@jshookmcp/jshook 0.1.7 → 0.1.9

package/dist/tests/modules/process/memory/nativeMemoryManager.test.js

@@ -0,0 +1,127 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+const state = vi.hoisted(() => {
+    const PAGE = {
+        NOACCESS: 0x01,
+        READONLY: 0x02,
+        READWRITE: 0x04,
+        WRITECOPY: 0x08,
+        EXECUTE: 0x10,
+        EXECUTE_READ: 0x20,
+        EXECUTE_READWRITE: 0x40,
+        GUARD: 0x100,
+    };
+    const MEM = {
+        COMMIT: 0x1000,
+        RESERVE: 0x2000,
+        FREE: 0x10000,
+    };
+    const MEM_TYPE = {
+        IMAGE: 0x1000000,
+        MAPPED: 0x40000,
+        PRIVATE: 0x20000,
+    };
+    return {
+        PAGE,
+        MEM,
+        MEM_TYPE,
+        openProcessForMemory: vi.fn(() => 1234),
+        CloseHandle: vi.fn(),
+        ReadProcessMemory: vi.fn(),
+        loggerError: vi.fn(),
+    };
+});
+vi.mock('@native/Win32API', () => ({
+    PAGE: state.PAGE,
+    MEM: state.MEM,
+    MEM_TYPE: state.MEM_TYPE,
+    isKoffiAvailable: vi.fn(() => true),
+    openProcessForMemory: state.openProcessForMemory,
+    CloseHandle: state.CloseHandle,
+    ReadProcessMemory: state.ReadProcessMemory,
+    WriteProcessMemory: vi.fn(),
+    VirtualQueryEx: vi.fn(),
+    VirtualProtectEx: vi.fn(),
+    VirtualAllocEx: vi.fn(),
+    CreateRemoteThread: vi.fn(),
+    GetModuleHandle: vi.fn(),
+    GetProcAddress: vi.fn(),
+    NtQueryInformationProcess: vi.fn(),
+    EnumProcessModules: vi.fn(),
+    GetModuleBaseName: vi.fn(),
+    GetModuleInformation: vi.fn(),
+}));
+vi.mock('@native/NativeMemoryManager.availability', () => ({
+    checkNativeMemoryAvailability: vi.fn(),
+}));
+vi.mock('@utils/logger', () => ({
+    logger: {
+        info: vi.fn(),
+        warn: vi.fn(),
+        error: state.loggerError,
+        debug: vi.fn(),
+    },
+}));
+import { ReadProcessMemory, VirtualQueryEx } from '../../../../src/native/Win32API.js';
+import { NativeMemoryManager, scanRegionInChunks } from '../../../../src/native/NativeMemoryManager.impl.js';
+function createChunkReader(source, baseAddress = 0n) {
+    return (address, size) => {
+        const start = Number(address - baseAddress);
+        return source.subarray(start, start + size);
+    };
+}
+describe('NativeMemoryManager chunked scanning', () => {
+    beforeEach(() => {
+        vi.clearAllMocks();
+        state.openProcessForMemory.mockReturnValue(1234);
+    });
+    it('matches patterns that span chunk boundaries without duplicates', () => {
+        const source = Buffer.from([0xaa, 0xbb, 0xcc, 0xdd, 0xaa, 0xbb, 0xcc, 0xdd]);
+        const matches = scanRegionInChunks({ baseAddress: 0n, regionSize: source.length }, [0xaa, 0xbb, 0xcc, 0xdd], [1, 1, 1, 1], createChunkReader(source), 3);
+        expect(matches).toEqual([0n, 4n]);
+    });
+    it('does not duplicate matches when overlap is zero', () => {
+        const source = Buffer.from([0xaa, 0xaa, 0xaa]);
+        const matches = scanRegionInChunks({ baseAddress: 0n, regionSize: source.length }, [0xaa], [1], createChunkReader(source), 1);
+        expect(matches).toEqual([0n, 1n, 2n]);
+    });
+    it('supports patterns longer than the chunk size', () => {
+        const source = Buffer.from([1, 2, 3, 4, 5, 6]);
+        const matches = scanRegionInChunks({ baseAddress: 0n, regionSize: source.length }, [1, 2, 3, 4, 5], [1, 1, 1, 1, 1], createChunkReader(source), 2);
+        expect(matches).toEqual([0n]);
+    });
+    it('scanMemory keeps large readable regions and reads them in chunks', async () => {
+        const hugeRegionSize = BigInt(1024 * 1024 * 1024 + 1);
+        vi.mocked(VirtualQueryEx)
+            .mockReturnValueOnce({
+            success: true,
+            info: {
+                BaseAddress: 0n,
+                AllocationBase: 0n,
+                AllocationProtect: 0x04,
+                RegionSize: hugeRegionSize,
+                State: state.MEM.COMMIT,
+                Protect: state.PAGE.READWRITE,
+                Type: state.MEM_TYPE.PRIVATE,
+            },
+        })
+            .mockReturnValueOnce({
+            success: false,
+            info: {
+                BaseAddress: hugeRegionSize,
+                AllocationBase: 0n,
+                AllocationProtect: 0,
+                RegionSize: 0n,
+                State: 0,
+                Protect: 0,
+                Type: 0,
+            },
+        });
+        vi.mocked(ReadProcessMemory).mockImplementation(() => Buffer.from([0xaa]));
+        const manager = new NativeMemoryManager();
+        const result = await manager.scanMemory(42, 'AA', 'hex');
+        expect(result.success).toBe(true);
+        expect(ReadProcessMemory).toHaveBeenCalledTimes(result.addresses.length);
+        expect(vi.mocked(ReadProcessMemory).mock.calls.length).toBeGreaterThan(1);
+        expect(state.openProcessForMemory).toHaveBeenCalledTimes(2);
+    });
+});

package/dist/tests/modules/process/memory/reader.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/tests/modules/process/memory/reader.test.js

@@ -0,0 +1,86 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+const state = vi.hoisted(() => ({
+    executePowerShellScript: vi.fn(),
+    execAsync: vi.fn(),
+    readFile: vi.fn(),
+    unlink: vi.fn(),
+    nativeReadMemory: vi.fn(),
+    isKoffiAvailable: vi.fn(),
+}));
+vi.mock('node:fs', () => ({
+    promises: {
+        readFile: state.readFile,
+        unlink: state.unlink,
+    },
+}));
+vi.mock('@src/modules/process/memory/types', () => ({
+    executePowerShellScript: state.executePowerShellScript,
+    execAsync: state.execAsync,
+}));
+vi.mock('@src/native/NativeMemoryManager', () => ({
+    nativeMemoryManager: {
+        readMemory: state.nativeReadMemory,
+    },
+}));
+vi.mock('@src/native/Win32API', () => ({
+    isKoffiAvailable: state.isKoffiAvailable,
+}));
+vi.mock('@src/utils/logger', () => ({
+    logger: {
+        info: vi.fn(),
+        warn: vi.fn(),
+        error: vi.fn(),
+        debug: vi.fn(),
+    },
+}));
+import { readMemory } from '../../../../src/modules/process/memory/reader.js';
+describe('memory/reader', () => {
+    beforeEach(() => {
+        vi.clearAllMocks();
+        state.isKoffiAvailable.mockReturnValue(false);
+    });
+    it('returns validation error for invalid address format', async () => {
+        const result = await readMemory('linux', 1, 'not-hex', 4, vi.fn());
+        expect(result.success).toBe(false);
+        expect(result.error).toContain('Invalid address format');
+    });
+    it('uses native Windows reader when koffi is available and succeeds', async () => {
+        state.isKoffiAvailable.mockReturnValue(true);
+        state.nativeReadMemory.mockResolvedValue({ success: true, data: 'AA BB' });
+        const result = await readMemory('win32', 2, '0x10', 2, vi.fn());
+        expect(result).toEqual({ success: true, data: 'AA BB' });
+        expect(state.nativeReadMemory).toHaveBeenCalledWith(2, '0x10', 2);
+        expect(state.executePowerShellScript).not.toHaveBeenCalled();
+    });
+    it('falls back to PowerShell on native Windows read failure', async () => {
+        state.isKoffiAvailable.mockReturnValue(true);
+        state.nativeReadMemory.mockResolvedValue({ success: false, error: 'native-fail' });
+        state.executePowerShellScript.mockResolvedValue({
+            stdout: '{"success":true,"data":"DE AD BE EF"}',
+            stderr: '',
+        });
+        const result = await readMemory('win32', 3, '0x20', 4, vi.fn());
+        expect(result.success).toBe(true);
+        expect(result.data).toBe('DE AD BE EF');
+    });
+    it('returns Linux privilege error when read output is empty', async () => {
+        state.execAsync.mockResolvedValue({ stdout: '', stderr: '' });
+        const result = await readMemory('linux', 4, '0x30', 8, vi.fn());
+        expect(result.success).toBe(false);
+        expect(result.error).toContain('Requires root');
+    });
+    it('returns macOS protection error when region is not readable', async () => {
+        const result = await readMemory('darwin', 5, '0x1000', 16, vi.fn().mockResolvedValue({ success: true, isReadable: false, protection: '---' }));
+        expect(result.success).toBe(false);
+        expect(result.error).toContain('not readable');
+    });
+    it('reads macOS memory dump and returns uppercase hex bytes', async () => {
+        state.execAsync.mockResolvedValue({ stdout: '16 bytes written', stderr: '' });
+        state.readFile.mockResolvedValue(Buffer.from([0xde, 0xad, 0xbe, 0xef]));
+        state.unlink.mockResolvedValue(undefined);
+        const result = await readMemory('darwin', 6, '0x2000', 4, vi.fn().mockResolvedValue({ success: true, isReadable: true }));
+        expect(result.success).toBe(true);
+        expect(result.data).toBe('DE AD BE EF');
+        expect(state.unlink).toHaveBeenCalled();
+    });
+});

package/dist/tests/modules/process/memory/regions.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/tests/modules/process/memory/regions.test.js

@@ -0,0 +1,81 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+const state = vi.hoisted(() => ({
+    executePowerShellScript: vi.fn(),
+    execAsync: vi.fn(),
+    execFileAsync: vi.fn(),
+}));
+vi.mock('@src/modules/process/memory/types', () => ({
+    executePowerShellScript: state.executePowerShellScript,
+    execAsync: state.execAsync,
+    execFileAsync: state.execFileAsync,
+}));
+vi.mock('@src/utils/logger', () => ({
+    logger: {
+        info: vi.fn(),
+        warn: vi.fn(),
+        error: vi.fn(),
+        debug: vi.fn(),
+    },
+}));
+import { dumpMemoryRegion, enumerateRegions, checkMemoryProtection, enumerateModules, } from '../../../../src/modules/process/memory/regions.js';
+describe('memory/regions', () => {
+    beforeEach(() => {
+        vi.clearAllMocks();
+        state.execAsync.mockResolvedValue({ stdout: '', stderr: '' });
+        state.execFileAsync.mockResolvedValue({ stdout: '', stderr: '' });
+        state.executePowerShellScript.mockResolvedValue({ stdout: '', stderr: '' });
+    });
+    it('rejects dumpMemoryRegion on unsupported platform', async () => {
+        const result = await dumpMemoryRegion('linux', 1, '0x10', 8, '/tmp/a.bin');
+        expect(result.success).toBe(false);
+        expect(result.error).toContain('only implemented for Windows and macOS');
+    });
+    it('validates darwin dump inputs', async () => {
+        const badAddress = await dumpMemoryRegion('darwin', 1, 'bad', 8, '/tmp/a.bin');
+        const badPid = await dumpMemoryRegion('darwin', 0, '0x10', 8, '/tmp/a.bin');
+        const badSize = await dumpMemoryRegion('darwin', 1, '0x10', 0, '/tmp/a.bin');
+        expect(badAddress.error).toContain('lldb dump failed');
+        expect(badPid.error).toBeDefined();
+        expect(badSize.error).toBeDefined();
+    });
+    it('parses successful darwin lldb dump output', async () => {
+        state.execFileAsync.mockResolvedValue({ stdout: '16 bytes written to file', stderr: '' });
+        const result = await dumpMemoryRegion('darwin', 2, '0x20', 16, '/tmp/out.bin');
+        expect(result.success).toBe(true);
+        expect(state.execFileAsync).toHaveBeenCalled();
+    });
+    it('enumerateRegions parses darwin vmmap output', async () => {
+        state.execAsync.mockResolvedValue({
+            stdout: 'MALLOC_LARGE  0000000100000000-0000000100001000 [  4K] rw-/rwx',
+            stderr: '',
+        });
+        const result = await enumerateRegions('darwin', 3);
+        expect(result.success).toBe(true);
+        expect(result.regions).toHaveLength(1);
+        expect(result.regions?.[0]?.baseAddress).toBe('0x0000000100000000');
+        expect(result.regions?.[0]?.isWritable).toBe(true);
+    });
+    it('checkMemoryProtection(darwin) returns not-found for unmatched address', async () => {
+        state.execAsync.mockResolvedValue({
+            stdout: 'STACK GUARD 0000000101000000-0000000101001000 [4K] r--/r--',
+            stderr: '',
+        });
+        const result = await checkMemoryProtection('darwin', 4, '0x20000000');
+        expect(result.success).toBe(false);
+        expect(result.error).toContain('not found');
+    });
+    it('enumerateModules rejects non-windows platform', async () => {
+        const result = await enumerateModules('darwin', 5);
+        expect(result.success).toBe(false);
+        expect(result.error).toContain('only implemented for Windows');
+    });
+    it('enumerateModules parses PowerShell JSON on windows', async () => {
+        state.executePowerShellScript.mockResolvedValue({
+            stdout: '{"success":true,"modules":[{"name":"a.dll","baseAddress":"0x1000","size":4096}]}',
+            stderr: '',
+        });
+        const result = await enumerateModules('win32', 6);
+        expect(result.success).toBe(true);
+        expect(result.modules?.[0]?.name).toBe('a.dll');
+    });
+});

package/dist/tests/modules/process/memory/scanner.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/tests/modules/process/memory/scanner.test.js

@@ -0,0 +1,155 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+const state = vi.hoisted(() => ({
+    executePowerShellScript: vi.fn(),
+    execAsync: vi.fn(),
+    writeFile: vi.fn(),
+    unlink: vi.fn(),
+    readFileSync: vi.fn(() => {
+        throw new Error('Linux memory scan not supported in test environment');
+    }),
+    nativeScanMemory: vi.fn(),
+    isKoffiAvailable: vi.fn(),
+    parseProcMaps: vi.fn(),
+}));
+vi.mock(import('node:fs'), async (importOriginal) => {
+    const actual = await importOriginal();
+    return {
+        ...actual,
+        readFileSync: state.readFileSync,
+        promises: {
+            ...actual.promises,
+            writeFile: state.writeFile,
+            unlink: state.unlink,
+        },
+    };
+});
+vi.mock('@src/modules/process/memory/types', () => ({
+    executePowerShellScript: state.executePowerShellScript,
+    execAsync: state.execAsync,
+}));
+vi.mock('@src/native/NativeMemoryManager', () => ({
+    nativeMemoryManager: {
+        scanMemory: state.nativeScanMemory,
+    },
+}));
+vi.mock('@src/native/NativeMemoryManager.utils', () => ({
+    isKoffiAvailable: state.isKoffiAvailable,
+}));
+vi.mock('@src/modules/process/memory/linux/mapsParser', () => ({
+    parseProcMaps: state.parseProcMaps,
+}));
+vi.mock('@src/utils/logger', () => ({
+    logger: {
+        info: vi.fn(),
+        warn: vi.fn(),
+        error: vi.fn(),
+        debug: vi.fn(),
+    },
+}));
+import { buildPatternBytesAndMask, patternToBytesMac, scanMemory, scanMemoryFiltered, } from '../../../../src/modules/process/memory/scanner.js';
+describe('memory/scanner', () => {
+    beforeEach(() => {
+        vi.clearAllMocks();
+    });
+    it('buildPatternBytesAndMask handles hex wildcard mask', () => {
+        const result = buildPatternBytesAndMask('AA ?? BB', 'hex');
+        expect(result.patternBytes).toEqual([0xaa, 0x00, 0xbb]);
+        expect(result.mask).toEqual([1, 0, 1]);
+    });
+    it('buildPatternBytesAndMask throws for invalid patterns', () => {
+        expect(() => buildPatternBytesAndMask('ZZ', 'hex')).toThrow('Invalid pattern');
+    });
+    it('patternToBytesMac supports int32 and string pattern types', () => {
+        const int32Bytes = patternToBytesMac('305419896', 'int32');
+        const strBytes = patternToBytesMac('AB', 'string');
+        expect(int32Bytes).toEqual({ bytes: [0x78, 0x56, 0x34, 0x12], mask: [1, 1, 1, 1] });
+        expect(strBytes).toEqual({ bytes: [65, 66], mask: [1, 1] });
+    });
+    it('scanMemory returns unsupported error on unknown platform', async () => {
+        const result = await scanMemory('unknown', 1, 'AA', 'hex');
+        expect(result.success).toBe(false);
+        expect(result.error).toContain('not supported');
+    });
+    it('scanMemory(win32) parses successful PowerShell JSON', async () => {
+        state.executePowerShellScript.mockResolvedValue({
+            stdout: '{"success":true,"addresses":["0x100","0x200"],"stats":{"patternLength":2,"resultsFound":2}}',
+            stderr: '',
+        });
+        const result = await scanMemory('win32', 2, 'AA BB', 'hex');
+        expect(result.success).toBe(true);
+        expect(result.addresses).toEqual(['0x100', '0x200']);
+        expect(result.stats?.resultsFound).toBe(2);
+    });
+    it('scanMemory(win32) returns stderr failure when PowerShell reports error', async () => {
+        state.executePowerShellScript.mockResolvedValue({
+            stdout: '{}',
+            stderr: 'Error: access denied',
+        });
+        const result = await scanMemory('win32', 2, 'AA BB', 'hex');
+        expect(result.success).toBe(false);
+        expect(result.error).toContain('Error');
+    });
+    it('scanMemoryFiltered rejects when no valid addresses provided', async () => {
+        const result = await scanMemoryFiltered(1, 'AA', ['xyz', 'qwerty'], 'hex', vi.fn(), vi.fn());
+        expect(result.success).toBe(false);
+        expect(result.error).toContain('No valid addresses');
+    });
+    it('scanMemoryFiltered keeps only matches near provided address window', async () => {
+        const result = await scanMemoryFiltered(1, 'AA', ['0x1000'], 'hex', vi.fn(), vi.fn().mockResolvedValue({
+            success: true,
+            addresses: ['0x0F50', '0x10F0', '0x2000', '0x10F0'],
+        }));
+        expect(result.success).toBe(true);
+        expect(result.addresses).toEqual(['0x0F50', '0x10F0']);
+        expect(result.stats?.resultsFound).toBe(2);
+    });
+    describe('Windows native fallback to PowerShell', () => {
+        it('falls back to PowerShell when native scan fails', async () => {
+            state.isKoffiAvailable.mockReturnValue(true);
+            state.nativeScanMemory.mockResolvedValue({
+                success: false,
+                addresses: [],
+                error: 'Native scan failed',
+            });
+            state.executePowerShellScript.mockResolvedValue({
+                stdout: '{"success":true,"addresses":["0x300"],"stats":{"patternLength":2,"resultsFound":1}}',
+                stderr: '',
+            });
+            const result = await scanMemory('win32', 1, 'AA BB', 'hex');
+            expect(result.success).toBe(true);
+            expect(result.addresses).toEqual(['0x300']);
+            expect(state.nativeScanMemory).toHaveBeenCalledWith(1, 'AA BB', 'hex');
+            expect(state.executePowerShellScript).toHaveBeenCalled();
+        });
+        it('falls back to PowerShell when native scan throws', async () => {
+            state.isKoffiAvailable.mockReturnValue(true);
+            state.nativeScanMemory.mockRejectedValue(new Error('Native crash'));
+            state.executePowerShellScript.mockResolvedValue({
+                stdout: '{"success":true,"addresses":["0x400"],"stats":{"patternLength":2,"resultsFound":1}}',
+                stderr: '',
+            });
+            const result = await scanMemory('win32', 1, 'CC DD', 'hex');
+            expect(result.success).toBe(true);
+            expect(result.addresses).toEqual(['0x400']);
+            expect(state.executePowerShellScript).toHaveBeenCalled();
+        });
+        it('skips native when koffi not available', async () => {
+            state.isKoffiAvailable.mockReturnValue(false);
+            state.executePowerShellScript.mockResolvedValue({
+                stdout: '{"success":true,"addresses":["0x500"],"stats":{"patternLength":2,"resultsFound":1}}',
+                stderr: '',
+            });
+            const result = await scanMemory('win32', 1, 'EE FF', 'hex');
+            expect(result.success).toBe(true);
+            expect(state.nativeScanMemory).not.toHaveBeenCalled();
+            expect(state.executePowerShellScript).toHaveBeenCalled();
+        });
+    });
+    describe('Linux memory scan error paths', () => {
+        it('returns not implemented error for linux platform', async () => {
+            const result = await scanMemory('linux', 1, 'AA BB', 'hex');
+            expect(result.success).toBe(false);
+            expect(result.error).toContain('not supported');
+        });
+    });
+});

package/dist/tests/modules/process/memory/writer.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/tests/modules/process/memory/writer.test.js

@@ -0,0 +1,81 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+const state = vi.hoisted(() => ({
+    executePowerShellScript: vi.fn(),
+    execAsync: vi.fn(),
+    nativeWriteMemory: vi.fn(),
+    isKoffiAvailable: vi.fn(),
+}));
+vi.mock('@src/modules/process/memory/types', () => ({
+    executePowerShellScript: state.executePowerShellScript,
+    execAsync: state.execAsync,
+}));
+vi.mock('@src/native/NativeMemoryManager', () => ({
+    nativeMemoryManager: {
+        writeMemory: state.nativeWriteMemory,
+    },
+}));
+vi.mock('@src/native/Win32API', () => ({
+    isKoffiAvailable: state.isKoffiAvailable,
+}));
+vi.mock('@src/utils/logger', () => ({
+    logger: {
+        info: vi.fn(),
+        warn: vi.fn(),
+        error: vi.fn(),
+        debug: vi.fn(),
+    },
+}));
+import { writeMemory, batchMemoryWrite } from '../../../../src/modules/process/memory/writer.js';
+describe('memory/writer', () => {
+    beforeEach(() => {
+        vi.clearAllMocks();
+        state.isKoffiAvailable.mockReturnValue(false);
+    });
+    it('returns validation error for invalid address', async () => {
+        const result = await writeMemory('linux', 1, 'nope', 'AA', 'hex', vi.fn());
+        expect(result.success).toBe(false);
+        expect(result.error).toContain('Invalid address format');
+    });
+    it('uses native Windows writer when koffi path succeeds', async () => {
+        state.isKoffiAvailable.mockReturnValue(true);
+        state.nativeWriteMemory.mockResolvedValue({ success: true, bytesWritten: 4 });
+        const result = await writeMemory('win32', 2, '0x10', 'DEADBEEF', 'hex', vi.fn());
+        expect(result.success).toBe(true);
+        expect(state.nativeWriteMemory).toHaveBeenCalledWith(2, '0x10', 'DEADBEEF', 'hex');
+        expect(state.executePowerShellScript).not.toHaveBeenCalled();
+    });
+    it('falls back to PowerShell when native Windows writer fails', async () => {
+        state.isKoffiAvailable.mockReturnValue(true);
+        state.nativeWriteMemory.mockResolvedValue({ success: false, error: 'native-fail' });
+        state.executePowerShellScript.mockResolvedValue({
+            stdout: '{"success":true,"bytesWritten":4}',
+            stderr: '',
+        });
+        const result = await writeMemory('win32', 3, '0x20', 'DE AD BE EF', 'hex', vi.fn());
+        expect(result.success).toBe(true);
+        expect(result.bytesWritten).toBe(4);
+    });
+    it('returns macOS protection error when region is not writable', async () => {
+        const result = await writeMemory('darwin', 4, '0x3000', '90', 'hex', vi.fn().mockResolvedValue({ success: true, isWritable: false, protection: 'r--' }));
+        expect(result.success).toBe(false);
+        expect(result.error).toContain('not writable');
+    });
+    it('returns unsupported-platform error for unknown targets', async () => {
+        const result = await writeMemory('unknown', 4, '0x3000', '90', 'hex', vi.fn());
+        expect(result.success).toBe(false);
+        expect(result.error).toContain('not supported');
+    });
+    it('batchMemoryWrite aggregates per-patch results and error summary', async () => {
+        const writeFn = vi
+            .fn()
+            .mockResolvedValueOnce({ success: true })
+            .mockResolvedValueOnce({ success: false, error: 'denied' });
+        const result = await batchMemoryWrite(10, [
+            { address: '0x10', data: '90' },
+            { address: '0x20', data: '91' },
+        ], writeFn);
+        expect(result.success).toBe(false);
+        expect(result.results).toHaveLength(2);
+        expect(result.error).toContain('Failed to write 1 of 2 patches');
+    });
+});

package/dist/tests/modules/process/memoryUtils.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/tests/modules/process/memoryUtils.test.js

@@ -0,0 +1,101 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+const { scanMemoryMock, dumpMemoryRegionMock, enumerateRegionsMock, checkMemoryProtectionMock, scanMemoryFilteredMock, batchMemoryWriteMock, startMemoryMonitorMock, stopMemoryMonitorMock, injectDllMock, injectShellcodeMock, checkDebugPortMock, enumerateModulesMock, MemoryManagerMock, } = vi.hoisted(() => {
+    const scanMemoryMock = vi.fn();
+    const dumpMemoryRegionMock = vi.fn();
+    const enumerateRegionsMock = vi.fn();
+    const checkMemoryProtectionMock = vi.fn();
+    const scanMemoryFilteredMock = vi.fn();
+    const batchMemoryWriteMock = vi.fn();
+    const startMemoryMonitorMock = vi.fn(() => 'monitor-1');
+    const stopMemoryMonitorMock = vi.fn(() => true);
+    const injectDllMock = vi.fn();
+    const injectShellcodeMock = vi.fn();
+    const checkDebugPortMock = vi.fn();
+    const enumerateModulesMock = vi.fn();
+    class MemoryManagerMock {
+        scanMemory = scanMemoryMock;
+        dumpMemoryRegion = dumpMemoryRegionMock;
+        enumerateRegions = enumerateRegionsMock;
+        checkMemoryProtection = checkMemoryProtectionMock;
+        scanMemoryFiltered = scanMemoryFilteredMock;
+        batchMemoryWrite = batchMemoryWriteMock;
+        startMemoryMonitor = startMemoryMonitorMock;
+        stopMemoryMonitor = stopMemoryMonitorMock;
+        injectDll = injectDllMock;
+        injectShellcode = injectShellcodeMock;
+        checkDebugPort = checkDebugPortMock;
+        enumerateModules = enumerateModulesMock;
+    }
+    return {
+        scanMemoryMock,
+        dumpMemoryRegionMock,
+        enumerateRegionsMock,
+        checkMemoryProtectionMock,
+        scanMemoryFilteredMock,
+        batchMemoryWriteMock,
+        startMemoryMonitorMock,
+        stopMemoryMonitorMock,
+        injectDllMock,
+        injectShellcodeMock,
+        checkDebugPortMock,
+        enumerateModulesMock,
+        MemoryManagerMock,
+    };
+});
+vi.mock('@src/modules/process/MemoryManager', () => ({
+    MemoryManager: MemoryManagerMock,
+}));
+import * as memoryUtils from '../../../src/modules/process/memoryUtils.js';
+describe('memoryUtils wrappers', () => {
+    beforeEach(() => {
+        vi.clearAllMocks();
+    });
+    it('scanMemory wrapper delegates with default pattern type', async () => {
+        scanMemoryMock.mockResolvedValue({ success: true, addresses: ['0x1'] });
+        const result = await memoryUtils.scanMemory(1, 'AA BB');
+        expect(result.success).toBe(true);
+        expect(scanMemoryMock).toHaveBeenCalledWith(1, 'AA BB', 'hex');
+    });
+    it('dumpMemory/listMemoryRegions/checkProtection wrappers delegate correctly', async () => {
+        dumpMemoryRegionMock.mockResolvedValue({ success: true });
+        enumerateRegionsMock.mockResolvedValue({ success: true, regions: [] });
+        checkMemoryProtectionMock.mockResolvedValue({ success: true, isReadable: true });
+        await memoryUtils.dumpMemory(2, '0x1000', 16, '/tmp/a.bin');
+        await memoryUtils.listMemoryRegions(2);
+        await memoryUtils.checkProtection(2, '0x1000');
+        expect(dumpMemoryRegionMock).toHaveBeenCalledWith(2, '0x1000', 16, '/tmp/a.bin');
+        expect(enumerateRegionsMock).toHaveBeenCalledWith(2);
+        expect(checkMemoryProtectionMock).toHaveBeenCalledWith(2, '0x1000');
+    });
+    it('scanFiltered and batchWrite wrappers delegate', async () => {
+        scanMemoryFilteredMock.mockResolvedValue({ success: true, addresses: [] });
+        batchMemoryWriteMock.mockResolvedValue({ success: true, results: [] });
+        await memoryUtils.scanFiltered(3, 'AA', ['0x10'], 'hex');
+        await memoryUtils.batchWrite(3, [{ address: '0x10', data: '90' }]);
+        expect(scanMemoryFilteredMock).toHaveBeenCalledWith(3, 'AA', ['0x10'], 'hex');
+        expect(batchMemoryWriteMock).toHaveBeenCalledWith(3, [{ address: '0x10', data: '90' }]);
+    });
+    it('startMonitor/stopMonitor wrappers delegate and return values', () => {
+        const onChange = vi.fn();
+        const id = memoryUtils.startMonitor(4, '0x20', 8, 500, onChange);
+        const stopped = memoryUtils.stopMonitor(id);
+        expect(id).toBe('monitor-1');
+        expect(stopped).toBe(true);
+        expect(startMemoryMonitorMock).toHaveBeenCalledWith(4, '0x20', 8, 500, onChange);
+        expect(stopMemoryMonitorMock).toHaveBeenCalledWith('monitor-1');
+    });
+    it('injection/debug/module wrappers delegate', async () => {
+        injectDllMock.mockResolvedValue({ success: true });
+        injectShellcodeMock.mockResolvedValue({ success: true });
+        checkDebugPortMock.mockResolvedValue({ success: true, isDebugged: false });
+        enumerateModulesMock.mockResolvedValue({ success: true, modules: [] });
+        await memoryUtils.injectDll(5, 'a.dll');
+        await memoryUtils.injectShellcode(5, '90', 'hex');
+        await memoryUtils.checkDebugPort(5);
+        await memoryUtils.enumerateModules(5);
+        expect(injectDllMock).toHaveBeenCalledWith(5, 'a.dll');
+        expect(injectShellcodeMock).toHaveBeenCalledWith(5, '90', 'hex');
+        expect(checkDebugPortMock).toHaveBeenCalledWith(5);
+        expect(enumerateModulesMock).toHaveBeenCalledWith(5);
+    });
+});

package/dist/tests/modules/security/ExecutionSandbox.test.d.ts

@@ -0,0 +1 @@
+export {};