@jshookmcp/jshook 0.1.8 → 0.1.9

package/dist/src/modules/process/memory/availability.js

@@ -0,0 +1,168 @@
+import { executePowerShellScript, execAsync } from '../../process/memory/types.js';
+const WINDOWS_CACHE_TTL_MS = 45_000;
+let windowsAvailabilityCache = null;
+function getExecErrorStream(error, key) {
+    if (typeof error !== 'object' || error === null)
+        return '';
+    const stream = error[key];
+    return typeof stream === 'string' ? stream : '';
+}
+function getWindowsAvailabilityFailureReason(error) {
+    const errorMessage = error instanceof Error ? error.message : String(error);
+    const stderr = getExecErrorStream(error, 'stderr');
+    const combined = `${errorMessage}\n${stderr}`.toLowerCase();
+    if (combined.includes('enoent') ||
+        combined.includes('command not found') ||
+        combined.includes('is not recognized as an internal or external command') ||
+        (combined.includes('cannot find') && combined.includes('powershell'))) {
+        return 'PowerShell is unavailable. Windows memory operations require powershell.exe to verify Administrator privileges.';
+    }
+    return `PowerShell command execution failed while checking Administrator privileges: ${errorMessage}`;
+}
+async function runWindowsAdminAvailabilityCheck() {
+    try {
+        const { stdout } = await executePowerShellScript('([Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)', { timeout: 5000 });
+        const normalizedOutput = stdout.trim().toLowerCase();
+        if (normalizedOutput === 'true') {
+            return { available: true };
+        }
+        if (normalizedOutput === 'false') {
+            return {
+                available: false,
+                reason: 'Windows memory operations require Administrator privileges. Please run your terminal/IDE as Administrator and retry.',
+            };
+        }
+        return {
+            available: false,
+            reason: `PowerShell command execution failed while checking Administrator privileges: unexpected output "${stdout.trim() || '(empty)'}".`,
+        };
+    }
+    catch (error) {
+        return {
+            available: false,
+            reason: getWindowsAvailabilityFailureReason(error),
+        };
+    }
+}
+async function checkWindowsAvailability() {
+    const now = Date.now();
+    if (windowsAvailabilityCache && windowsAvailabilityCache.expiresAt > now) {
+        return windowsAvailabilityCache.result;
+    }
+    const result = await runWindowsAdminAvailabilityCheck();
+    windowsAvailabilityCache = { expiresAt: now + WINDOWS_CACHE_TTL_MS, result };
+    return result;
+}
+export async function checkAvailability(platform) {
+    switch (platform) {
+        case 'win32':
+            return checkWindowsAvailability();
+        case 'linux':
+            try {
+                const { stdout } = await execAsync('id -u', { timeout: 2000 });
+                if (stdout.trim() === '0') {
+                    return { available: true };
+                }
+                try {
+                    await execAsync('capsh --print 2>/dev/null | grep -q "cap_sys_ptrace"', { timeout: 2000 });
+                    return { available: true };
+                }
+                catch {
+                    return {
+                        available: false,
+                        reason: 'Linux memory operations require root privileges or CAP_SYS_PTRACE capability. Run with sudo.',
+                    };
+                }
+            }
+            catch {
+                return { available: false, reason: 'Requires root privileges for /proc/pid/mem access. Run with sudo.' };
+            }
+        case 'darwin':
+            try {
+                await execAsync('which lldb', { timeout: 3000 });
+                const isRoot = process.getuid?.() === 0;
+                return {
+                    available: true,
+                    reason: isRoot
+                        ? undefined
+                        : 'Running without root — memory access works for own processes only. Use sudo for other processes.',
+                };
+            }
+            catch {
+                return {
+                    available: false,
+                    reason: 'lldb not found. Install Xcode Command Line Tools: xcode-select --install',
+                };
+            }
+        default:
+            return { available: false, reason: `Platform ${platform} not supported for memory operations.` };
+    }
+}
+export async function checkDebugPort(platform, pid) {
+    if (platform !== 'win32') {
+        return { success: false, error: 'Debug port check currently only implemented for Windows' };
+    }
+    try {
+        const psScript = `
+Add-Type @"
+using System;
+using System.Runtime.InteropServices;
+using System.ComponentModel;
+
+public class DebugChecker {
+    [DllImport("ntdll.dll")]
+    public static extern int NtQueryInformationProcess(IntPtr processHandle, int processInformationClass, out IntPtr processInformation, int processInformationLength, out int returnLength);
+
+    [DllImport("kernel32.dll", SetLastError = true)]
+    public static extern IntPtr OpenProcess(int access, bool inherit, int pid);
+
+    [DllImport("kernel32.dll", SetLastError = true)]
+    public static extern bool CloseHandle(IntPtr handle);
+
+    const int PROCESS_QUERY_INFORMATION = 0x0400;
+    const int ProcessDebugPort = 7;
+
+    public static object Check(int pid) {
+        IntPtr hProcess = OpenProcess(PROCESS_QUERY_INFORMATION, false, pid);
+        if (hProcess == IntPtr.Zero) {
+            int error = Marshal.GetLastWin32Error();
+            throw new Win32Exception(error, "Failed to open process");
+        }
+
+        try {
+            IntPtr debugPort;
+            int returnLength;
+            int status = NtQueryInformationProcess(hProcess, ProcessDebugPort, out debugPort, IntPtr.Size, out returnLength);
+
+            if (status != 0) {
+                return new { success = false, error = "NtQueryInformationProcess failed with status: 0x" + status.ToString("X") };
+            }
+
+            return new { success = true, isDebugged = debugPort != IntPtr.Zero };
+        } finally {
+            CloseHandle(hProcess);
+        }
+    }
+}
+"@
+
+try {
+    $result = [DebugChecker]::Check(${pid})
+    $result | ConvertTo-Json -Compress
+} catch {
+    @{ success = $false; error = $_.Exception.Message } | ConvertTo-Json -Compress
+}
+    `;
+        const { stdout } = await executePowerShellScript(psScript, { maxBuffer: 1024 * 1024, timeout: 10000 });
+        const _trimmed = stdout.trim();
+        if (!_trimmed)
+            throw new Error('PowerShell returned empty output');
+        return JSON.parse(_trimmed);
+    }
+    catch (error) {
+        return {
+            success: false,
+            error: error instanceof Error ? error.message : 'PowerShell execution failed',
+        };
+    }
+}

package/dist/src/modules/process/memory/injector.js

@@ -0,0 +1,251 @@
+import { logger } from '../../../utils/logger.js';
+import { executePowerShellScript } from '../../process/memory/types.js';
+function buildDllInjectionScript(pid, dllPath) {
+    return `
+Add-Type @"
+using System;
+using System.Runtime.InteropServices;
+using System.ComponentModel;
+using System.IO;
+
+public class DllInjector {
+    [DllImport("kernel32.dll", SetLastError = true)]
+    public static extern IntPtr OpenProcess(int access, bool inherit, int pid);
+
+    [DllImport("kernel32.dll", SetLastError = true)]
+    public static extern IntPtr VirtualAllocEx(IntPtr hProcess, IntPtr addr, int size, int allocType, int protect);
+
+    [DllImport("kernel32.dll", SetLastError = true)]
+    public static extern bool WriteProcessMemory(IntPtr hProcess, IntPtr addr, byte[] buffer, int size, out int written);
+
+    [DllImport("kernel32.dll", SetLastError = true)]
+    public static extern IntPtr CreateRemoteThread(IntPtr hProcess, IntPtr attr, int stackSize, IntPtr startAddr, IntPtr param, int flags, out int threadId);
+
+    [DllImport("kernel32.dll", SetLastError = true)]
+    public static extern IntPtr GetModuleHandle(string name);
+
+    [DllImport("kernel32.dll", SetLastError = true)]
+    public static extern IntPtr GetProcAddress(IntPtr hModule, string name);
+
+    [DllImport("kernel32.dll", SetLastError = true)]
+    public static extern bool CloseHandle(IntPtr handle);
+
+    [DllImport("kernel32.dll", SetLastError = true)]
+    public static extern bool VirtualFreeEx(IntPtr hProcess, IntPtr addr, int size, int freeType);
+
+    const int PROCESS_CREATE_THREAD = 0x0002;
+    const int PROCESS_QUERY_INFORMATION = 0x0400;
+    const int PROCESS_VM_OPERATION = 0x0008;
+    const int PROCESS_VM_WRITE = 0x0020;
+    const int MEM_COMMIT = 0x1000;
+    const int MEM_RESERVE = 0x2000;
+    const int PAGE_READWRITE = 0x04;
+    const int MEM_RELEASE = 0x8000;
+
+    public static object Inject(int pid, string dllPath) {
+        if (!File.Exists(dllPath)) {
+            return new { success = false, error = "DLL not found: " + dllPath };
+        }
+
+        IntPtr hProcess = OpenProcess(PROCESS_CREATE_THREAD | PROCESS_QUERY_INFORMATION | PROCESS_VM_OPERATION | PROCESS_VM_WRITE, false, pid);
+        if (hProcess == IntPtr.Zero) {
+            int error = Marshal.GetLastWin32Error();
+            throw new Win32Exception(error, "Failed to open process. Run as Administrator.");
+        }
+
+        try {
+            byte[] dllBytes = System.Text.Encoding.ASCII.GetBytes(dllPath + "\\0");
+            IntPtr remoteMem = VirtualAllocEx(hProcess, IntPtr.Zero, dllBytes.Length, MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE);
+            if (remoteMem == IntPtr.Zero) {
+                int error = Marshal.GetLastWin32Error();
+                throw new Win32Exception(error, "Failed to allocate memory in target");
+            }
+
+            try {
+                int written;
+                if (!WriteProcessMemory(hProcess, remoteMem, dllBytes, dllBytes.Length, out written)) {
+                    int error = Marshal.GetLastWin32Error();
+                    throw new Win32Exception(error, "Failed to write DLL path to target");
+                }
+
+                IntPtr hKernel32 = GetModuleHandle("kernel32.dll");
+                IntPtr loadLibraryAddr = GetProcAddress(hKernel32, "LoadLibraryA");
+                if (loadLibraryAddr == IntPtr.Zero) {
+                    throw new Exception("Failed to get LoadLibraryA address");
+                }
+
+                int threadId;
+                IntPtr hThread = CreateRemoteThread(hProcess, IntPtr.Zero, 0, loadLibraryAddr, remoteMem, 0, out threadId);
+                if (hThread == IntPtr.Zero) {
+                    int error = Marshal.GetLastWin32Error();
+                    throw new Win32Exception(error, "Failed to create remote thread");
+                }
+
+                CloseHandle(hThread);
+                return new { success = true, remoteThreadId = threadId };
+            } finally {
+                VirtualFreeEx(hProcess, remoteMem, 0, MEM_RELEASE);
+            }
+        } finally {
+            CloseHandle(hProcess);
+        }
+    }
+}
+"@
+
+try {
+    $result = [DllInjector]::Inject(${pid}, "${dllPath.replace(/\\/g, '\\\\').replace(/"/g, '`"').replace(/`/g, '``').replace(/\$/g, '`$')}")
+    $result | ConvertTo-Json -Compress
+} catch {
+    @{ success = $false; error = $_.Exception.Message } | ConvertTo-Json -Compress
+}
+  `.trim();
+}
+export async function injectDll(platform, pid, dllPath) {
+    if (platform !== 'win32') {
+        return { success: false, error: 'DLL injection currently only implemented for Windows' };
+    }
+    try {
+        const psScript = buildDllInjectionScript(pid, dllPath);
+        const { stdout } = await executePowerShellScript(psScript, { maxBuffer: 1024 * 1024, timeout: 30000 });
+        const _trimmed = stdout.trim();
+        if (!_trimmed)
+            throw new Error('PowerShell returned empty output');
+        const result = JSON.parse(_trimmed);
+        return {
+            success: result.success,
+            remoteThreadId: result.remoteThreadId,
+            error: result.error,
+        };
+    }
+    catch (error) {
+        logger.error('DLL injection failed:', error);
+        return {
+            success: false,
+            error: error instanceof Error ? error.message : 'PowerShell execution failed',
+        };
+    }
+}
+function buildShellcodeInjectionScript(pid, shellcode) {
+    return `
+Add-Type @"
+using System;
+using System.Runtime.InteropServices;
+using System.ComponentModel;
+
+public class ShellcodeInjector {
+    [DllImport("kernel32.dll", SetLastError = true)]
+    public static extern IntPtr OpenProcess(int access, bool inherit, int pid);
+
+    [DllImport("kernel32.dll", SetLastError = true)]
+    public static extern IntPtr VirtualAllocEx(IntPtr hProcess, IntPtr addr, int size, int allocType, int protect);
+
+    [DllImport("kernel32.dll", SetLastError = true)]
+    public static extern bool WriteProcessMemory(IntPtr hProcess, IntPtr addr, byte[] buffer, int size, out int written);
+
+    [DllImport("kernel32.dll", SetLastError = true)]
+    public static extern IntPtr CreateRemoteThread(IntPtr hProcess, IntPtr attr, int stackSize, IntPtr startAddr, IntPtr param, int flags, out int threadId);
+
+    [DllImport("kernel32.dll", SetLastError = true)]
+    public static extern bool CloseHandle(IntPtr handle);
+
+    [DllImport("kernel32.dll", SetLastError = true)]
+    public static extern bool VirtualProtectEx(IntPtr hProcess, IntPtr addr, int size, int newProtect, out int oldProtect);
+
+    const int PROCESS_CREATE_THREAD = 0x0002;
+    const int PROCESS_QUERY_INFORMATION = 0x0400;
+    const int PROCESS_VM_OPERATION = 0x0008;
+    const int PROCESS_VM_WRITE = 0x0020;
+    const int MEM_COMMIT = 0x1000;
+    const int MEM_RESERVE = 0x2000;
+    const int PAGE_READWRITE = 0x04;
+    const int PAGE_EXECUTE_READWRITE = 0x40;
+
+    public static object Inject(int pid, byte[] shellcode) {
+        IntPtr hProcess = OpenProcess(PROCESS_CREATE_THREAD | PROCESS_QUERY_INFORMATION | PROCESS_VM_OPERATION | PROCESS_VM_WRITE, false, pid);
+        if (hProcess == IntPtr.Zero) {
+            int error = Marshal.GetLastWin32Error();
+            throw new Win32Exception(error, "Failed to open process. Run as Administrator.");
+        }
+
+        try {
+            IntPtr remoteMem = VirtualAllocEx(hProcess, IntPtr.Zero, shellcode.Length, MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE);
+            if (remoteMem == IntPtr.Zero) {
+                int error = Marshal.GetLastWin32Error();
+                throw new Win32Exception(error, "Failed to allocate memory in target");
+            }
+
+            try {
+                int written;
+                if (!WriteProcessMemory(hProcess, remoteMem, shellcode, shellcode.Length, out written)) {
+                    int error = Marshal.GetLastWin32Error();
+                    throw new Win32Exception(error, "Failed to write shellcode to target");
+                }
+
+                int oldProtect;
+                if (!VirtualProtectEx(hProcess, remoteMem, shellcode.Length, PAGE_EXECUTE_READWRITE, out oldProtect)) {
+                    int error = Marshal.GetLastWin32Error();
+                    throw new Win32Exception(error, "Failed to change memory protection to executable");
+                }
+
+                int threadId;
+                IntPtr hThread = CreateRemoteThread(hProcess, IntPtr.Zero, 0, remoteMem, IntPtr.Zero, 0, out threadId);
+                if (hThread == IntPtr.Zero) {
+                    int error = Marshal.GetLastWin32Error();
+                    throw new Win32Exception(error, "Failed to create remote thread");
+                }
+
+                CloseHandle(hThread);
+                return new { success = true, remoteThreadId = threadId };
+            } finally {
+                // Note: Memory is not freed to allow shellcode to execute
+            }
+        } finally {
+            CloseHandle(hProcess);
+        }
+    }
+}
+"@
+
+try {
+    $shellcode = @(${Array.from(shellcode).join(',')})
+    $result = [ShellcodeInjector]::Inject(${pid}, $shellcode)
+    $result | ConvertTo-Json -Compress
+} catch {
+    @{ success = $false; error = $_.Exception.Message } | ConvertTo-Json -Compress
+}
+  `.trim();
+}
+export async function injectShellcode(platform, pid, shellcode, encoding = 'hex') {
+    if (platform !== 'win32') {
+        return { success: false, error: 'Shellcode injection currently only implemented for Windows' };
+    }
+    try {
+        let shellcodeBytes;
+        if (encoding === 'base64') {
+            shellcodeBytes = Buffer.from(shellcode, 'base64');
+        }
+        else {
+            const cleanHex = shellcode.replace(/\s/g, '');
+            shellcodeBytes = Buffer.from(cleanHex, 'hex');
+        }
+        const psScript = buildShellcodeInjectionScript(pid, shellcodeBytes);
+        const { stdout } = await executePowerShellScript(psScript, { maxBuffer: 1024 * 1024, timeout: 30000 });
+        const _trimmed = stdout.trim();
+        if (!_trimmed)
+            throw new Error('PowerShell returned empty output');
+        const result = JSON.parse(_trimmed);
+        return {
+            success: result.success,
+            remoteThreadId: result.remoteThreadId,
+            error: result.error,
+        };
+    }
+    catch (error) {
+        logger.error('Shellcode injection failed:', error);
+        return {
+            success: false,
+            error: error instanceof Error ? error.message : 'PowerShell execution failed',
+        };
+    }
+}

package/dist/src/modules/process/memory/reader.js

@@ -0,0 +1,171 @@
+import { promises as fs } from 'node:fs';
+import { logger } from '../../../utils/logger.js';
+import { nativeMemoryManager } from '../../../native/NativeMemoryManager.js';
+import { isKoffiAvailable } from '../../../native/Win32API.js';
+import { execAsync, executePowerShellScript, } from '../../process/memory/types.js';
+async function readMemoryWindows(pid, address, size) {
+    try {
+        const psScript = `
+        Add-Type @"
+          using System;
+          using System.Runtime.InteropServices;
+          using System.ComponentModel;
+
+          public class MemoryReader {
+            [DllImport("kernel32.dll", SetLastError = true)]
+            public static extern IntPtr OpenProcess(int access, bool inherit, int pid);
+
+            [DllImport("kernel32.dll", SetLastError = true)]
+            public static extern bool ReadProcessMemory(IntPtr hProcess, IntPtr addr, byte[] buffer, int size, out int read);
+
+            [DllImport("kernel32.dll", SetLastError = true)]
+            public static extern bool CloseHandle(IntPtr handle);
+
+            const int PROCESS_VM_READ = 0x0010;
+            const int PROCESS_QUERY_INFORMATION = 0x0400;
+
+            public static string ReadMemory(int pid, long address, int size) {
+              IntPtr hProcess = OpenProcess(PROCESS_VM_READ | PROCESS_QUERY_INFORMATION, false, pid);
+              if (hProcess == IntPtr.Zero) {
+                int error = Marshal.GetLastWin32Error();
+                throw new Win32Exception(error, "Failed to open process. Run as Administrator.");
+              }
+
+              try {
+                byte[] buffer = new byte[size];
+                int bytesRead;
+                bool success = ReadProcessMemory(hProcess, (IntPtr)address, buffer, size, out bytesRead);
+
+                if (!success) {
+                  int error = Marshal.GetLastWin32Error();
+                  throw new Win32Exception(error, "Failed to read memory");
+                }
+
+                return BitConverter.ToString(buffer, 0, bytesRead).Replace("-", " ");
+              } finally {
+                CloseHandle(hProcess);
+              }
+            }
+          }
+"@
+
+        try {
+          $result = [MemoryReader]::ReadMemory(${pid}, ${address}, ${size})
+          @{ success = $true; data = $result } | ConvertTo-Json -Compress
+        } catch {
+          @{ success = $false; error = $_.Exception.Message } | ConvertTo-Json -Compress
+        }
+      `;
+        const { stdout } = await executePowerShellScript(psScript, { maxBuffer: 1024 * 1024 * 10 });
+        const _trimmed = stdout.trim();
+        if (!_trimmed)
+            throw new Error('PowerShell returned empty output');
+        const result = JSON.parse(_trimmed);
+        return {
+            success: result.success,
+            data: result.data,
+            error: result.error,
+        };
+    }
+    catch (error) {
+        logger.error('Windows memory read failed:', error);
+        return {
+            success: false,
+            error: error instanceof Error ? error.message : 'PowerShell execution failed. Run as Administrator.',
+        };
+    }
+}
+async function readMemoryLinux(pid, address, size) {
+    try {
+        const { stdout } = await execAsync(`sudo dd if=/proc/${pid}/mem bs=1 skip=${address} count=${size} 2>/dev/null | xxd -p | tr -d '\\n' || echo ""`, { maxBuffer: 1024 * 1024 * 10, timeout: 10000 });
+        if (!stdout.trim()) {
+            return {
+                success: false,
+                error: 'Failed to read memory. Requires root privileges or ptrace access.',
+            };
+        }
+        const hexData = stdout.trim().match(/.{1,2}/g)?.join(' ') || stdout.trim();
+        return {
+            success: true,
+            data: hexData.toUpperCase(),
+        };
+    }
+    catch (error) {
+        logger.error('Linux memory read failed:', error);
+        return {
+            success: false,
+            error: 'Memory read failed. Run as root or use ptrace.',
+        };
+    }
+}
+async function readMemoryMac(pid, address, size, checkProtectionFn) {
+    if (address === 0) {
+        return { success: false, error: 'Invalid address: null pointer (0x0)' };
+    }
+    const MAX_READ_SIZE = 16 * 1024 * 1024;
+    if (size <= 0 || size > MAX_READ_SIZE) {
+        return { success: false, error: `Invalid size: must be 1–${MAX_READ_SIZE} bytes` };
+    }
+    const addrHex = `0x${address.toString(16)}`;
+    const prot = await checkProtectionFn(pid, addrHex);
+    if (!prot.success) {
+        return { success: false, error: `Cannot verify memory region: ${prot.error}` };
+    }
+    if (!prot.isReadable) {
+        return { success: false, error: `Address ${addrHex} is not readable (protection: ${prot.protection ?? 'unknown'})` };
+    }
+    const tmpFile = `/tmp/mread_${pid}_${Date.now()}.bin`;
+    try {
+        const { stdout } = await execAsync(`lldb --batch -p ${pid} -o "memory read --outfile ${tmpFile} --binary ${addrHex} -c ${size}" -o "process detach"`, { timeout: 15000, maxBuffer: 1024 * 1024 * 10 });
+        if (!stdout.includes('bytes written')) {
+            const errLine = stdout.split('\n').find(l => l.includes('error:')) ?? stdout;
+            return { success: false, error: `lldb memory read failed: ${errLine.trim()}` };
+        }
+        const data = await fs.readFile(tmpFile);
+        const hex = Array.from(data)
+            .map(b => b.toString(16).padStart(2, '0').toUpperCase())
+            .join(' ');
+        return { success: true, data: hex };
+    }
+    catch (error) {
+        return { success: false, error: error instanceof Error ? error.message : String(error) };
+    }
+    finally {
+        await fs.unlink(tmpFile).catch(() => { });
+    }
+}
+export async function readMemory(platform, pid, address, size, checkProtectionFn) {
+    try {
+        const addrNum = parseInt(address, 16);
+        if (isNaN(addrNum)) {
+            return { success: false, error: 'Invalid address format. Use hex like "0x12345678"' };
+        }
+        if (platform === 'win32' && isKoffiAvailable()) {
+            try {
+                const result = await nativeMemoryManager.readMemory(pid, address, size);
+                if (result.success) {
+                    logger.debug('Native memory read succeeded');
+                    return result;
+                }
+                logger.warn('Native memory read failed, falling back to PowerShell:', result.error);
+            }
+            catch (nativeError) {
+                logger.warn('Native memory read error, falling back to PowerShell:', nativeError);
+            }
+        }
+        switch (platform) {
+            case 'win32':
+                return readMemoryWindows(pid, addrNum, size);
+            case 'linux':
+                return readMemoryLinux(pid, addrNum, size);
+            case 'darwin':
+                return readMemoryMac(pid, addrNum, size, checkProtectionFn);
+            default:
+                return { success: false, error: `Memory operations not supported on platform: ${platform}` };
+        }
+    }
+    catch (error) {
+        logger.error('Memory read failed:', error);
+        return { success: false, error: error instanceof Error ? error.message : String(error) };
+    }
+}

package/dist/src/modules/process/memory/scanner.d.ts

@@ -0,0 +1,7 @@
+import type { Platform, MemoryScanResult, PatternType } from '../../process/memory/types.js';
+export { buildPatternBytesAndMask, patternToBytesMac } from './scanner.patterns.js';
+export declare function scanMemory(platform: Platform, pid: number, pattern: string, patternType?: PatternType): Promise<MemoryScanResult>;
+export declare function scanMemoryFiltered(pid: number, pattern: string, addresses: string[], patternType: PatternType | undefined, _readMemoryFn: (pid: number, address: string, size: number) => Promise<{
+    success: boolean;
+    data?: string;
+}>, scanMemoryFn: (pid: number, pattern: string, patternType: PatternType) => Promise<MemoryScanResult>): Promise<MemoryScanResult>;

package/dist/src/modules/process/memory/scanner.darwin.d.ts

@@ -0,0 +1,2 @@
+import type { MemoryScanResult } from '../../process/memory/types.js';
+export declare function scanMemoryMac(pid: number, pattern: string, patternType: string): Promise<MemoryScanResult>;

package/dist/src/modules/process/memory/scanner.darwin.js

@@ -0,0 +1,87 @@
+import { promises as fs } from 'node:fs';
+import { execAsync } from '../../process/memory/types.js';
+import { patternToBytesMac } from './scanner.patterns.js';
+export async function scanMemoryMac(pid, pattern, patternType) {
+    let patternBytes;
+    let patternMask;
+    try {
+        const result = patternToBytesMac(pattern, patternType);
+        patternBytes = result.bytes;
+        patternMask = result.mask;
+    }
+    catch (e) {
+        return { success: false, addresses: [], error: e instanceof Error ? e.message : 'Invalid pattern' };
+    }
+    const byteList = patternBytes.map(b => `0x${b.toString(16)}`).join(',');
+    const maskList = patternMask.join(',');
+    const tag = `${pid}_${Date.now()}`;
+    const pyFile = `/tmp/lldb_scan_${tag}.py`;
+    const cmdFile = `/tmp/lldb_scan_${tag}.txt`;
+    const pyScript = `
+import lldb, json, sys
+
+def __lldb_init_module(debugger, internal_dict):
+    proc = debugger.GetSelectedTarget().GetProcess()
+    pat = bytes([${byteList}])
+    mask = [${maskList}]
+    results = []
+    rl = proc.GetMemoryRegions()
+    for i in range(rl.GetSize()):
+        info = lldb.SBMemoryRegionInfo()
+        rl.GetMemoryRegionAtIndex(i, info)
+        if not info.IsReadable():
+            continue
+        s = info.GetRegionBase()
+        sz = info.GetRegionEnd() - s
+        if sz > 32 * 1024 * 1024:
+            continue
+        err = lldb.SBError()
+        data = proc.ReadMemory(s, sz, err)
+        if not err.Success():
+            continue
+        n = len(pat)
+        for j in range(len(data) - n + 1):
+            match = True
+            for k in range(n):
+                if mask[k] == 1 and data[j+k] != pat[k]:
+                    match = False
+                    break
+            if match:
+                results.append(hex(s + j))
+                if len(results) >= 1000:
+                    break
+        if len(results) >= 1000:
+            break
+    sys.stdout.write('SCAN_RESULT:' + json.dumps({
+        'success': True,
+        'addresses': results,
+        'stats': {'patternLength': len(pat), 'resultsFound': len(results)}
+    }) + '\\n')
+    sys.stdout.flush()
+`;
+    await fs.writeFile(pyFile, pyScript, 'utf8');
+    await fs.writeFile(cmdFile, `command script import ${pyFile}\nprocess detach\n`, 'utf8');
+    try {
+        const { stdout } = await execAsync(`lldb --batch -p ${pid} --source ${cmdFile}`, {
+            timeout: 120000,
+            maxBuffer: 1024 * 1024 * 5,
+        });
+        const line = stdout.split('\n').find(l => l.startsWith('SCAN_RESULT:'));
+        if (!line) {
+            const errLine = stdout.split('\n').find(l => l.includes('error:')) ?? '';
+            return {
+                success: false,
+                addresses: [],
+                error: `lldb scan returned no result. ${errLine}`.trim(),
+            };
+        }
+        return JSON.parse(line.slice('SCAN_RESULT:'.length));
+    }
+    catch (error) {
+        return { success: false, addresses: [], error: error instanceof Error ? error.message : String(error) };
+    }
+    finally {
+        await fs.unlink(pyFile).catch(() => { });
+        await fs.unlink(cmdFile).catch(() => { });
+    }
+}