CAAC,EAAE,gBAAgB,EAAE,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAwD7E"}

package/dist/modules/process/memory/regions.enumerate.js

@@ -0,0 +1,171 @@
+import { logger } from '../../../utils/logger.js';
+import { execAsync, executePowerShellScript } from '../../process/memory/types.js';
+function buildEnumerateRegionsScript(pid) {
+    return `
+Add-Type @"
+using System;
+using System.Runtime.InteropServices;
+using System.Collections.Generic;
+using System.ComponentModel;
+
+public class RegionEnumerator {
+    [DllImport("kernel32.dll", SetLastError = true)]
+    public static extern IntPtr OpenProcess(int access, bool inherit, int pid);
+
+    [DllImport("kernel32.dll", SetLastError = true)]
+    public static extern int VirtualQueryEx(IntPtr hProcess, IntPtr addr, out MEMORY_BASIC_INFORMATION info, int size);
+
+    [DllImport("kernel32.dll", SetLastError = true)]
+    public static extern bool CloseHandle(IntPtr handle);
+
+    const int PROCESS_QUERY_INFORMATION = 0x0400;
+
+    [StructLayout(LayoutKind.Sequential)]
+    public struct MEMORY_BASIC_INFORMATION {
+        public IntPtr BaseAddress;
+        public IntPtr AllocationBase;
+        public uint AllocationProtect;
+        public IntPtr RegionSize;
+        public uint State;
+        public uint Protect;
+        public uint Type;
+    }
+
+    const uint MEM_COMMIT = 0x1000;
+    const uint MEM_FREE = 0x10000;
+    const uint MEM_RESERVE = 0x2000;
+    const uint PAGE_READONLY = 0x02;
+    const uint PAGE_READWRITE = 0x04;
+    const uint PAGE_WRITECOPY = 0x08;
+    const uint PAGE_EXECUTE = 0x10;
+    const uint PAGE_EXECUTE_READ = 0x20;
+    const uint PAGE_EXECUTE_READWRITE = 0x40;
+
+    public static List<object> EnumerateRegions(int pid) {
+        var regions = new List<object>();
+        IntPtr hProcess = OpenProcess(PROCESS_QUERY_INFORMATION, false, pid);
+        if (hProcess == IntPtr.Zero) {
+            int error = Marshal.GetLastWin32Error();
+            throw new Win32Exception(error, "Failed to open process. Run as Administrator.");
+        }
+
+        try {
+            IntPtr addr = IntPtr.Zero;
+            MEMORY_BASIC_INFORMATION info;
+            int infoSize = Marshal.SizeOf(typeof(MEMORY_BASIC_INFORMATION));
+            int scannedRegions = 0;
+
+            while (VirtualQueryEx(hProcess, addr, out info, infoSize) == infoSize) {
+                scannedRegions++;
+                string state = info.State == MEM_COMMIT ? "COMMIT" : (info.State == MEM_RESERVE ? "RESERVE" : (info.State == MEM_FREE ? "FREE" : "UNKNOWN"));
+                string protect = GetProtectionString(info.Protect);
+                bool isReadable = (info.State == MEM_COMMIT) && ((info.Protect & (PAGE_READONLY | PAGE_READWRITE | PAGE_EXECUTE_READ | PAGE_EXECUTE_READWRITE)) != 0);
+
+                regions.Add(new {
+                    baseAddress = "0x" + info.BaseAddress.ToInt64().ToString("X"),
+                    size = info.RegionSize.ToInt64(),
+                    state = state,
+                    protection = protect,
+                    isReadable = isReadable,
+                    type = info.Type == 0x1000000 ? "IMAGE" : (info.Type == 0x40000 ? "MAPPED" : "PRIVATE")
+                });
+
+                if (regions.Count >= 10000 || scannedRegions >= 50000) break;
+                long baseAddr = info.BaseAddress.ToInt64();
+                long regionSize = info.RegionSize.ToInt64();
+                if (regionSize <= 0) break;
+                long nextAddr = baseAddr + regionSize;
+                if (nextAddr <= baseAddr) break;
+                addr = new IntPtr(nextAddr);
+                if (addr.ToInt64() >= 0x7FFFFFFF0000) break;
+            }
+
+            return regions;
+        } finally {
+            CloseHandle(hProcess);
+        }
+    }
+
+    private static string GetProtectionString(uint protect) {
+        if (protect == 0) return "NOACCESS";
+        string s = "";
+        if ((protect & 0x100) != 0) s += "NOACCESS ";
+        if ((protect & PAGE_READONLY) != 0) s += "R ";
+        if ((protect & PAGE_READWRITE) != 0) s += "RW ";
+        if ((protect & PAGE_WRITECOPY) != 0) s += "W ";
+        if ((protect & PAGE_EXECUTE) != 0) s += "X ";
+        if ((protect & PAGE_EXECUTE_READ) != 0) s += "RX ";
+        if ((protect & PAGE_EXECUTE_READWRITE) != 0) s += "RWX ";
+        if ((protect & 0x100) != 0) s += "GUARD ";
+        return s.Trim();
+    }
+}
+"@
+
+try {
+    $regions = [RegionEnumerator]::EnumerateRegions(${pid})
+    @{ success = $true; regions = $regions; count = $regions.Count } | ConvertTo-Json -Compress -Depth 10
+} catch {
+    @{ success = $false; error = $_.Exception.Message } | ConvertTo-Json -Compress
+}
+  `.trim();
+}
+export async function enumerateRegions(platform, pid) {
+    if (platform !== 'win32' && platform !== 'darwin') {
+        return { success: false, error: 'Region enumeration currently only implemented for Windows and macOS' };
+    }
+    if (platform === 'darwin') {
+        try {
+            const { stdout } = await execAsync(`vmmap -v ${pid}`, { timeout: 15000, maxBuffer: 1024 * 1024 * 5 });
+            const regions = [];
+            const regionRe = /^(\S[^\t]*?)\s{2,}([0-9a-f]+)-([0-9a-f]+)\s+\[.*?\]\s+([a-z-]+)\/([a-z-]+)/;
+            for (const line of stdout.split('\n')) {
+                const m = line.match(regionRe);
+                if (!m)
+                    continue;
+                const type = m[1];
+                const start = m[2];
+                const end = m[3];
+                const prot = m[4];
+                const maxProt = m[5];
+                const startNum = parseInt(start, 16);
+                const endNum = parseInt(end, 16);
+                regions.push({
+                    baseAddress: `0x${start}`,
+                    size: endNum - startNum,
+                    type: type.trim(),
+                    protect: prot,
+                    maxProtect: maxProt,
+                    isReadable: prot.includes('r'),
+                    isWritable: prot.includes('w'),
+                    isExecutable: prot.includes('x'),
+                });
+            }
+            return { success: true, regions };
+        }
+        catch (error) {
+            logger.error('macOS region enumeration failed:', error);
+            return { success: false, error: error instanceof Error ? error.message : String(error) };
+        }
+    }
+    try {
+        const psScript = buildEnumerateRegionsScript(pid);
+        const { stdout } = await executePowerShellScript(psScript, {
+            maxBuffer: 1024 * 1024 * 10,
+            timeout: 30000,
+        });
+        const _trimmed = stdout.trim();
+        if (!_trimmed)
+            throw new Error('PowerShell returned empty output');
+        const result = JSON.parse(_trimmed);
+        return { success: result.success, regions: result.regions, error: result.error };
+    }
+    catch (error) {
+        logger.error('Region enumeration failed:', error);
+        return {
+            success: false,
+            error: error instanceof Error ? error.message : 'PowerShell execution failed',
+        };
+    }
+}
+//# sourceMappingURL=regions.enumerate.js.map

package/dist/modules/process/memory/regions.enumerate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"regions.enumerate.js","sourceRoot":"","sources":["../../../../src/modules/process/memory/regions.enumerate.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AACvC,OAAO,EAAE,SAAS,EAAE,uBAAuB,EAAoC,MAAM,+BAA+B,CAAC;AAerH,SAAS,2BAA2B,CAAC,GAAW;IAC9C,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;sDAsG6C,GAAG;;;;;GAKtD,CAAC,IAAI,EAAE,CAAC;AACX,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,QAAkB,EAClB,GAAW;IAEX,IAAI,QAAQ,KAAK,OAAO,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAClD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,qEAAqE,EAAE,CAAC;IAC1G,CAAC;IAED,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC1B,IAAI,CAAC;YACH,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,SAAS,CAAC,YAAY,GAAG,EAAE,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,GAAG,IAAI,GAAG,CAAC,EAAE,CAAC,CAAC;YACtG,MAAM,OAAO,GAAyB,EAAE,CAAC;YACzC,MAAM,QAAQ,GAAG,4EAA4E,CAAC;YAC9F,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;gBACtC,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;gBAC/B,IAAI,CAAC,CAAC;oBAAE,SAAS;gBACjB,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC;gBACnB,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC;gBACpB,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC;gBAClB,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC;gBACnB,MAAM,OAAO,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC;gBACtB,MAAM,QAAQ,GAAG,QAAQ,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;gBACrC,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;gBACjC,OAAO,CAAC,IAAI,CAAC;oBACX,WAAW,EAAE,KAAK,KAAK,EAAE;oBACzB,IAAI,EAAE,MAAM,GAAG,QAAQ;oBACvB,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE;oBACjB,OAAO,EAAE,IAAI;oBACb,UAAU,EAAE,OAAO;oBACnB,UAAU,EAAE,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;oBAC9B,UAAU,EAAE,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;oBAC9B,YAAY,EAAE,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;iBACjC,CAAC,CAAC;YACL,CAAC;YACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;QACpC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,KAAK,CAAC,kCAAkC,EAAE,KAAK,CAAC,CAAC;YACxD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;QAC3F,CAAC;IACH,CAAC;IAED,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,2BAA2B,CAAC,GAAG,CAAC,CAAC;QAClD,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,uBAAuB,CAAC,QAAQ,EAAE;YACzD,SAAS,EAAE,IAAI,GAAG,IAAI,GAAG,EAAE;YAC3B,OAAO,EAAE,KAAK;SACf,CAAC,CAAC;QAEH,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;QAC/B,IAAI,CAAC,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;QACnE,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACpC,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;IACnF,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,KAAK,CAAC,4BAA4B,EAAE,KAAK,CAAC,CAAC;QAClD,OAAO;YACL,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,6BAA6B;SAC9E,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/modules/process/memory/regions.impl.d.ts

@@ -0,0 +1,5 @@
+export { dumpMemoryRegion } from '../../process/memory/regions.dump.js';
+export { enumerateRegions } from '../../process/memory/regions.enumerate.js';
+export { checkMemoryProtection } from '../../process/memory/regions.protection.js';
+export { enumerateModules } from '../../process/memory/regions.modules.js';
+//# sourceMappingURL=regions.impl.d.ts.map

package/dist/modules/process/memory/regions.impl.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"regions.impl.d.ts","sourceRoot":"","sources":["../../../../src/modules/process/memory/regions.impl.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,gBAAgB,EAAE,MAAM,sCAAsC,CAAC;AACxE,OAAO,EAAE,gBAAgB,EAAE,MAAM,2CAA2C,CAAC;AAC7E,OAAO,EAAE,qBAAqB,EAAE,MAAM,4CAA4C,CAAC;AACnF,OAAO,EAAE,gBAAgB,EAAE,MAAM,yCAAyC,CAAC"}

package/dist/modules/process/memory/regions.impl.js

@@ -0,0 +1,5 @@
+export { dumpMemoryRegion } from '../../process/memory/regions.dump.js';
+export { enumerateRegions } from '../../process/memory/regions.enumerate.js';
+export { checkMemoryProtection } from '../../process/memory/regions.protection.js';
+export { enumerateModules } from '../../process/memory/regions.modules.js';
+//# sourceMappingURL=regions.impl.js.map

package/dist/modules/process/memory/regions.impl.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"regions.impl.js","sourceRoot":"","sources":["../../../../src/modules/process/memory/regions.impl.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,gBAAgB,EAAE,MAAM,sCAAsC,CAAC;AACxE,OAAO,EAAE,gBAAgB,EAAE,MAAM,2CAA2C,CAAC;AAC7E,OAAO,EAAE,qBAAqB,EAAE,MAAM,4CAA4C,CAAC;AACnF,OAAO,EAAE,gBAAgB,EAAE,MAAM,yCAAyC,CAAC"}

package/dist/modules/process/memory/regions.js

@@ -0,0 +1,2 @@
+export { dumpMemoryRegion, enumerateRegions, checkMemoryProtection, enumerateModules, } from '../../process/memory/regions.impl.js';
+//# sourceMappingURL=regions.js.map

package/dist/modules/process/memory/regions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"regions.js","sourceRoot":"","sources":["../../../../src/modules/process/memory/regions.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,gBAAgB,EAChB,gBAAgB,EAChB,qBAAqB,EACrB,gBAAgB,GACjB,MAAM,sCAAsC,CAAC"}

package/dist/modules/process/memory/regions.modules.d.ts

@@ -0,0 +1,11 @@
+import { type Platform } from '../../process/memory/types.js';
+export declare function enumerateModules(platform: Platform, pid: number): Promise<{
+    success: boolean;
+    modules?: {
+        name: string;
+        baseAddress: string;
+        size: number;
+    }[];
+    error?: string;
+}>;
+//# sourceMappingURL=regions.modules.d.ts.map

package/dist/modules/process/memory/regions.modules.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"regions.modules.d.ts","sourceRoot":"","sources":["../../../../src/modules/process/memory/regions.modules.ts"],"names":[],"mappings":"AACA,OAAO,EAA2B,KAAK,QAAQ,EAAE,MAAM,+BAA+B,CAAC;AAEvF,wBAAsB,gBAAgB,CACpC,QAAQ,EAAE,QAAQ,EAClB,GAAG,EAAE,MAAM,GACV,OAAO,CAAC;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,OAAO,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAqGhH"}

package/dist/modules/process/memory/regions.modules.js

@@ -0,0 +1,104 @@
+import { logger } from '../../../utils/logger.js';
+import { executePowerShellScript } from '../../process/memory/types.js';
+export async function enumerateModules(platform, pid) {
+    if (platform !== 'win32') {
+        return { success: false, error: 'Module enumeration currently only implemented for Windows' };
+    }
+    try {
+        const psScript = `
+Add-Type @"
+using System;
+using System.Runtime.InteropServices;
+using System.Collections.Generic;
+using System.ComponentModel;
+
+public class ModuleEnumerator {
+    [DllImport("psapi.dll", SetLastError = true)]
+    public static extern bool EnumProcessModules(IntPtr hProcess, [Out] IntPtr[] lphModule, int cb, out int lpcbNeeded);
+
+    [DllImport("psapi.dll", SetLastError = true)]
+    public static extern int GetModuleBaseName(IntPtr hProcess, IntPtr hModule, [Out] System.Text.StringBuilder lpBaseName, int nSize);
+
+    [DllImport("psapi.dll", SetLastError = true)]
+    public static extern bool GetModuleInformation(IntPtr hProcess, IntPtr hModule, out MODULEINFO lpmodinfo, int cb);
+
+    [DllImport("kernel32.dll", SetLastError = true)]
+    public static extern IntPtr OpenProcess(int access, bool inherit, int pid);
+
+    [DllImport("kernel32.dll", SetLastError = true)]
+    public static extern bool CloseHandle(IntPtr handle);
+
+    const int PROCESS_QUERY_INFORMATION = 0x0400;
+    const int PROCESS_VM_READ = 0x0010;
+
+    [StructLayout(LayoutKind.Sequential)]
+    public struct MODULEINFO {
+        public IntPtr lpBaseOfDll;
+        public int SizeOfImage;
+        public IntPtr EntryPoint;
+    }
+
+    public static object Enumerate(int pid) {
+        IntPtr hProcess = OpenProcess(PROCESS_QUERY_INFORMATION | PROCESS_VM_READ, false, pid);
+        if (hProcess == IntPtr.Zero) {
+            int error = Marshal.GetLastWin32Error();
+            throw new Win32Exception(error, "Failed to open process");
+        }
+
+        try {
+            IntPtr[] modules = new IntPtr[1024];
+            int cbNeeded;
+
+            if (!EnumProcessModules(hProcess, modules, modules.Length * IntPtr.Size, out cbNeeded)) {
+                int error = Marshal.GetLastWin32Error();
+                throw new Win32Exception(error, "EnumProcessModules failed");
+            }
+
+            int numModules = cbNeeded / IntPtr.Size;
+            var result = new List<object>();
+
+            for (int i = 0; i < numModules; i++) {
+                System.Text.StringBuilder baseName = new System.Text.StringBuilder(256);
+                if (GetModuleBaseName(hProcess, modules[i], baseName, baseName.Capacity) > 0) {
+                    MODULEINFO modInfo;
+                    if (GetModuleInformation(hProcess, modules[i], out modInfo, Marshal.SizeOf(typeof(MODULEINFO)))) {
+                        result.Add(new {
+                            name = baseName.ToString(),
+                            baseAddress = "0x" + modInfo.lpBaseOfDll.ToInt64().ToString("X"),
+                            size = modInfo.SizeOfImage
+                        });
+                    }
+                }
+            }
+
+            return new { success = true, modules = result };
+        } finally {
+            CloseHandle(hProcess);
+        }
+    }
+}
+"@
+
+try {
+    $result = [ModuleEnumerator]::Enumerate(${pid})
+    $result | ConvertTo-Json -Compress -Depth 10
+} catch {
+    @{ success = $false; error = $_.Exception.Message } | ConvertTo-Json -Compress
+}
+    `;
+        const { stdout } = await executePowerShellScript(psScript, { maxBuffer: 1024 * 1024 * 10, timeout: 30000 });
+        const _trimmed = stdout.trim();
+        if (!_trimmed)
+            throw new Error('PowerShell returned empty output');
+        const result = JSON.parse(_trimmed);
+        return result;
+    }
+    catch (error) {
+        logger.error('Module enumeration failed:', error);
+        return {
+            success: false,
+            error: error instanceof Error ? error.message : 'PowerShell execution failed',
+        };
+    }
+}
+//# sourceMappingURL=regions.modules.js.map

package/dist/modules/process/memory/regions.modules.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"regions.modules.js","sourceRoot":"","sources":["../../../../src/modules/process/memory/regions.modules.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AACvC,OAAO,EAAE,uBAAuB,EAAiB,MAAM,+BAA+B,CAAC;AAEvF,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,QAAkB,EAClB,GAAW;IAEX,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;QACzB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,2DAA2D,EAAE,CAAC;IAChG,CAAC;IAED,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;8CA2EyB,GAAG;;;;;KAK5C,CAAC;QAEF,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,uBAAuB,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,GAAG,IAAI,GAAG,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;QAE5G,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;QAC/B,IAAI,CAAC,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;QACnE,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACpC,OAAO,MAAM,CAAC;IAChB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,KAAK,CAAC,4BAA4B,EAAE,KAAK,CAAC,CAAC;QAClD,OAAO;YACL,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,6BAA6B;SAC9E,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/modules/process/memory/regions.protection.d.ts

@@ -0,0 +1,3 @@
+import { type MemoryProtectionInfo, type Platform } from '../../process/memory/types.js';
+export declare function checkMemoryProtection(platform: Platform, pid: number, address: string): Promise<MemoryProtectionInfo>;
+//# sourceMappingURL=regions.protection.d.ts.map

package/dist/modules/process/memory/regions.protection.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"regions.protection.d.ts","sourceRoot":"","sources":["../../../../src/modules/process/memory/regions.protection.ts"],"names":[],"mappings":"AACA,OAAO,EAAsC,KAAK,oBAAoB,EAAE,KAAK,QAAQ,EAAE,MAAM,+BAA+B,CAAC;AAgH7H,wBAAsB,qBAAqB,CACzC,QAAQ,EAAE,QAAQ,EAClB,GAAG,EAAE,MAAM,EACX,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,oBAAoB,CAAC,CAgE/B"}

package/dist/modules/process/memory/regions.protection.js

@@ -0,0 +1,178 @@
+import { logger } from '../../../utils/logger.js';
+import { execAsync, executePowerShellScript } from '../../process/memory/types.js';
+function buildProtectionCheckScript(pid, address) {
+    return `
+Add-Type @"
+using System;
+using System.Runtime.InteropServices;
+using System.ComponentModel;
+
+public class ProtectionChecker {
+    [DllImport("kernel32.dll", SetLastError = true)]
+    public static extern IntPtr OpenProcess(int access, bool inherit, int pid);
+
+    [DllImport("kernel32.dll", SetLastError = true)]
+    public static extern int VirtualQueryEx(IntPtr hProcess, IntPtr addr, out MEMORY_BASIC_INFORMATION info, int size);
+
+    [DllImport("kernel32.dll", SetLastError = true)]
+    public static extern bool CloseHandle(IntPtr handle);
+
+    const int PROCESS_QUERY_INFORMATION = 0x0400;
+
+    [StructLayout(LayoutKind.Sequential)]
+    public struct MEMORY_BASIC_INFORMATION {
+        public IntPtr BaseAddress;
+        public IntPtr AllocationBase;
+        public uint AllocationProtect;
+        public IntPtr RegionSize;
+        public uint State;
+        public uint Protect;
+        public uint Type;
+    }
+
+    const uint MEM_COMMIT = 0x1000;
+    const uint PAGE_NOACCESS = 0x01;
+    const uint PAGE_READONLY = 0x02;
+    const uint PAGE_READWRITE = 0x04;
+    const uint PAGE_WRITECOPY = 0x08;
+    const uint PAGE_EXECUTE = 0x10;
+    const uint PAGE_EXECUTE_READ = 0x20;
+    const uint PAGE_EXECUTE_READWRITE = 0x40;
+    const uint PAGE_EXECUTE_WRITECOPY = 0x80;
+    const uint PAGE_GUARD = 0x100;
+
+    public static object CheckProtection(int pid, long address) {
+        IntPtr hProcess = OpenProcess(PROCESS_QUERY_INFORMATION, false, pid);
+        if (hProcess == IntPtr.Zero) {
+            int error = Marshal.GetLastWin32Error();
+            throw new Win32Exception(error, "Failed to open process. Run as Administrator.");
+        }
+
+        try {
+            MEMORY_BASIC_INFORMATION info;
+            int infoSize = Marshal.SizeOf(typeof(MEMORY_BASIC_INFORMATION));
+            int result = VirtualQueryEx(hProcess, (IntPtr)address, out info, infoSize);
+
+            if (result != infoSize) {
+                return new { success = false, error = "Failed to query memory region" };
+            }
+
+            if (info.State != MEM_COMMIT) {
+                return new {
+                    success = true,
+                    protection = "NOT_COMMITTED",
+                    isWritable = false,
+                    isReadable = false,
+                    isExecutable = false,
+                    regionStart = "0x" + info.BaseAddress.ToInt64().ToString("X"),
+                    regionSize = info.RegionSize.ToInt64()
+                };
+            }
+
+            uint protect = info.Protect;
+            string protectionStr = "";
+            bool isWritable = false;
+            bool isReadable = false;
+            bool isExecutable = false;
+
+            if ((protect & PAGE_NOACCESS) != 0) protectionStr += "NOACCESS ";
+            if ((protect & PAGE_READONLY) != 0) { protectionStr += "R "; isReadable = true; }
+            if ((protect & PAGE_READWRITE) != 0) { protectionStr += "RW "; isReadable = true; isWritable = true; }
+            if ((protect & PAGE_WRITECOPY) != 0) { protectionStr += "WC "; isReadable = true; isWritable = true; }
+            if ((protect & PAGE_EXECUTE) != 0) { protectionStr += "X "; isExecutable = true; }
+            if ((protect & PAGE_EXECUTE_READ) != 0) { protectionStr += "RX "; isReadable = true; isExecutable = true; }
+            if ((protect & PAGE_EXECUTE_READWRITE) != 0) { protectionStr += "RWX "; isReadable = true; isWritable = true; isExecutable = true; }
+            if ((protect & PAGE_EXECUTE_WRITECOPY) != 0) { protectionStr += "RWCX "; isReadable = true; isWritable = true; isExecutable = true; }
+            if ((protect & PAGE_GUARD) != 0) protectionStr += "GUARD ";
+
+            return new {
+                success = true,
+                protection = protectionStr.Trim(),
+                isWritable = isWritable,
+                isReadable = isReadable,
+                isExecutable = isExecutable,
+                regionStart = "0x" + info.BaseAddress.ToInt64().ToString("X"),
+                regionSize = info.RegionSize.ToInt64()
+            };
+        } finally {
+            CloseHandle(hProcess);
+        }
+    }
+}
+"@
+
+try {
+    $result = [ProtectionChecker]::CheckProtection(${pid}, ${address})
+    $result | ConvertTo-Json -Compress
+} catch {
+    @{ success = $false; error = $_.Exception.Message } | ConvertTo-Json -Compress
+}
+  `.trim();
+}
+export async function checkMemoryProtection(platform, pid, address) {
+    if (platform !== 'win32' && platform !== 'darwin') {
+        return { success: false, error: 'Memory protection check currently only implemented for Windows and macOS' };
+    }
+    if (platform === 'darwin') {
+        try {
+            const addrNum = parseInt(address, 16);
+            if (isNaN(addrNum))
+                return { success: false, error: 'Invalid address format' };
+            const { stdout } = await execAsync(`vmmap -v ${pid}`, { timeout: 15000, maxBuffer: 1024 * 1024 * 5 });
+            const regionRe = /^(\S[^\t]*?)\s{2,}([0-9a-f]+)-([0-9a-f]+)\s+\[.*?\]\s+([a-z-]+)\/([a-z-]+)/;
+            for (const line of stdout.split('\n')) {
+                const m = line.match(regionRe);
+                if (!m)
+                    continue;
+                const start = parseInt(m[2], 16);
+                const end = parseInt(m[3], 16);
+                if (addrNum >= start && addrNum < end) {
+                    const prot = m[4];
+                    return {
+                        success: true,
+                        protection: prot,
+                        isReadable: prot.includes('r'),
+                        isWritable: prot.includes('w'),
+                        isExecutable: prot.includes('x'),
+                        regionStart: `0x${m[2]}`,
+                        regionSize: end - start,
+                    };
+                }
+            }
+            return { success: false, error: `Address ${address} not found in any memory region` };
+        }
+        catch (error) {
+            return { success: false, error: error instanceof Error ? error.message : String(error) };
+        }
+    }
+    try {
+        const addrNum = parseInt(address, 16);
+        if (isNaN(addrNum)) {
+            return { success: false, error: 'Invalid address format' };
+        }
+        const psScript = buildProtectionCheckScript(pid, addrNum);
+        const { stdout } = await executePowerShellScript(psScript, { maxBuffer: 1024 * 1024, timeout: 30000 });
+        const _trimmed = stdout.trim();
+        if (!_trimmed)
+            throw new Error('PowerShell returned empty output');
+        const result = JSON.parse(_trimmed);
+        return {
+            success: result.success,
+            protection: result.protection,
+            isWritable: result.isWritable,
+            isReadable: result.isReadable,
+            isExecutable: result.isExecutable,
+            regionStart: result.regionStart,
+            regionSize: result.regionSize,
+            error: result.error,
+        };
+    }
+    catch (error) {
+        logger.error('Memory protection check failed:', error);
+        return {
+            success: false,
+            error: error instanceof Error ? error.message : 'PowerShell execution failed',
+        };
+    }
+}
+//# sourceMappingURL=regions.protection.js.map

package/dist/modules/process/memory/regions.protection.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"regions.protection.js","sourceRoot":"","sources":["../../../../src/modules/process/memory/regions.protection.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AACvC,OAAO,EAAE,SAAS,EAAE,uBAAuB,EAA4C,MAAM,+BAA+B,CAAC;AAE7H,SAAS,0BAA0B,CAAC,GAAW,EAAE,OAAe;IAC9D,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;qDAqG4C,GAAG,KAAK,OAAO;;;;;GAKjE,CAAC,IAAI,EAAE,CAAC;AACX,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,QAAkB,EAClB,GAAW,EACX,OAAe;IAEf,IAAI,QAAQ,KAAK,OAAO,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAClD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,0EAA0E,EAAE,CAAC;IAC/G,CAAC;IAED,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC1B,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;YACtC,IAAI,KAAK,CAAC,OAAO,CAAC;gBAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,wBAAwB,EAAE,CAAC;YAC/E,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,SAAS,CAAC,YAAY,GAAG,EAAE,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,GAAG,IAAI,GAAG,CAAC,EAAE,CAAC,CAAC;YACtG,MAAM,QAAQ,GAAG,4EAA4E,CAAC;YAC9F,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;gBACtC,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;gBAC/B,IAAI,CAAC,CAAC;oBAAE,SAAS;gBACjB,MAAM,KAAK,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAE,EAAE,EAAE,CAAC,CAAC;gBAClC,MAAM,GAAG,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAE,EAAE,EAAE,CAAC,CAAC;gBAChC,IAAI,OAAO,IAAI,KAAK,IAAI,OAAO,GAAG,GAAG,EAAE,CAAC;oBACtC,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC;oBACnB,OAAO;wBACL,OAAO,EAAE,IAAI;wBACb,UAAU,EAAE,IAAI;wBAChB,UAAU,EAAE,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;wBAC9B,UAAU,EAAE,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;wBAC9B,YAAY,EAAE,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;wBAChC,WAAW,EAAE,KAAK,CAAC,CAAC,CAAC,CAAE,EAAE;wBACzB,UAAU,EAAE,GAAG,GAAG,KAAK;qBACxB,CAAC;gBACJ,CAAC;YACH,CAAC;YACD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,OAAO,iCAAiC,EAAE,CAAC;QACxF,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;QAC3F,CAAC;IACH,CAAC;IAED,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;QACtC,IAAI,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;YACnB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,wBAAwB,EAAE,CAAC;QAC7D,CAAC;QAED,MAAM,QAAQ,GAAG,0BAA0B,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QAC1D,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,uBAAuB,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;QAEvG,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;QAC/B,IAAI,CAAC,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;QACnE,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACpC,OAAO;YACL,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,YAAY,EAAE,MAAM,CAAC,YAAY;YACjC,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,KAAK,EAAE,MAAM,CAAC,KAAK;SACpB,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,KAAK,CAAC,iCAAiC,EAAE,KAAK,CAAC,CAAC;QACvD,OAAO;YACL,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,6BAA6B;SAC9E,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/modules/process/memory/scanner.d.ts

@@ -0,0 +1,12 @@
+import { type Platform, type MemoryScanResult, type PatternType } from '../../process/memory/types.js';
+export declare function buildPatternBytesAndMask(pattern: string, patternType: string): {
+    patternBytes: number[];
+    mask: number[];
+};
+export declare function patternToBytesMac(pattern: string, patternType: string): number[];
+export declare function scanMemory(platform: Platform, pid: number, pattern: string, patternType?: PatternType): Promise<MemoryScanResult>;
+export declare function scanMemoryFiltered(pid: number, pattern: string, addresses: string[], patternType: PatternType | undefined, _readMemoryFn: (pid: number, address: string, size: number) => Promise<{
+    success: boolean;
+    data?: string;
+}>, scanMemoryFn: (pid: number, pattern: string, patternType: PatternType) => Promise<MemoryScanResult>): Promise<MemoryScanResult>;
+//# sourceMappingURL=scanner.d.ts.map

package/dist/modules/process/memory/scanner.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scanner.d.ts","sourceRoot":"","sources":["../../../../src/modules/process/memory/scanner.ts"],"names":[],"mappings":"AAMA,OAAO,EAGL,KAAK,QAAQ,EACb,KAAK,gBAAgB,EACrB,KAAK,WAAW,EACjB,MAAM,+BAA+B,CAAC;AAMvC,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,MAAM,EACf,WAAW,EAAE,MAAM,GAClB;IAAE,YAAY,EAAE,MAAM,EAAE,CAAC;IAAC,IAAI,EAAE,MAAM,EAAE,CAAA;CAAE,CAwE5C;AAGD,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,MAAM,EAAE,CA4ChF;AAkRD,wBAAsB,UAAU,CAC9B,QAAQ,EAAE,QAAQ,EAClB,GAAG,EAAE,MAAM,EACX,OAAO,EAAE,MAAM,EACf,WAAW,GAAE,WAAmB,GAC/B,OAAO,CAAC,gBAAgB,CAAC,CAgB3B;AAED,wBAAsB,kBAAkB,CACtC,GAAG,EAAE,MAAM,EACX,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,MAAM,EAAE,EACnB,WAAW,EAAE,WAAW,YAAQ,EAChC,aAAa,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,EAC3G,YAAY,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,WAAW,KAAK,OAAO,CAAC,gBAAgB,CAAC,GAClG,OAAO,CAAC,gBAAgB,CAAC,CAmC3B"}