@jshookmcp/jshook 0.2.1 → 0.2.2

package/dist/src/native/PEAnalyzer.js

@@ -0,0 +1,380 @@
+import { readFileSync } from 'node:fs';
+import { logger } from '../utils/logger.js';
+import { openProcessForMemory, CloseHandle, ReadProcessMemory, EnumProcessModules, GetModuleBaseName, GetModuleInformation, } from './Win32API.js';
+import { IMAGE_SCN, IMAGE_DIRECTORY_ENTRY } from './PEAnalyzer.types.js';
+const MZ_MAGIC = 0x5a4d;
+const PE_SIGNATURE = 0x00004550;
+const PE32PLUS_MAGIC = 0x20b;
+const SECTION_HEADER_SIZE = 40;
+const IMPORT_DESCRIPTOR_SIZE = 20;
+const COMPARE_BYTES = 16;
+export class PEAnalyzer {
+    async parseHeaders(pid, moduleBase) {
+        const base = BigInt(moduleBase);
+        const hProcess = openProcessForMemory(pid);
+        try {
+            const dosData = ReadProcessMemory(hProcess, base, 64);
+            const e_magic = dosData.readUInt16LE(0);
+            if (e_magic !== MZ_MAGIC) {
+                throw new Error(`Invalid DOS header: expected 0x5A4D, got 0x${e_magic.toString(16)}`);
+            }
+            const e_lfanew = dosData.readUInt32LE(60);
+            const ntData = ReadProcessMemory(hProcess, base + BigInt(e_lfanew), 264);
+            const ntSignature = ntData.readUInt32LE(0);
+            if (ntSignature !== PE_SIGNATURE) {
+                throw new Error(`Invalid PE signature: expected 0x4550, got 0x${ntSignature.toString(16)}`);
+            }
+            const machine = ntData.readUInt16LE(4);
+            const numberOfSections = ntData.readUInt16LE(6);
+            const timeDateStamp = ntData.readUInt32LE(8);
+            const characteristics = ntData.readUInt16LE(22);
+            const magic = ntData.readUInt16LE(24);
+            const isPE32Plus = magic === PE32PLUS_MAGIC;
+            let imageBase;
+            let entryPoint;
+            let sizeOfImage;
+            let numberOfRvaAndSizes;
+            if (isPE32Plus) {
+                entryPoint = ntData.readUInt32LE(40);
+                imageBase = ntData.readBigUInt64LE(48);
+                sizeOfImage = ntData.readUInt32LE(80);
+                numberOfRvaAndSizes = ntData.readUInt32LE(132);
+            }
+            else {
+                entryPoint = ntData.readUInt32LE(40);
+                imageBase = BigInt(ntData.readUInt32LE(52));
+                sizeOfImage = ntData.readUInt32LE(80);
+                numberOfRvaAndSizes = ntData.readUInt32LE(116);
+            }
+            return {
+                dosHeader: { e_magic, e_lfanew },
+                ntSignature,
+                fileHeader: { machine, numberOfSections, timeDateStamp, characteristics },
+                optionalHeader: {
+                    magic,
+                    imageBase: `0x${imageBase.toString(16)}`,
+                    entryPoint: `0x${entryPoint.toString(16)}`,
+                    sizeOfImage,
+                    numberOfRvaAndSizes,
+                },
+            };
+        }
+        finally {
+            CloseHandle(hProcess);
+        }
+    }
+    async listSections(pid, moduleBase) {
+        const base = BigInt(moduleBase);
+        const hProcess = openProcessForMemory(pid);
+        try {
+            const headers = await this._readCoreHeaders(hProcess, base);
+            const sections = [];
+            for (let i = 0; i < headers.numSections; i++) {
+                const off = headers.firstSectionOffset + i * SECTION_HEADER_SIZE;
+                const secData = ReadProcessMemory(hProcess, base + BigInt(off), SECTION_HEADER_SIZE);
+                const nameEnd = secData.indexOf(0);
+                const name = secData.subarray(0, nameEnd > 0 && nameEnd <= 8 ? nameEnd : 8).toString('ascii');
+                const virtualSize = secData.readUInt32LE(8);
+                const virtualAddress = secData.readUInt32LE(12);
+                const rawSize = secData.readUInt32LE(16);
+                const chars = secData.readUInt32LE(36);
+                sections.push({
+                    name,
+                    virtualAddress: `0x${virtualAddress.toString(16)}`,
+                    virtualSize,
+                    rawSize,
+                    characteristics: chars,
+                    isExecutable: (chars & IMAGE_SCN.MEM_EXECUTE) !== 0,
+                    isWritable: (chars & IMAGE_SCN.MEM_WRITE) !== 0,
+                    isReadable: (chars & IMAGE_SCN.MEM_READ) !== 0,
+                });
+            }
+            return sections;
+        }
+        finally {
+            CloseHandle(hProcess);
+        }
+    }
+    async parseImports(pid, moduleBase) {
+        const base = BigInt(moduleBase);
+        const hProcess = openProcessForMemory(pid);
+        try {
+            const headers = await this._readCoreHeaders(hProcess, base);
+            const importRva = headers.dataDirectories[IMAGE_DIRECTORY_ENTRY.IMPORT];
+            if (!importRva || importRva.rva === 0)
+                return [];
+            const imports = [];
+            let descOffset = importRva.rva;
+            for (let i = 0; i < 500; i++) {
+                const desc = ReadProcessMemory(hProcess, base + BigInt(descOffset), IMPORT_DESCRIPTOR_SIZE);
+                const nameRva = desc.readUInt32LE(12);
+                if (nameRva === 0)
+                    break;
+                const nameData = ReadProcessMemory(hProcess, base + BigInt(nameRva), 256);
+                const nullIdx = nameData.indexOf(0);
+                const dllName = nameData.subarray(0, nullIdx > 0 ? nullIdx : 256).toString('ascii');
+                const originalFirstThunkRva = desc.readUInt32LE(0) || desc.readUInt32LE(16);
+                const functions = await this._readThunkArray(hProcess, base, originalFirstThunkRva, headers.isPE32Plus);
+                imports.push({ dllName, functions });
+                descOffset += IMPORT_DESCRIPTOR_SIZE;
+            }
+            return imports;
+        }
+        finally {
+            CloseHandle(hProcess);
+        }
+    }
+    async parseExports(pid, moduleBase) {
+        const base = BigInt(moduleBase);
+        const hProcess = openProcessForMemory(pid);
+        try {
+            const headers = await this._readCoreHeaders(hProcess, base);
+            const exportDir = headers.dataDirectories[IMAGE_DIRECTORY_ENTRY.EXPORT];
+            if (!exportDir || exportDir.rva === 0)
+                return [];
+            const expData = ReadProcessMemory(hProcess, base + BigInt(exportDir.rva), 40);
+            const numberOfNames = expData.readUInt32LE(24);
+            const addressOfFunctionsRva = expData.readUInt32LE(28);
+            const addressOfNamesRva = expData.readUInt32LE(32);
+            const addressOfNameOrdinalsRva = expData.readUInt32LE(36);
+            const ordinalBase = expData.readUInt32LE(16);
+            const exports = [];
+            const namesBuf = ReadProcessMemory(hProcess, base + BigInt(addressOfNamesRva), numberOfNames * 4);
+            const ordsBuf = ReadProcessMemory(hProcess, base + BigInt(addressOfNameOrdinalsRva), numberOfNames * 2);
+            for (let i = 0; i < Math.min(numberOfNames, 2000); i++) {
+                const nameRva = namesBuf.readUInt32LE(i * 4);
+                const ordIndex = ordsBuf.readUInt16LE(i * 2);
+                const nameBuf = ReadProcessMemory(hProcess, base + BigInt(nameRva), 256);
+                const nullIdx = nameBuf.indexOf(0);
+                const name = nameBuf.subarray(0, nullIdx > 0 ? nullIdx : 256).toString('ascii');
+                const funcRva = ReadProcessMemory(hProcess, base + BigInt(addressOfFunctionsRva + ordIndex * 4), 4)
+                    .readUInt32LE(0);
+                let forwardedTo = null;
+                if (funcRva >= exportDir.rva && funcRva < exportDir.rva + exportDir.size) {
+                    const fwdBuf = ReadProcessMemory(hProcess, base + BigInt(funcRva), 256);
+                    const fwdEnd = fwdBuf.indexOf(0);
+                    forwardedTo = fwdBuf.subarray(0, fwdEnd > 0 ? fwdEnd : 256).toString('ascii');
+                }
+                exports.push({
+                    name,
+                    ordinal: ordinalBase + ordIndex,
+                    rva: `0x${funcRva.toString(16)}`,
+                    forwardedTo,
+                });
+            }
+            return exports;
+        }
+        finally {
+            CloseHandle(hProcess);
+        }
+    }
+    async detectInlineHooks(pid, moduleName) {
+        const hProcess = openProcessForMemory(pid);
+        const detections = [];
+        try {
+            const modules = this._enumerateModulesInternal(hProcess);
+            const targets = moduleName
+                ? modules.filter(m => m.name.toLowerCase().includes(moduleName.toLowerCase()))
+                : modules;
+            for (const mod of targets) {
+                try {
+                    const diskData = readFileSync(mod.path);
+                    const exports = await this.parseExports(pid, mod.base);
+                    for (const exp of exports) {
+                        const funcRva = parseInt(exp.rva, 16);
+                        if (funcRva === 0 || exp.forwardedTo)
+                            continue;
+                        const memBytes = ReadProcessMemory(hProcess, BigInt(mod.base) + BigInt(funcRva), COMPARE_BYTES);
+                        const diskOffset = this._rvaToFileOffset(diskData, funcRva);
+                        if (diskOffset < 0 || diskOffset + COMPARE_BYTES > diskData.length)
+                            continue;
+                        const diskBytes = diskData.subarray(diskOffset, diskOffset + COMPARE_BYTES);
+                        if (!memBytes.equals(diskBytes)) {
+                            const hookType = this._classifyHook(memBytes);
+                            const jumpTarget = this._decodeJumpTarget(memBytes, BigInt(mod.base) + BigInt(funcRva));
+                            detections.push({
+                                address: `0x${(BigInt(mod.base) + BigInt(funcRva)).toString(16)}`,
+                                moduleName: mod.name,
+                                functionName: exp.name,
+                                originalBytes: Array.from(diskBytes),
+                                currentBytes: Array.from(memBytes),
+                                hookType,
+                                jumpTarget,
+                            });
+                        }
+                    }
+                }
+                catch (e) {
+                    logger.debug(`Hook check skipped for ${mod.name}: ${e}`);
+                }
+            }
+        }
+        finally {
+            CloseHandle(hProcess);
+        }
+        return detections;
+    }
+    async analyzeSections(pid, moduleBase) {
+        const sections = await this.listSections(pid, moduleBase);
+        const anomalies = [];
+        for (const sec of sections) {
+            if (sec.isReadable && sec.isWritable && sec.isExecutable) {
+                anomalies.push({
+                    sectionName: sec.name,
+                    anomalyType: 'rwx',
+                    severity: 'high',
+                    details: `Section ${sec.name} has Read+Write+Execute permissions — unusual and potentially malicious`,
+                });
+            }
+            else if (sec.isWritable && sec.isExecutable) {
+                anomalies.push({
+                    sectionName: sec.name,
+                    anomalyType: 'writable_code',
+                    severity: 'high',
+                    details: `Section ${sec.name} is writable and executable — code may be self-modifying or packed`,
+                });
+            }
+            else if (sec.isExecutable &&
+                !sec.name.startsWith('.text') &&
+                !sec.name.startsWith('.code') &&
+                (sec.characteristics & IMAGE_SCN.CNT_INITIALIZED_DATA) !== 0) {
+                anomalies.push({
+                    sectionName: sec.name,
+                    anomalyType: 'executable_data',
+                    severity: 'medium',
+                    details: `Data section ${sec.name} has execute permission`,
+                });
+            }
+        }
+        return anomalies;
+    }
+    async _readCoreHeaders(hProcess, base) {
+        const dosData = ReadProcessMemory(hProcess, base, 64);
+        const e_lfanew = dosData.readUInt32LE(60);
+        const ntData = ReadProcessMemory(hProcess, base + BigInt(e_lfanew), 264);
+        const numSections = ntData.readUInt16LE(6);
+        const sizeOfOptionalHeader = ntData.readUInt16LE(20);
+        const magic = ntData.readUInt16LE(24);
+        const isPE32Plus = magic === PE32PLUS_MAGIC;
+        const numberOfRvaAndSizes = isPE32Plus ? ntData.readUInt32LE(132) : ntData.readUInt32LE(116);
+        const dataDirectoriesOffset = isPE32Plus ? 136 : 120;
+        const dataDirectories = [];
+        for (let i = 0; i < Math.min(numberOfRvaAndSizes, 16); i++) {
+            const off = dataDirectoriesOffset + i * 8;
+            if (off + 8 <= ntData.length) {
+                dataDirectories.push({
+                    rva: ntData.readUInt32LE(off),
+                    size: ntData.readUInt32LE(off + 4),
+                });
+            }
+        }
+        const firstSectionOffset = e_lfanew + 4 + 20 + sizeOfOptionalHeader;
+        return { numSections, isPE32Plus, firstSectionOffset, dataDirectories };
+    }
+    async _readThunkArray(hProcess, base, thunkRva, isPE32Plus) {
+        const thunkSize = isPE32Plus ? 8 : 4;
+        const functions = [];
+        const IMAGE_ORDINAL_FLAG = isPE32Plus ? 0x8000000000000000n : 0x80000000n;
+        for (let i = 0; i < 2000; i++) {
+            const thunkData = ReadProcessMemory(hProcess, base + BigInt(thunkRva + i * thunkSize), thunkSize);
+            const thunkValue = isPE32Plus ? thunkData.readBigUInt64LE(0) : BigInt(thunkData.readUInt32LE(0));
+            if (thunkValue === 0n)
+                break;
+            if ((thunkValue & IMAGE_ORDINAL_FLAG) !== 0n) {
+                functions.push({
+                    name: `Ordinal#${Number(thunkValue & 0xffffn)}`,
+                    ordinal: Number(thunkValue & 0xffffn),
+                    hint: 0,
+                    thunkRva: `0x${(thunkRva + i * thunkSize).toString(16)}`,
+                });
+            }
+            else {
+                const hintNameRva = Number(thunkValue);
+                const hintNameData = ReadProcessMemory(hProcess, base + BigInt(hintNameRva), 258);
+                const hint = hintNameData.readUInt16LE(0);
+                const nullIdx = hintNameData.indexOf(0, 2);
+                const name = hintNameData.subarray(2, nullIdx > 2 ? nullIdx : 258).toString('ascii');
+                functions.push({
+                    name,
+                    ordinal: 0,
+                    hint,
+                    thunkRva: `0x${(thunkRva + i * thunkSize).toString(16)}`,
+                });
+            }
+        }
+        return functions;
+    }
+    _enumerateModulesInternal(hProcess) {
+        const modules = [];
+        try {
+            const { modules: modHandles, count } = EnumProcessModules(hProcess);
+            for (let i = 0; i < count; i++) {
+                const hMod = modHandles[i];
+                const name = GetModuleBaseName(hProcess, hMod);
+                const info = GetModuleInformation(hProcess, hMod);
+                let modulePath = name;
+                try {
+                    modulePath = `C:\\Windows\\System32\\${name}`;
+                }
+                catch { }
+                if (info.success) {
+                    modules.push({
+                        name,
+                        base: `0x${info.info.lpBaseOfDll.toString(16)}`,
+                        path: modulePath,
+                        size: info.info.SizeOfImage,
+                    });
+                }
+            }
+        }
+        catch (e) {
+            logger.debug(`Module enumeration failed: ${e}`);
+        }
+        return modules;
+    }
+    _rvaToFileOffset(peData, rva) {
+        const e_lfanew = peData.readUInt32LE(60);
+        const numSections = peData.readUInt16LE(e_lfanew + 6);
+        const sizeOfOptionalHeader = peData.readUInt16LE(e_lfanew + 20);
+        const secStart = e_lfanew + 24 + sizeOfOptionalHeader;
+        for (let i = 0; i < numSections; i++) {
+            const off = secStart + i * 40;
+            if (off + 40 > peData.length)
+                break;
+            const virtualAddr = peData.readUInt32LE(off + 12);
+            const virtualSize = peData.readUInt32LE(off + 8);
+            const rawOffset = peData.readUInt32LE(off + 20);
+            if (rva >= virtualAddr && rva < virtualAddr + virtualSize) {
+                return rawOffset + (rva - virtualAddr);
+            }
+        }
+        return -1;
+    }
+    _classifyHook(memBytes) {
+        if (memBytes[0] === 0xe9)
+            return 'jmp_rel32';
+        if (memBytes[0] === 0xff && memBytes[1] === 0x25)
+            return 'jmp_abs64';
+        if (memBytes[0] === 0x68 && memBytes[5] === 0xc3)
+            return 'push_ret';
+        return 'unknown';
+    }
+    _decodeJumpTarget(memBytes, funcAddr) {
+        if (memBytes[0] === 0xe9) {
+            const rel32 = memBytes.readInt32LE(1);
+            return `0x${(funcAddr + 5n + BigInt(rel32)).toString(16)}`;
+        }
+        if (memBytes[0] === 0xff && memBytes[1] === 0x25) {
+            if (memBytes.length >= 14) {
+                const target = memBytes.readBigUInt64LE(6);
+                return `0x${target.toString(16)}`;
+            }
+        }
+        if (memBytes[0] === 0x68) {
+            const target = memBytes.readUInt32LE(1);
+            return `0x${target.toString(16)}`;
+        }
+        return '0x0';
+    }
+}
+export const peAnalyzer = new PEAnalyzer();

package/dist/src/native/PEAnalyzer.types.d.ts

@@ -0,0 +1,77 @@
+export interface PEHeaders {
+    dosHeader: {
+        e_magic: number;
+        e_lfanew: number;
+    };
+    ntSignature: number;
+    fileHeader: {
+        machine: number;
+        numberOfSections: number;
+        timeDateStamp: number;
+        characteristics: number;
+    };
+    optionalHeader: {
+        magic: number;
+        imageBase: string;
+        entryPoint: string;
+        sizeOfImage: number;
+        numberOfRvaAndSizes: number;
+    };
+}
+export interface PESection {
+    name: string;
+    virtualAddress: string;
+    virtualSize: number;
+    rawSize: number;
+    characteristics: number;
+    isExecutable: boolean;
+    isWritable: boolean;
+    isReadable: boolean;
+}
+export interface ImportEntry {
+    dllName: string;
+    functions: ImportFunction[];
+}
+export interface ImportFunction {
+    name: string;
+    ordinal: number;
+    hint: number;
+    thunkRva: string;
+}
+export interface ExportEntry {
+    name: string;
+    ordinal: number;
+    rva: string;
+    forwardedTo: string | null;
+}
+export interface InlineHookDetection {
+    address: string;
+    moduleName: string;
+    functionName: string;
+    originalBytes: number[];
+    currentBytes: number[];
+    hookType: 'jmp_rel32' | 'jmp_abs64' | 'push_ret' | 'unknown';
+    jumpTarget: string;
+}
+export interface SectionAnomaly {
+    sectionName: string;
+    anomalyType: 'rwx' | 'writable_code' | 'executable_data' | 'high_entropy' | 'name_mismatch';
+    severity: 'low' | 'medium' | 'high';
+    details: string;
+}
+export declare const IMAGE_SCN: {
+    readonly CNT_CODE: 32;
+    readonly CNT_INITIALIZED_DATA: 64;
+    readonly CNT_UNINITIALIZED_DATA: 128;
+    readonly MEM_EXECUTE: 536870912;
+    readonly MEM_READ: 1073741824;
+    readonly MEM_WRITE: 2147483648;
+};
+export declare const IMAGE_DIRECTORY_ENTRY: {
+    readonly EXPORT: 0;
+    readonly IMPORT: 1;
+    readonly RESOURCE: 2;
+    readonly EXCEPTION: 3;
+    readonly IAT: 12;
+    readonly DELAY_IMPORT: 13;
+};

package/dist/src/native/PEAnalyzer.types.js

@@ -0,0 +1,16 @@
+export const IMAGE_SCN = {
+    CNT_CODE: 0x00000020,
+    CNT_INITIALIZED_DATA: 0x00000040,
+    CNT_UNINITIALIZED_DATA: 0x00000080,
+    MEM_EXECUTE: 0x20000000,
+    MEM_READ: 0x40000000,
+    MEM_WRITE: 0x80000000,
+};
+export const IMAGE_DIRECTORY_ENTRY = {
+    EXPORT: 0,
+    IMPORT: 1,
+    RESOURCE: 2,
+    EXCEPTION: 3,
+    IAT: 12,
+    DELAY_IMPORT: 13,
+};

package/dist/src/native/PointerChainEngine.d.ts

@@ -0,0 +1,16 @@
+import type { PointerChain, PointerScanOptions, PointerScanResult, ChainValidationResult } from './PointerChainEngine.types.js';
+export declare class PointerChainEngine {
+    private _provider;
+    private get provider();
+    scan(pid: number, targetAddress: string, options?: PointerScanOptions): Promise<PointerScanResult>;
+    validateChain(pid: number, chain: PointerChain): Promise<ChainValidationResult>;
+    validateChains(pid: number, chains: PointerChain[]): Promise<ChainValidationResult[]>;
+    resolveChain(pid: number, chain: PointerChain): Promise<string | null>;
+    exportChains(chains: PointerChain[]): string;
+    importChains(data: string): PointerChain[];
+    private getModuleMap;
+    private resolveToModule;
+    private scanLevel;
+    private buildChains;
+}
+export declare const pointerChainEngine: PointerChainEngine;