@jshookmcp/jshook 0.1.8 → 0.2.0

package/dist/src/modules/process/memory/scanner.patterns.d.ts

@@ -0,0 +1,8 @@
+export declare function buildPatternBytesAndMask(pattern: string, patternType: string): {
+    patternBytes: number[];
+    mask: number[];
+};
+export declare function patternToBytesMac(pattern: string, patternType: string): {
+    bytes: number[];
+    mask: number[];
+};

package/dist/src/modules/process/memory/scanner.patterns.js

@@ -0,0 +1,146 @@
+export function buildPatternBytesAndMask(pattern, patternType) {
+    let patternBytes = [];
+    let mask = [];
+    switch (patternType) {
+        case 'hex': {
+            const hexParts = pattern.trim().split(/\s+/);
+            for (const part of hexParts) {
+                if (part === '??' || part === '**' || part === '?') {
+                    patternBytes.push(0);
+                    mask.push(0);
+                }
+                else {
+                    const byte = parseInt(part, 16);
+                    if (!isNaN(byte)) {
+                        patternBytes.push(byte);
+                        mask.push(1);
+                    }
+                }
+            }
+            break;
+        }
+        case 'int32': {
+            const int32Val = parseInt(pattern);
+            if (!isNaN(int32Val)) {
+                const buf = Buffer.allocUnsafe(4);
+                buf.writeInt32LE(int32Val, 0);
+                patternBytes = Array.from(buf);
+                mask = [1, 1, 1, 1];
+            }
+            break;
+        }
+        case 'int64': {
+            const int64Val = BigInt.asIntN(64, BigInt(pattern));
+            const buf64 = Buffer.allocUnsafe(8);
+            buf64.writeBigInt64LE(int64Val, 0);
+            patternBytes = Array.from(buf64);
+            mask = [1, 1, 1, 1, 1, 1, 1, 1];
+            break;
+        }
+        case 'float': {
+            const floatVal = parseFloat(pattern);
+            if (!isNaN(floatVal)) {
+                const bufFloat = Buffer.allocUnsafe(4);
+                bufFloat.writeFloatLE(floatVal, 0);
+                patternBytes = Array.from(bufFloat);
+                mask = [1, 1, 1, 1];
+            }
+            break;
+        }
+        case 'double': {
+            const doubleVal = parseFloat(pattern);
+            if (!isNaN(doubleVal)) {
+                const bufDouble = Buffer.allocUnsafe(8);
+                bufDouble.writeDoubleLE(doubleVal, 0);
+                patternBytes = Array.from(bufDouble);
+                mask = [1, 1, 1, 1, 1, 1, 1, 1];
+            }
+            break;
+        }
+        case 'string': {
+            const stringBuf = Buffer.from(pattern, 'utf8');
+            patternBytes = Array.from(stringBuf);
+            mask = patternBytes.map(() => 1);
+            break;
+        }
+    }
+    if (patternBytes.length === 0) {
+        throw new Error('Invalid pattern');
+    }
+    return { patternBytes, mask };
+}
+export function patternToBytesMac(pattern, patternType) {
+    const bytes = [];
+    const mask = [];
+    switch (patternType) {
+        case 'hex': {
+            const parts = pattern.trim().split(/\s+/);
+            for (const part of parts) {
+                if (part === '??' || part === '?' || part === '**') {
+                    bytes.push(0);
+                    mask.push(0);
+                }
+                else {
+                    const b = parseInt(part, 16);
+                    if (isNaN(b))
+                        throw new Error(`Invalid hex byte: ${part}`);
+                    bytes.push(b);
+                    mask.push(1);
+                }
+            }
+            if (!bytes.length)
+                throw new Error('Pattern is empty');
+            break;
+        }
+        case 'int32': {
+            const v = parseInt(pattern);
+            if (isNaN(v))
+                throw new Error('Invalid int32 value');
+            const buf = Buffer.allocUnsafe(4);
+            buf.writeInt32LE(v, 0);
+            const arr = Array.from(buf);
+            bytes.push(...arr);
+            mask.push(...arr.map(() => 1));
+            break;
+        }
+        case 'int64': {
+            const buf = Buffer.allocUnsafe(8);
+            buf.writeBigInt64LE(BigInt.asIntN(64, BigInt(pattern)), 0);
+            const arr = Array.from(buf);
+            bytes.push(...arr);
+            mask.push(...arr.map(() => 1));
+            break;
+        }
+        case 'float': {
+            const v = parseFloat(pattern);
+            if (isNaN(v))
+                throw new Error('Invalid float value');
+            const buf = Buffer.allocUnsafe(4);
+            buf.writeFloatLE(v, 0);
+            const arr = Array.from(buf);
+            bytes.push(...arr);
+            mask.push(...arr.map(() => 1));
+            break;
+        }
+        case 'double': {
+            const v = parseFloat(pattern);
+            if (isNaN(v))
+                throw new Error('Invalid double value');
+            const buf = Buffer.allocUnsafe(8);
+            buf.writeDoubleLE(v, 0);
+            const arr = Array.from(buf);
+            bytes.push(...arr);
+            mask.push(...arr.map(() => 1));
+            break;
+        }
+        case 'string': {
+            const arr = Array.from(Buffer.from(pattern, 'utf8'));
+            bytes.push(...arr);
+            mask.push(...arr.map(() => 1));
+            break;
+        }
+        default:
+            throw new Error(`Unsupported pattern type: ${patternType}`);
+    }
+    return { bytes, mask };
+}

package/dist/src/modules/process/memory/scanner.windows.d.ts

@@ -0,0 +1,2 @@
+import { type MemoryScanResult } from '../../process/memory/types.js';
+export declare function scanMemoryWindows(pid: number, pattern: string, patternType: string): Promise<MemoryScanResult>;

package/dist/src/modules/process/memory/scanner.windows.js

@@ -0,0 +1,187 @@
+import { logger } from '../../../utils/logger.js';
+import { executePowerShellScript, } from '../../process/memory/types.js';
+import { nativeMemoryManager } from '../../../native/NativeMemoryManager.js';
+import { isKoffiAvailable } from '../../../native/NativeMemoryManager.utils.js';
+import { buildPatternBytesAndMask } from './scanner.patterns.js';
+function buildMemoryScanScript(pid, pattern, patternType) {
+    const { patternBytes, mask } = buildPatternBytesAndMask(pattern, patternType);
+    const patternArray = patternBytes.join(',');
+    const maskArray = mask.join(',');
+    return `
+Add-Type @"
+using System;
+using System.Runtime.InteropServices;
+using System.Collections.Generic;
+using System.ComponentModel;
+
+public class MemoryScanner {
+    [DllImport("kernel32.dll", SetLastError = true)]
+    public static extern IntPtr OpenProcess(int access, bool inherit, int pid);
+
+    [DllImport("kernel32.dll", SetLastError = true)]
+    public static extern bool ReadProcessMemory(IntPtr hProcess, IntPtr addr, byte[] buffer, int size, out int read);
+
+    [DllImport("kernel32.dll", SetLastError = true)]
+    public static extern int VirtualQueryEx(IntPtr hProcess, IntPtr addr, out MEMORY_BASIC_INFORMATION info, int size);
+
+    [DllImport("kernel32.dll", SetLastError = true)]
+    public static extern bool CloseHandle(IntPtr handle);
+
+    const int PROCESS_VM_READ = 0x0010;
+    const int PROCESS_QUERY_INFORMATION = 0x0400;
+
+    [StructLayout(LayoutKind.Sequential)]
+    public struct MEMORY_BASIC_INFORMATION {
+        public IntPtr BaseAddress;
+        public IntPtr AllocationBase;
+        public uint AllocationProtect;
+        public IntPtr RegionSize;
+        public uint State;
+        public uint Protect;
+        public uint Type;
+    }
+
+    const uint MEM_COMMIT = 0x1000;
+    const uint PAGE_READONLY = 0x02;
+    const uint PAGE_READWRITE = 0x04;
+    const uint PAGE_WRITECOPY = 0x08;
+    const uint PAGE_EXECUTE_READ = 0x20;
+    const uint PAGE_EXECUTE_READWRITE = 0x40;
+
+    public static List<string> ScanMemory(int pid, byte[] pattern, byte[] mask, int maxResults = 10000) {
+        var results = new List<string>();
+        IntPtr hProcess = OpenProcess(PROCESS_VM_READ | PROCESS_QUERY_INFORMATION, false, pid);
+        if (hProcess == IntPtr.Zero) {
+            int error = Marshal.GetLastWin32Error();
+            throw new Win32Exception(error, "Failed to open process. Run as Administrator.");
+        }
+
+        try {
+            IntPtr addr = IntPtr.Zero;
+            MEMORY_BASIC_INFORMATION info;
+            int infoSize = Marshal.SizeOf(typeof(MEMORY_BASIC_INFORMATION));
+            int scannedRegions = 0;
+
+            while (VirtualQueryEx(hProcess, addr, out info, infoSize) == infoSize) {
+                scannedRegions++;
+                bool isReadable = (info.State == MEM_COMMIT) &&
+                    ((info.Protect & PAGE_READONLY) != 0 ||
+                     (info.Protect & PAGE_READWRITE) != 0 ||
+                     (info.Protect & PAGE_WRITECOPY) != 0 ||
+                     (info.Protect & PAGE_EXECUTE_READ) != 0 ||
+                     (info.Protect & PAGE_EXECUTE_READWRITE) != 0);
+
+                if (isReadable && info.RegionSize.ToInt64() > 0 && info.RegionSize.ToInt64() < 1073741824) {
+                    long regionSize = info.RegionSize.ToInt64();
+                    if (regionSize > 16777216) regionSize = 16777216; // bound scan window per region (16MB)
+                    byte[] buffer = new byte[(int)regionSize];
+                    int bytesRead;
+
+                    if (ReadProcessMemory(hProcess, info.BaseAddress, buffer, buffer.Length, out bytesRead)) {
+                        for (int i = 0; i <= bytesRead - pattern.Length; i++) {
+                            if (PatternMatch(buffer, i, pattern, mask)) {
+                                long foundAddr = info.BaseAddress.ToInt64() + i;
+                                results.Add("0x" + foundAddr.ToString("X"));
+                                if (results.Count >= maxResults) break;
+                            }
+                        }
+                    }
+                }
+
+                if (results.Count >= maxResults) break;
+                if (scannedRegions >= 50000) break;
+                long baseAddr = info.BaseAddress.ToInt64();
+                long regionSizeRaw = info.RegionSize.ToInt64();
+                if (regionSizeRaw <= 0) break;
+                long nextAddr = baseAddr + regionSizeRaw;
+                if (nextAddr <= baseAddr) break;
+                addr = new IntPtr(nextAddr);
+                if (addr.ToInt64() >= 0x7FFFFFFF0000) break;
+            }
+
+            return results;
+        } finally {
+            CloseHandle(hProcess);
+        }
+    }
+
+    private static bool PatternMatch(byte[] buffer, int offset, byte[] pattern, byte[] mask) {
+        for (int i = 0; i < pattern.Length; i++) {
+            if (mask[i] == 1 && buffer[offset + i] != pattern[i]) {
+                return false;
+            }
+        }
+        return true;
+    }
+}
+"@
+
+try {
+    $patternBytes = @(${patternArray})
+    $maskBytes = @(${maskArray})
+    $results = [MemoryScanner]::ScanMemory(${pid}, $patternBytes, $maskBytes, 1000)
+    @{
+        success = $true;
+        addresses = $results;
+        stats = @{
+            patternLength = $patternBytes.Length;
+            resultsFound = $results.Count
+        }
+    } | ConvertTo-Json -Compress
+} catch {
+    @{ success = $false; error = $_.Exception.Message } | ConvertTo-Json -Compress
+}
+  `.trim();
+}
+export async function scanMemoryWindows(pid, pattern, patternType) {
+    try {
+        if (isKoffiAvailable()) {
+            try {
+                const nativeResult = await nativeMemoryManager.scanMemory(pid, pattern, patternType);
+                if (nativeResult.success) {
+                    return nativeResult;
+                }
+                logger.warn('Native Windows memory scan failed, falling back to PowerShell', {
+                    pid,
+                    patternType,
+                    error: nativeResult.error,
+                    nativeAvailable: isKoffiAvailable(),
+                });
+            }
+            catch (error) {
+                logger.warn('Native Windows memory scan threw, falling back to PowerShell', {
+                    pid,
+                    patternType,
+                    error: error instanceof Error ? error.message : String(error),
+                    nativeAvailable: isKoffiAvailable(),
+                });
+            }
+        }
+        const psScript = buildMemoryScanScript(pid, pattern, patternType);
+        const { stdout, stderr } = await executePowerShellScript(psScript, {
+            maxBuffer: 1024 * 1024 * 50,
+            timeout: 120000,
+        });
+        if (stderr && stderr.includes('Error')) {
+            return { success: false, addresses: [], error: stderr };
+        }
+        const _trimmed = stdout.trim();
+        if (!_trimmed)
+            throw new Error('PowerShell returned empty output');
+        const result = JSON.parse(_trimmed);
+        return {
+            success: result.success,
+            addresses: result.addresses || [],
+            error: result.error,
+            stats: result.stats,
+        };
+    }
+    catch (error) {
+        logger.error('Windows memory scan failed:', error);
+        return {
+            success: false,
+            addresses: [],
+            error: error instanceof Error ? error.message : 'PowerShell execution failed. Run as Administrator.',
+        };
+    }
+}

package/dist/src/modules/security/RedactionService.js

@@ -0,0 +1,101 @@
+import { logger } from '../../utils/logger.js';
+const PATTERNS = [
+    {
+        name: 'bearer_token',
+        pattern: /Bearer\s+[A-Za-z0-9_\-.~+/]+=*/g,
+        replacement: 'Bearer [REDACTED]',
+        levels: ['standard', 'strict'],
+    },
+    {
+        name: 'jwt',
+        pattern: /eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}/g,
+        replacement: '[REDACTED_JWT]',
+        levels: ['standard', 'strict'],
+    },
+    {
+        name: 'api_key_sk',
+        pattern: /sk[_-][A-Za-z0-9]{20,}/g,
+        replacement: '[REDACTED_API_KEY]',
+        levels: ['standard', 'strict'],
+    },
+    {
+        name: 'api_key_generic',
+        pattern: /(?:api[_-]?key|apikey|access[_-]?key)\s*[:=]\s*["']?[A-Za-z0-9_-]{16,}["']?/gi,
+        replacement: '[REDACTED_API_KEY]',
+        levels: ['standard', 'strict'],
+    },
+    {
+        name: 'long_hex_secret',
+        pattern: /(?:secret|token|password|passwd|credential)\s*[:=]\s*["']?[A-Fa-f0-9]{32,}["']?/gi,
+        replacement: '[REDACTED_SECRET]',
+        levels: ['standard', 'strict'],
+    },
+    {
+        name: 'cookie_header',
+        pattern: /(?:Cookie|Set-Cookie)\s*:\s*[^\r\n]{10,}/gi,
+        replacement: '[REDACTED_COOKIE]',
+        levels: ['standard', 'strict'],
+    },
+    {
+        name: 'email',
+        pattern: /[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}/g,
+        replacement: '[REDACTED_EMAIL]',
+        levels: ['strict'],
+    },
+    {
+        name: 'windows_absolute_path',
+        pattern: /[A-Z]:\\(?:Users|Documents and Settings)\\[^\s"'<>|]{3,}/gi,
+        replacement: '[REDACTED_PATH]',
+        levels: ['strict'],
+    },
+    {
+        name: 'unix_home_path',
+        pattern: /\/(?:home|Users)\/[a-zA-Z0-9._-]+(?:\/[^\s"'<>|]+)*/g,
+        replacement: '[REDACTED_PATH]',
+        levels: ['strict'],
+    },
+];
+export class RedactionService {
+    level;
+    activePatterns;
+    constructor(level) {
+        this.level = level ?? process.env.jshook_REDACTION_LEVEL ?? 'standard';
+        this.activePatterns = PATTERNS.filter((p) => p.levels.includes(this.level));
+    }
+    redactString(input) {
+        if (this.level === 'none')
+            return input;
+        let result = input;
+        for (const pattern of this.activePatterns) {
+            result = result.replace(pattern.pattern, pattern.replacement);
+        }
+        return result;
+    }
+    redactObject(obj) {
+        if (this.level === 'none')
+            return obj;
+        try {
+            const json = JSON.stringify(obj);
+            const redacted = this.redactString(json);
+            return JSON.parse(redacted);
+        }
+        catch {
+            return obj;
+        }
+    }
+    setLevel(level) {
+        this.level = level;
+        this.activePatterns = PATTERNS.filter((p) => p.levels.includes(level));
+        logger.info(`[RedactionService] Level set to: ${level} (${this.activePatterns.length} patterns active)`);
+    }
+    getLevel() {
+        return this.level;
+    }
+    getStats() {
+        return {
+            level: this.level,
+            activePatterns: this.activePatterns.length,
+            patternNames: this.activePatterns.map((p) => p.name),
+        };
+    }
+}