@jshookmcp/jshook 0.2.0 → 0.2.2

package/dist/src/native/Speedhack.js

@@ -0,0 +1,159 @@
+import { openProcessForMemory, CloseHandle, ReadProcessMemory, WriteProcessMemory, VirtualAllocEx, VirtualFreeEx, VirtualProtectEx, GetModuleHandle, GetProcAddress, PAGE, MEM, } from './Win32API.js';
+import { FlushInstructionCache } from './Win32Debug.js';
+export class Speedhack {
+    states = new Map();
+    async apply(pid, speed) {
+        if (this.states.has(pid)) {
+            await this.remove(pid);
+        }
+        const handle = openProcessForMemory(pid, true);
+        const hookedApis = [];
+        const patchIds = [];
+        try {
+            const kernel32Base = GetModuleHandle('kernel32.dll');
+            if (kernel32Base === 0n) {
+                throw new Error('Cannot find kernel32.dll');
+            }
+            const sharedMem = VirtualAllocEx(handle, 0n, 4096, MEM.COMMIT | MEM.RESERVE, PAGE.EXECUTE_READWRITE);
+            if (sharedMem === 0n) {
+                throw new Error('VirtualAllocEx failed for speedhack shared memory');
+            }
+            const speedBuf = Buffer.alloc(8);
+            speedBuf.writeDoubleLE(speed, 0);
+            WriteProcessMemory(handle, sharedMem, speedBuf);
+            const zeroBuf = Buffer.alloc(8, 0);
+            WriteProcessMemory(handle, sharedMem + 8n, zeroBuf);
+            WriteProcessMemory(handle, sharedMem + 16n, zeroBuf);
+            const gettickAddr = GetProcAddress(kernel32Base, 'GetTickCount64');
+            if (gettickAddr !== 0n) {
+                const patched = await this.hookTimeFunction(handle, gettickAddr, sharedMem, 256n, 'gettick64');
+                if (patched) {
+                    hookedApis.push('GetTickCount64');
+                    patchIds.push('gettick64');
+                }
+            }
+            const qpcAddr = GetProcAddress(kernel32Base, 'QueryPerformanceCounter');
+            if (qpcAddr !== 0n) {
+                const patched = await this.hookTimeFunction(handle, qpcAddr, sharedMem, 512n, 'qpc');
+                if (patched) {
+                    hookedApis.push('QueryPerformanceCounter');
+                    patchIds.push('qpc');
+                }
+            }
+            this.states.set(pid, {
+                pid,
+                speed,
+                hookedApis,
+                isActive: true,
+                allocatedMemory: `0x${sharedMem.toString(16).toUpperCase()}`,
+                patchIds,
+            });
+            return { success: hookedApis.length > 0, hookedApis };
+        }
+        catch (error) {
+            CloseHandle(handle);
+            throw error;
+        }
+        finally {
+            CloseHandle(handle);
+        }
+    }
+    async setSpeed(pid, speed) {
+        const state = this.states.get(pid);
+        if (!state || !state.isActive || !state.allocatedMemory)
+            return false;
+        const addr = BigInt(state.allocatedMemory);
+        const handle = openProcessForMemory(pid, true);
+        try {
+            const buf = Buffer.alloc(8);
+            buf.writeDoubleLE(speed, 0);
+            WriteProcessMemory(handle, addr, buf);
+            state.speed = speed;
+            return true;
+        }
+        finally {
+            CloseHandle(handle);
+        }
+    }
+    getSpeed(pid) {
+        const state = this.states.get(pid);
+        return state?.isActive ? state.speed : null;
+    }
+    async remove(pid) {
+        const state = this.states.get(pid);
+        if (!state)
+            return false;
+        const handle = openProcessForMemory(pid, true);
+        try {
+            if (state.allocatedMemory) {
+                const allocAddr = BigInt(state.allocatedMemory);
+                for (let i = 0; i < state.patchIds.length; i++) {
+                    try {
+                        const metaOffset = 3072n + BigInt(i * 32);
+                        const metaBuf = ReadProcessMemory(handle, allocAddr + metaOffset, 32);
+                        const origAddr = metaBuf.readBigUInt64LE(0);
+                        const origSize = metaBuf.readUInt32LE(8);
+                        if (origAddr !== 0n && origSize > 0 && origSize <= 16) {
+                            const origBytes = metaBuf.subarray(12, 12 + origSize);
+                            const { oldProtect } = VirtualProtectEx(handle, origAddr, origSize, PAGE.EXECUTE_READWRITE);
+                            WriteProcessMemory(handle, origAddr, origBytes);
+                            FlushInstructionCache(handle, origAddr, origSize);
+                            VirtualProtectEx(handle, origAddr, origSize, oldProtect);
+                        }
+                    }
+                    catch {
+                    }
+                }
+                VirtualFreeEx(handle, allocAddr, 0, MEM.RELEASE);
+            }
+        }
+        finally {
+            CloseHandle(handle);
+        }
+        state.isActive = false;
+        this.states.delete(pid);
+        return true;
+    }
+    isActive(pid) {
+        return this.states.get(pid)?.isActive ?? false;
+    }
+    listActive() {
+        return Array.from(this.states.values()).filter((s) => s.isActive);
+    }
+    async hookTimeFunction(handle, funcAddr, sharedMem, trampolineOffset, _hookId) {
+        try {
+            const origBytes = ReadProcessMemory(handle, funcAddr, 14);
+            const trampolineAddr = sharedMem + trampolineOffset;
+            WriteProcessMemory(handle, trampolineAddr, origBytes);
+            const jumpBackAddr = funcAddr + 14n;
+            const jumpBack = this.buildAbsoluteJump(jumpBackAddr);
+            WriteProcessMemory(handle, trampolineAddr + 14n, Buffer.from(jumpBack));
+            const jumpToTrampoline = this.buildAbsoluteJump(trampolineAddr);
+            const { oldProtect } = VirtualProtectEx(handle, funcAddr, 14, PAGE.EXECUTE_READWRITE);
+            WriteProcessMemory(handle, funcAddr, Buffer.from(jumpToTrampoline));
+            FlushInstructionCache(handle, funcAddr, 14);
+            VirtualProtectEx(handle, funcAddr, 14, oldProtect);
+            const patchIndex = this.states.size;
+            const metaOffset = 3072n + BigInt(patchIndex * 32);
+            const metaBuf = Buffer.alloc(32);
+            metaBuf.writeBigUInt64LE(funcAddr, 0);
+            metaBuf.writeUInt32LE(14, 8);
+            origBytes.copy(metaBuf, 12);
+            WriteProcessMemory(handle, sharedMem + metaOffset, metaBuf);
+            FlushInstructionCache(handle, trampolineAddr, 32);
+            return true;
+        }
+        catch {
+            return false;
+        }
+    }
+    buildAbsoluteJump(target) {
+        const buf = Buffer.alloc(14);
+        buf[0] = 0xFF;
+        buf[1] = 0x25;
+        buf.writeUInt32LE(0, 2);
+        buf.writeBigUInt64LE(target, 6);
+        return Array.from(buf);
+    }
+}
+export const speedhack = new Speedhack();

package/dist/src/native/Speedhack.types.d.ts

@@ -0,0 +1,8 @@
+export interface SpeedhackState {
+    pid: number;
+    speed: number;
+    hookedApis: string[];
+    isActive: boolean;
+    allocatedMemory?: string;
+    patchIds: string[];
+}

package/dist/src/native/StructureAnalyzer.d.ts

@@ -0,0 +1,31 @@
+import type { InferredField, InferredStruct, VtableInfo, FieldType, StructureAnalysisOptions, CStructExport } from './StructureAnalyzer.types.js';
+import type { ProcessHandle } from './platform/types.js';
+export declare class StructureAnalyzer {
+    private _provider;
+    private get provider();
+    analyzeStructure(pid: number, address: string, options?: StructureAnalysisOptions): Promise<InferredStruct>;
+    parseVtable(pid: number, vtableAddress: string): Promise<VtableInfo>;
+    parseRtti(pid: number, vtableAddress: string, existingHandle?: ProcessHandle): Promise<{
+        className: string;
+        baseClasses: string[];
+    } | null>;
+    exportToCStruct(structure: InferredStruct, name?: string): CStructExport;
+    compareInstances(pid: number, address1: string, address2: string, size?: number): Promise<{
+        matching: InferredField[];
+        differing: Array<{
+            offset: number;
+            value1: string;
+            value2: string;
+            type: FieldType;
+        }>;
+    }>;
+    private classifyValue;
+    private isValidReadablePointer;
+    private isValidExecutablePointer;
+    private readCString;
+    private demangleMsvcName;
+    private fieldTypeToCType;
+    private getModuleEntries;
+    private resolveToModule;
+}
+export declare const structureAnalyzer: StructureAnalyzer;

package/dist/src/native/StructureAnalyzer.js

@@ -0,0 +1,449 @@
+import { STRUCT_ANALYZE_DEFAULT_SIZE, STRUCT_VTABLE_MAX_FUNCTIONS, STRUCT_RTTI_MAX_STRING_LEN, STRUCT_CSTRING_MAX_LEN, } from '../constants.js';
+import { createPlatformProvider } from './platform/factory.js';
+import { nativeMemoryManager } from './NativeMemoryManager.impl.js';
+export class StructureAnalyzer {
+    _provider = null;
+    get provider() {
+        if (!this._provider) {
+            this._provider = createPlatformProvider();
+        }
+        return this._provider;
+    }
+    async analyzeStructure(pid, address, options) {
+        const size = options?.size ?? STRUCT_ANALYZE_DEFAULT_SIZE;
+        const baseAddr = BigInt(address.startsWith('0x') ? address : `0x${address}`);
+        const handle = this.provider.openProcess(pid, false);
+        try {
+            const buf = this.provider.readMemory(handle, baseAddr, size).data;
+            const fields = [];
+            let offset = 0;
+            while (offset < size) {
+                const remaining = size - offset;
+                if (remaining < 1)
+                    break;
+                const classification = this.classifyValue(buf, handle, baseAddr, offset, remaining);
+                fields.push({
+                    offset,
+                    size: classification.size,
+                    type: classification.type,
+                    name: `field_0x${offset.toString(16).padStart(2, '0').toUpperCase()}`,
+                    value: classification.value,
+                    confidence: classification.confidence,
+                    notes: classification.notes,
+                });
+                offset += classification.size;
+            }
+            let vtableAddress;
+            let className;
+            let baseClasses;
+            if (fields.length > 0 && fields[0].type === 'vtable_ptr') {
+                vtableAddress = fields[0].value;
+                if (options?.parseRtti !== false && vtableAddress) {
+                    try {
+                        const rtti = await this.parseRtti(pid, vtableAddress, handle);
+                        if (rtti) {
+                            className = rtti.className;
+                            baseClasses = rtti.baseClasses;
+                        }
+                    }
+                    catch {
+                    }
+                }
+            }
+            return {
+                baseAddress: `0x${baseAddr.toString(16).toUpperCase()}`,
+                totalSize: size,
+                fields,
+                vtableAddress,
+                className,
+                baseClasses,
+                timestamp: Date.now(),
+            };
+        }
+        finally {
+            this.provider.closeProcess(handle);
+        }
+    }
+    async parseVtable(pid, vtableAddress) {
+        const vtableAddr = BigInt(vtableAddress.startsWith('0x') ? vtableAddress : `0x${vtableAddress}`);
+        const handle = this.provider.openProcess(pid, false);
+        try {
+            const functions = [];
+            const modules = await this.getModuleEntries(pid);
+            for (let i = 0; i < STRUCT_VTABLE_MAX_FUNCTIONS; i++) {
+                const ptrAddr = vtableAddr + BigInt(i * 8);
+                let funcPtr;
+                try {
+                    const buf = this.provider.readMemory(handle, ptrAddr, 8).data;
+                    funcPtr = buf.readBigUInt64LE(0);
+                }
+                catch {
+                    break;
+                }
+                if (!this.isValidExecutablePointer(handle, funcPtr))
+                    break;
+                const modInfo = this.resolveToModule(funcPtr, modules);
+                functions.push({
+                    index: i,
+                    address: `0x${funcPtr.toString(16).toUpperCase()}`,
+                    module: modInfo?.module,
+                    moduleOffset: modInfo?.offset,
+                });
+            }
+            let rttiName;
+            let baseClassList;
+            try {
+                const rtti = await this.parseRtti(pid, vtableAddress, handle);
+                if (rtti) {
+                    rttiName = rtti.className;
+                    baseClassList = rtti.baseClasses;
+                }
+            }
+            catch {
+            }
+            return {
+                address: `0x${vtableAddr.toString(16).toUpperCase()}`,
+                functionCount: functions.length,
+                functions,
+                rttiName,
+                baseClasses: baseClassList,
+            };
+        }
+        finally {
+            this.provider.closeProcess(handle);
+        }
+    }
+    async parseRtti(pid, vtableAddress, existingHandle) {
+        const vtableAddr = BigInt(vtableAddress.startsWith('0x') ? vtableAddress : `0x${vtableAddress}`);
+        const ownHandle = !existingHandle;
+        const handle = existingHandle ?? this.provider.openProcess(pid, false);
+        try {
+            const colPtrBuf = this.provider.readMemory(handle, vtableAddr - 8n, 8).data;
+            const colAddr = colPtrBuf.readBigUInt64LE(0);
+            if (!this.isValidReadablePointer(handle, colAddr))
+                return null;
+            const colBuf = this.provider.readMemory(handle, colAddr, 0x18).data;
+            const signature = colBuf.readUInt32LE(0);
+            if (signature !== 1)
+                return null;
+            const typeDescRVA = colBuf.readUInt32LE(0x0C);
+            const classDescRVA = colBuf.readUInt32LE(0x10);
+            const objectLocRVA = colBuf.readUInt32LE(0x14);
+            const moduleBase = colAddr - BigInt(objectLocRVA);
+            const typeDescAddr = moduleBase + BigInt(typeDescRVA);
+            const className = this.readCString(handle, typeDescAddr + 0x10n, STRUCT_RTTI_MAX_STRING_LEN);
+            if (!className)
+                return null;
+            const demangled = this.demangleMsvcName(className);
+            const baseClasses = [];
+            try {
+                const classDescAddr = moduleBase + BigInt(classDescRVA);
+                const classDescBuf = this.provider.readMemory(handle, classDescAddr, 0x10).data;
+                const numBaseClasses = classDescBuf.readUInt32LE(0x08);
+                const baseClassArrayRVA = classDescBuf.readUInt32LE(0x0C);
+                if (numBaseClasses > 0 && numBaseClasses < 20) {
+                    const baseArrayAddr = moduleBase + BigInt(baseClassArrayRVA);
+                    const baseArrayBuf = this.provider.readMemory(handle, baseArrayAddr, numBaseClasses * 4).data;
+                    for (let i = 1; i < numBaseClasses; i++) {
+                        const baseDescRVA = baseArrayBuf.readUInt32LE(i * 4);
+                        const baseDescAddr = moduleBase + BigInt(baseDescRVA);
+                        try {
+                            const baseDescBuf = this.provider.readMemory(handle, baseDescAddr, 0x08).data;
+                            const baseTypeDescRVA = baseDescBuf.readUInt32LE(0);
+                            const baseTypeDescAddr = moduleBase + BigInt(baseTypeDescRVA);
+                            const baseName = this.readCString(handle, baseTypeDescAddr + 0x10n, STRUCT_RTTI_MAX_STRING_LEN);
+                            if (baseName) {
+                                baseClasses.push(this.demangleMsvcName(baseName));
+                            }
+                        }
+                        catch {
+                            break;
+                        }
+                    }
+                }
+            }
+            catch {
+            }
+            return { className: demangled, baseClasses };
+        }
+        catch {
+            return null;
+        }
+        finally {
+            if (ownHandle)
+                this.provider.closeProcess(handle);
+        }
+    }
+    exportToCStruct(structure, name) {
+        const structName = name ?? structure.className ?? 'UnknownStruct';
+        const lines = [];
+        lines.push(`struct ${structName} { // size: 0x${structure.totalSize.toString(16).toUpperCase()} (${structure.totalSize} bytes)`);
+        for (const field of structure.fields) {
+            const cType = this.fieldTypeToCType(field.type, field.size);
+            const offsetStr = `0x${field.offset.toString(16).padStart(2, '0').toUpperCase()}`;
+            const comment = field.notes
+                ? `// +${offsetStr} ${field.notes}`
+                : `// +${offsetStr} = ${field.value}`;
+            if (field.type === 'padding') {
+                lines.push(`    uint8_t _pad_${field.offset.toString(16)}[${field.size}]; ${comment}`);
+            }
+            else {
+                lines.push(`    ${cType} ${field.name}; ${comment}`);
+            }
+        }
+        lines.push('};');
+        const definition = lines.join('\n');
+        return {
+            name: structName,
+            definition,
+            size: structure.totalSize,
+            fieldCount: structure.fields.filter((f) => f.type !== 'padding').length,
+        };
+    }
+    async compareInstances(pid, address1, address2, size) {
+        const analysisSize = size ?? STRUCT_ANALYZE_DEFAULT_SIZE;
+        const [struct1, struct2] = await Promise.all([
+            this.analyzeStructure(pid, address1, { size: analysisSize, parseRtti: false }),
+            this.analyzeStructure(pid, address2, { size: analysisSize, parseRtti: false }),
+        ]);
+        const matching = [];
+        const differing = [];
+        const fieldMap2 = new Map(struct2.fields.map((f) => [f.offset, f]));
+        for (const f1 of struct1.fields) {
+            const f2 = fieldMap2.get(f1.offset);
+            if (!f2)
+                continue;
+            if (f1.value === f2.value && f1.type === f2.type) {
+                matching.push(f1);
+            }
+            else {
+                differing.push({
+                    offset: f1.offset,
+                    value1: f1.value,
+                    value2: f2.value,
+                    type: f1.type,
+                });
+            }
+        }
+        return { matching, differing };
+    }
+    classifyValue(buf, handle, _baseAddr, offset, remaining) {
+        if (remaining >= 8) {
+            const val64 = buf.readBigUInt64LE(offset);
+            if (offset === 0 && val64 !== 0n) {
+                if (this.isValidExecutablePointer(handle, val64)) {
+                    try {
+                        const vtableCheck = this.provider.readMemory(handle, val64, 16).data;
+                        const firstFunc = vtableCheck.readBigUInt64LE(0);
+                        if (this.isValidExecutablePointer(handle, firstFunc)) {
+                            return {
+                                type: 'vtable_ptr',
+                                size: 8,
+                                value: `0x${val64.toString(16).toUpperCase()}`,
+                                confidence: 0.9,
+                                notes: 'likely vtable pointer (points to array of executable pointers)',
+                            };
+                        }
+                    }
+                    catch {
+                    }
+                }
+            }
+            if (val64 !== 0n && val64 > 0x10000n && val64 < 0x7fffffffffffn) {
+                if (this.isValidReadablePointer(handle, val64)) {
+                    const str = this.readCString(handle, val64, 64);
+                    if (str && str.length >= 2) {
+                        return {
+                            type: 'string_ptr',
+                            size: 8,
+                            value: `0x${val64.toString(16).toUpperCase()} → "${str.slice(0, 32)}${str.length > 32 ? '...' : ''}"`,
+                            confidence: 0.75,
+                            notes: `string pointer: "${str.slice(0, 64)}"`,
+                        };
+                    }
+                    return {
+                        type: 'pointer',
+                        size: 8,
+                        value: `0x${val64.toString(16).toUpperCase()}`,
+                        confidence: 0.7,
+                        notes: 'valid pointer to readable memory',
+                    };
+                }
+            }
+        }
+        if (remaining >= 4) {
+            const val32u = buf.readUInt32LE(offset);
+            const val32s = buf.readInt32LE(offset);
+            const valFloat = buf.readFloatLE(offset);
+            if (val32u === 0 && remaining >= 8 && buf.readUInt32LE(offset + 4) === 0) {
+                let zeroLen = 0;
+                for (let i = offset; i < buf.length && buf[i] === 0; i++)
+                    zeroLen++;
+                const padSize = Math.min(zeroLen, remaining);
+                const alignedPad = padSize >= 8 ? (padSize & ~7) : (padSize >= 4 ? (padSize & ~3) : padSize);
+                if (alignedPad > 0) {
+                    return {
+                        type: 'padding',
+                        size: alignedPad,
+                        value: `0x${'00'.repeat(Math.min(alignedPad, 8))}`,
+                        confidence: 0.6,
+                    };
+                }
+            }
+            if (val32u === 0) {
+                return {
+                    type: 'int32',
+                    size: 4,
+                    value: '0',
+                    confidence: 0.4,
+                    notes: 'zero value — could be int, bool, or padding',
+                };
+            }
+            if (val32u === 1) {
+                return {
+                    type: 'bool',
+                    size: 4,
+                    value: 'true',
+                    confidence: 0.5,
+                    notes: 'value is 1 — could be boolean',
+                };
+            }
+            if (isFinite(valFloat) && !isNaN(valFloat) && Math.abs(valFloat) > 1e-10 && Math.abs(valFloat) < 1e8) {
+                const intLooksReasonable = val32u > 0 && val32u < 100_000;
+                const floatHasDecimals = Math.abs(valFloat - Math.round(valFloat)) > 0.001;
+                if (floatHasDecimals || (!intLooksReasonable && Math.abs(valFloat) < 10000)) {
+                    return {
+                        type: 'float',
+                        size: 4,
+                        value: valFloat.toFixed(6),
+                        confidence: floatHasDecimals ? 0.8 : 0.5,
+                        notes: floatHasDecimals ? 'IEEE 754 float with fractional part' : 'could be float or int',
+                    };
+                }
+            }
+            if (val32u < 0x80000000) {
+                return {
+                    type: 'int32',
+                    size: 4,
+                    value: val32s.toString(),
+                    confidence: 0.6,
+                };
+            }
+            return {
+                type: 'uint32',
+                size: 4,
+                value: val32u.toString(),
+                confidence: 0.5,
+            };
+        }
+        if (remaining >= 2) {
+            const val16 = buf.readUInt16LE(offset);
+            return {
+                type: 'uint16',
+                size: 2,
+                value: val16.toString(),
+                confidence: 0.4,
+            };
+        }
+        const val8 = buf.readUInt8(offset);
+        return {
+            type: 'uint8',
+            size: 1,
+            value: val8.toString(),
+            confidence: 0.3,
+        };
+    }
+    isValidReadablePointer(handle, address) {
+        try {
+            const regionInfo = this.provider.queryRegion(handle, address);
+            if (!regionInfo)
+                return false;
+            return regionInfo.isReadable;
+        }
+        catch {
+            return false;
+        }
+    }
+    isValidExecutablePointer(handle, address) {
+        try {
+            const regionInfo = this.provider.queryRegion(handle, address);
+            if (!regionInfo)
+                return false;
+            return regionInfo.isReadable && regionInfo.isExecutable;
+        }
+        catch {
+            return false;
+        }
+    }
+    readCString(handle, address, maxLen) {
+        const len = maxLen ?? STRUCT_CSTRING_MAX_LEN;
+        try {
+            const buf = this.provider.readMemory(handle, address, len).data;
+            const nullIdx = buf.indexOf(0);
+            if (nullIdx < 0)
+                return null;
+            const str = buf.subarray(0, nullIdx).toString('ascii');
+            if (/^[\x20-\x7E]+$/.test(str) && str.length >= 1) {
+                return str;
+            }
+            return null;
+        }
+        catch {
+            return null;
+        }
+    }
+    demangleMsvcName(name) {
+        const match = name.match(/\.?\?A[VU](.+?)@@/);
+        if (match)
+            return match[1];
+        const enumMatch = name.match(/\.?\?AW4(.+?)@@/);
+        if (enumMatch)
+            return enumMatch[1];
+        return name.replace(/^\./, '').replace(/@@$/, '');
+    }
+    fieldTypeToCType(type, size) {
+        switch (type) {
+            case 'int8': return 'int8_t';
+            case 'uint8': return 'uint8_t';
+            case 'int16': return 'int16_t';
+            case 'uint16': return 'uint16_t';
+            case 'int32': return 'int32_t';
+            case 'uint32': return 'uint32_t';
+            case 'int64': return 'int64_t';
+            case 'uint64': return 'uint64_t';
+            case 'float': return 'float';
+            case 'double': return 'double';
+            case 'pointer': return 'void*';
+            case 'vtable_ptr': return 'void**';
+            case 'string_ptr': return 'char*';
+            case 'bool': return 'bool';
+            case 'padding': return `uint8_t[${size}]`;
+            case 'unknown': return `uint8_t[${size}]`;
+            default: return `uint8_t[${size}]`;
+        }
+    }
+    async getModuleEntries(pid) {
+        const modules = new Map();
+        try {
+            const result = await nativeMemoryManager.enumerateModules(pid);
+            if (result.success && result.modules) {
+                for (const mod of result.modules) {
+                    const base = BigInt(mod.baseAddress.startsWith('0x') ? mod.baseAddress : `0x${mod.baseAddress}`);
+                    modules.set(mod.name.toLowerCase(), { name: mod.name, base, size: mod.size });
+                }
+            }
+        }
+        catch {
+        }
+        return modules;
+    }
+    resolveToModule(address, moduleMap) {
+        for (const entry of moduleMap.values()) {
+            if (address >= entry.base && address < entry.base + BigInt(entry.size)) {
+                return { module: entry.name, offset: Number(address - entry.base) };
+            }
+        }
+        return null;
+    }
+}
+export const structureAnalyzer = new StructureAnalyzer();

package/dist/src/native/StructureAnalyzer.types.d.ts

@@ -0,0 +1,42 @@
+export type FieldType = 'int8' | 'uint8' | 'int16' | 'uint16' | 'int32' | 'uint32' | 'int64' | 'uint64' | 'float' | 'double' | 'pointer' | 'vtable_ptr' | 'string_ptr' | 'bool' | 'padding' | 'unknown';
+export interface InferredField {
+    offset: number;
+    size: number;
+    type: FieldType;
+    name: string;
+    value: string;
+    confidence: number;
+    notes?: string;
+}
+export interface InferredStruct {
+    baseAddress: string;
+    totalSize: number;
+    fields: InferredField[];
+    vtableAddress?: string;
+    className?: string;
+    baseClasses?: string[];
+    timestamp: number;
+}
+export interface VtableInfo {
+    address: string;
+    functionCount: number;
+    functions: Array<{
+        index: number;
+        address: string;
+        module?: string;
+        moduleOffset?: number;
+    }>;
+    rttiName?: string;
+    baseClasses?: string[];
+}
+export interface StructureAnalysisOptions {
+    size?: number;
+    otherInstances?: string[];
+    parseRtti?: boolean;
+}
+export interface CStructExport {
+    name: string;
+    definition: string;
+    size: number;
+    fieldCount: number;
+}