@jshookmcp/jshook 0.2.2 → 0.2.5

package/dist/src/modules/trace/TraceRecorder.js

@@ -4,11 +4,7 @@ import { resolveArtifactPath } from '../../utils/artifacts.js';
 const CDP_EVENTS_BY_DOMAIN = {
     Debugger: ['Debugger.paused', 'Debugger.resumed', 'Debugger.scriptParsed'],
     Runtime: ['Runtime.consoleAPICalled', 'Runtime.exceptionThrown'],
-    Network: [
-        'Network.requestWillBeSent',
-        'Network.responseReceived',
-        'Network.loadingFinished',
-    ],
+    Network: ['Network.requestWillBeSent', 'Network.responseReceived', 'Network.loadingFinished'],
     Page: ['Page.navigatedWithinDocument', 'Page.loadEventFired'],
 };
 const DEFAULT_CDP_DOMAINS = ['Debugger', 'Runtime', 'Network', 'Page'];

package/dist/src/native/AntiCheatDetector.js

@@ -1,27 +1,77 @@
 import { createHash } from 'node:crypto';
-import { readFileSync } from 'node:fs';
+import { promises as fs } from 'node:fs';
 import { logger } from '../utils/logger.js';
-import { openProcessForMemory, CloseHandle, ReadProcessMemory, VirtualQueryEx, PAGE, EnumProcessModules, GetModuleBaseName, GetModuleInformation, } from './Win32API.js';
+import { openProcessForMemory, CloseHandle, ReadProcessMemory, VirtualQueryEx, PAGE, EnumProcessModules, GetModuleBaseName, GetModuleFileNameEx, GetModuleInformation, } from './Win32API.js';
 import { PEAnalyzer } from './PEAnalyzer.js';
 const ANTI_DEBUG_IMPORTS = [
     {
         dll: 'kernel32.dll',
         funcs: [
-            { name: 'IsDebuggerPresent', mechanism: 'anti_debug_api', confidence: 'high', bypass: 'Hook IsDebuggerPresent to return 0, or patch PEB.BeingDebugged field' },
-            { name: 'CheckRemoteDebuggerPresent', mechanism: 'anti_debug_api', confidence: 'high', bypass: 'Hook CheckRemoteDebuggerPresent to set output to FALSE and return TRUE' },
-            { name: 'OutputDebugStringA', mechanism: 'exception_based', confidence: 'low', bypass: 'May be used for anti-debug timing — monitor for exception handler abuse' },
-            { name: 'GetTickCount', mechanism: 'timing_check', confidence: 'low', bypass: 'Hook GetTickCount to return consistent delta values' },
-            { name: 'GetTickCount64', mechanism: 'timing_check', confidence: 'low', bypass: 'Hook GetTickCount64 to return consistent delta values' },
-            { name: 'QueryPerformanceCounter', mechanism: 'timing_check', confidence: 'medium', bypass: 'Hook QPC to filter out debugging time deltas' },
+            {
+                name: 'IsDebuggerPresent',
+                mechanism: 'anti_debug_api',
+                confidence: 'high',
+                bypass: 'Hook IsDebuggerPresent to return 0, or patch PEB.BeingDebugged field',
+            },
+            {
+                name: 'CheckRemoteDebuggerPresent',
+                mechanism: 'anti_debug_api',
+                confidence: 'high',
+                bypass: 'Hook CheckRemoteDebuggerPresent to set output to FALSE and return TRUE',
+            },
+            {
+                name: 'OutputDebugStringA',
+                mechanism: 'exception_based',
+                confidence: 'low',
+                bypass: 'May be used for anti-debug timing — monitor for exception handler abuse',
+            },
+            {
+                name: 'GetTickCount',
+                mechanism: 'timing_check',
+                confidence: 'low',
+                bypass: 'Hook GetTickCount to return consistent delta values',
+            },
+            {
+                name: 'GetTickCount64',
+                mechanism: 'timing_check',
+                confidence: 'low',
+                bypass: 'Hook GetTickCount64 to return consistent delta values',
+            },
+            {
+                name: 'QueryPerformanceCounter',
+                mechanism: 'timing_check',
+                confidence: 'medium',
+                bypass: 'Hook QPC to filter out debugging time deltas',
+            },
         ],
     },
     {
         dll: 'ntdll.dll',
         funcs: [
-            { name: 'NtQueryInformationProcess', mechanism: 'ntquery_debug', confidence: 'high', bypass: 'Hook NtQueryInformationProcess: return 0 for ProcessDebugPort (7), ProcessDebugObjectHandle (30), ProcessDebugFlags (31)' },
-            { name: 'NtSetInformationThread', mechanism: 'thread_hiding', confidence: 'medium', bypass: 'Hook NtSetInformationThread: intercept ThreadHideFromDebugger (0x11) calls' },
-            { name: 'NtClose', mechanism: 'exception_based', confidence: 'low', bypass: 'NtClose with invalid handle detects debugger via exception — hook to suppress' },
-            { name: 'RtlGetNtGlobalFlags', mechanism: 'heap_flags', confidence: 'medium', bypass: 'Clear NtGlobalFlag (FLG_HEAP_*) in PEB at offset 0xBC (x64)' },
+            {
+                name: 'NtQueryInformationProcess',
+                mechanism: 'ntquery_debug',
+                confidence: 'high',
+                bypass: 'Hook NtQueryInformationProcess: return 0 for ProcessDebugPort (7), ProcessDebugObjectHandle (30), ProcessDebugFlags (31)',
+            },
+            {
+                name: 'NtSetInformationThread',
+                mechanism: 'thread_hiding',
+                confidence: 'medium',
+                bypass: 'Hook NtSetInformationThread: intercept ThreadHideFromDebugger (0x11) calls',
+            },
+            {
+                name: 'NtClose',
+                mechanism: 'exception_based',
+                confidence: 'low',
+                bypass: 'NtClose with invalid handle detects debugger via exception — hook to suppress',
+            },
+            {
+                name: 'RtlGetNtGlobalFlags',
+                mechanism: 'heap_flags',
+                confidence: 'medium',
+                bypass: 'Clear NtGlobalFlag (FLG_HEAP_*) in PEB at offset 0xBC (x64)',
+            },
         ],
     },
 ];
@@ -41,7 +91,7 @@ export class AntiCheatDetector {
                         for (const knownDll of ANTI_DEBUG_IMPORTS) {
                             if (dllLower.includes(knownDll.dll.toLowerCase().replace('.dll', ''))) {
                                 for (const func of knownDll.funcs) {
-                                    if (imp.functions.some(f => f.name === func.name)) {
+                                    if (imp.functions.some((f) => f.name === func.name)) {
                                         detections.push({
                                             mechanism: func.mechanism,
                                             confidence: func.confidence,
@@ -127,11 +177,11 @@ export class AntiCheatDetector {
         try {
             const modules = this._enumerateModules(hProcess);
             const targets = moduleName
-                ? modules.filter(m => m.name.toLowerCase().includes(moduleName.toLowerCase()))
+                ? modules.filter((m) => m.name.toLowerCase().includes(moduleName.toLowerCase()))
                 : modules;
             for (const mod of targets) {
                 try {
-                    const diskData = readFileSync(mod.path);
+                    const diskData = await fs.readFile(mod.path);
                     const sections = await this.peAnalyzer.listSections(pid, mod.base);
                     for (const sec of sections) {
                         if (!sec.isExecutable)
@@ -174,11 +224,12 @@ export class AntiCheatDetector {
                 const hMod = modHandles[i];
                 const name = GetModuleBaseName(hProcess, hMod);
                 const info = GetModuleInformation(hProcess, hMod);
+                const modulePath = GetModuleFileNameEx(hProcess, hMod) ?? name;
                 if (info.success) {
                     modules.push({
                         name,
                         base: `0x${info.info.lpBaseOfDll.toString(16)}`,
-                        path: `C:\\Windows\\System32\\${name}`,
+                        path: modulePath,
                         size: info.info.SizeOfImage,
                     });
                 }

package/dist/src/native/CodeInjector.js

@@ -36,7 +36,7 @@ export class CodeInjector {
     }
     async unpatch(patchId) {
         const patch = this.patches.get(patchId);
-        if (!patch || !patch.isApplied)
+        if (!patch?.isApplied)
             return false;
         const addr = BigInt(patch.address);
         const originalBuf = Buffer.from(patch.originalBytes);
@@ -54,7 +54,7 @@ export class CodeInjector {
         }
     }
     async nopBytes(pid, address, count) {
-        const nops = new Array(count).fill(0x90);
+        const nops = Array.from({ length: count }, () => 0x90);
         return this.patchBytes(pid, address, nops);
     }
     async findCodeCaves(pid, minSize) {
@@ -80,7 +80,7 @@ export class CodeInjector {
                             let caveStart = -1;
                             for (let i = 0; i < chunk.length; i++) {
                                 const b = chunk[i];
-                                if (b === 0x00 || b === 0xCC) {
+                                if (b === 0x00 || b === 0xcc) {
                                     if (caveStart === -1)
                                         caveStart = i;
                                 }
@@ -123,7 +123,7 @@ export class CodeInjector {
         finally {
             CloseHandle(handle);
         }
-        return caves.sort((a, b) => b.size - a.size);
+        return caves.toSorted((a, b) => b.size - a.size);
     }
     async allocateRemote(pid, size) {
         const handle = openProcessForMemory(pid, true);

package/dist/src/native/HardwareBreakpoint.js

@@ -1,7 +1,8 @@
 import { randomUUID } from 'node:crypto';
-import { BREAKPOINT_HIT_TIMEOUT_MS, BREAKPOINT_TRACE_MAX_HITS, } from '../constants.js';
+import { BREAKPOINT_HIT_TIMEOUT_MS, BREAKPOINT_TRACE_MAX_HITS } from '../constants.js';
 import { SuspendThread, ResumeThread, GetThreadContext, SetThreadContext, DebugActiveProcess, DebugActiveProcessStop, DebugSetProcessKillOnExit, WaitForDebugEvent, ContinueDebugEvent, EnumerateProcessThreads, openThreadForDebug, parseContext, writeContext, encodeDR7, CONTEXT_FLAGS, EXCEPTION_CODE, DBG, } from './Win32Debug.js';
 import { CloseHandle } from './Win32API.js';
+const toHex = (v) => `0x${v.toString(16).toUpperCase()}`;
 export class HardwareBreakpointEngine {
     breakpoints = new Map();
     attachedPids = new Set();
@@ -104,7 +105,7 @@ export class HardwareBreakpointEngine {
         const deadline = Date.now() + timeout;
         while (hits.length < max && Date.now() < deadline) {
             const hit = await this.waitForHit(Math.min(1000, deadline - Date.now()));
-            if (hit && hit.breakpointId === bp.id) {
+            if (hit?.breakpointId === bp.id) {
                 hits.push(hit);
             }
         }
@@ -123,10 +124,10 @@ export class HardwareBreakpointEngine {
     applyDRToAllThreads(pid, drIndex, address, access, size, enable) {
         const threads = EnumerateProcessThreads(pid);
         const drAccessMap = {
-            'execute': 'execute',
-            'write': 'write',
-            'readwrite': 'readwrite',
-            'read': 'read',
+            execute: 'execute',
+            write: 'write',
+            readwrite: 'readwrite',
+            read: 'read',
         };
         for (const tid of threads) {
             let hThread;
@@ -172,7 +173,8 @@ export class HardwareBreakpointEngine {
                 try {
                     ResumeThread(hThread);
                 }
-                catch { }
+                catch {
+                }
             }
             finally {
                 CloseHandle(hThread);
@@ -203,7 +205,6 @@ export class HardwareBreakpointEngine {
                     bp.lastHit = Date.now();
                     ctxBuf.writeBigUInt64LE(0n, 0x68);
                     SetThreadContext(hThread, ctxBuf);
-                    const toHex = (v) => `0x${v.toString(16).toUpperCase()}`;
                     return {
                         breakpointId: id,
                         address: bp.address,
@@ -213,14 +214,22 @@ export class HardwareBreakpointEngine {
                         accessType: bp.access,
                         timestamp: Date.now(),
                         registers: {
-                            rax: toHex(ctx.rax), rbx: toHex(ctx.rbx),
-                            rcx: toHex(ctx.rcx), rdx: toHex(ctx.rdx),
-                            rsi: toHex(ctx.rsi), rdi: toHex(ctx.rdi),
-                            rsp: toHex(ctx.rsp), rbp: toHex(ctx.rbp),
-                            r8: toHex(ctx.r8), r9: toHex(ctx.r9),
-                            r10: toHex(ctx.r10), r11: toHex(ctx.r11),
-                            r12: toHex(ctx.r12), r13: toHex(ctx.r13),
-                            r14: toHex(ctx.r14), r15: toHex(ctx.r15),
+                            rax: toHex(ctx.rax),
+                            rbx: toHex(ctx.rbx),
+                            rcx: toHex(ctx.rcx),
+                            rdx: toHex(ctx.rdx),
+                            rsi: toHex(ctx.rsi),
+                            rdi: toHex(ctx.rdi),
+                            rsp: toHex(ctx.rsp),
+                            rbp: toHex(ctx.rbp),
+                            r8: toHex(ctx.r8),
+                            r9: toHex(ctx.r9),
+                            r10: toHex(ctx.r10),
+                            r11: toHex(ctx.r11),
+                            r12: toHex(ctx.r12),
+                            r13: toHex(ctx.r13),
+                            r14: toHex(ctx.r14),
+                            r15: toHex(ctx.r15),
                             rip: toHex(ctx.rip),
                             rflags: `0x${ctx.eflags.toString(16).toUpperCase()}`,
                         },

package/dist/src/native/HeapAnalyzer.js

@@ -1,6 +1,6 @@
 import { logger } from '../utils/logger.js';
 import koffi from 'koffi';
-import { openProcessForMemory, CloseHandle, ReadProcessMemory, } from './Win32API.js';
+import { openProcessForMemory, CloseHandle, ReadProcessMemory } from './Win32API.js';
 import { HEAP_ENUMERATE_MAX_BLOCKS, HEAP_SPRAY_THRESHOLD, HEAP_SPRAY_SIZE_TOLERANCE, HEAP_SUSPICIOUS_BLOCK_SIZE, } from '../constants.js';
 import { LF32, HF32 } from './HeapAnalyzer.types.js';
 import { TH32CS } from './Win32Debug.js';
@@ -208,7 +208,7 @@ export class HeapAnalyzer {
         }
     }
     async _detectPossibleUAF(pid, blocks, heapId, anomalies) {
-        const freeBlocks = blocks.filter(b => b.isFree && b.size >= 8);
+        const freeBlocks = blocks.filter((b) => b.isFree && b.size >= 8);
         const sampled = freeBlocks.slice(0, 100);
         let hProcess = null;
         try {

package/dist/src/native/MemoryController.js

@@ -1,5 +1,5 @@
 import { randomUUID } from 'node:crypto';
-import { FREEZE_DEFAULT_INTERVAL_MS, WRITE_HISTORY_MAX, } from '../constants.js';
+import { FREEZE_DEFAULT_INTERVAL_MS, WRITE_HISTORY_MAX } from '../constants.js';
 import { openProcessForMemory, CloseHandle, ReadProcessMemory, WriteProcessMemory, VirtualProtectEx, PAGE, } from './Win32API.js';
 import { parsePattern } from './NativeMemoryManager.utils.js';
 export class MemoryController {

package/dist/src/native/MemoryScanSession.js

@@ -1,5 +1,5 @@
 import { randomUUID } from 'node:crypto';
-import { SCAN_SESSION_MAX_COUNT, SCAN_SESSION_TTL_MS, } from '../constants.js';
+import { SCAN_SESSION_MAX_COUNT, SCAN_SESSION_TTL_MS } from '../constants.js';
 import { getDefaultAlignment } from './ScanComparators.js';
 import { formatAddress, parseAddress } from './formatAddress.js';
 export class MemoryScanSessionManager {
@@ -97,7 +97,7 @@ export class MemoryScanSessionManager {
         const session = this.getSession(sessionId);
         const serializable = {
             ...session,
-            addresses: session.addresses.map(addr => formatAddress(addr)),
+            addresses: session.addresses.map((addr) => formatAddress(addr)),
             previousValues: Array.from(session.previousValues.entries()).map(([addr, buf]) => [formatAddress(addr), buf.toString('hex')]),
         };
         return JSON.stringify(serializable);

package/dist/src/native/MemoryScanner.js

@@ -229,9 +229,7 @@ export class MemoryScanner {
                     }
                     for (let i = 0; i <= chunk.length - 8; i += 8) {
                         const ptrValue = chunk.readBigUInt64LE(i);
-                        const diff = ptrValue > targetAddr
-                            ? Number(ptrValue - targetAddr)
-                            : Number(targetAddr - ptrValue);
+                        const diff = ptrValue > targetAddr ? Number(ptrValue - targetAddr) : Number(targetAddr - ptrValue);
                         if (diff <= 4096) {
                             const addr = chunkAddr + BigInt(i);
                             const offsetFromTarget = ptrValue >= targetAddr
@@ -271,8 +269,8 @@ export class MemoryScanner {
         if (maxOffset > SCAN_GROUP_MAX_PATTERN_SIZE) {
             throw new Error(`Group pattern too large: ${maxOffset} bytes (max ${SCAN_GROUP_MAX_PATTERN_SIZE})`);
         }
-        const compositePattern = new Array(maxOffset).fill(0);
-        const compositeMask = new Array(maxOffset).fill(0);
+        const compositePattern = Array.from({ length: maxOffset }, () => 0);
+        const compositeMask = Array.from({ length: maxOffset }, () => 0);
         for (const entry of pattern) {
             const effectiveType = entry.type === 'pointer' ? 'uint64' : entry.type;
             const { patternBytes, mask } = parsePattern(entry.value, effectiveType);
@@ -372,9 +370,7 @@ export class MemoryScanner {
             if (!regionInfo)
                 break;
             const regionSize = regionInfo.size;
-            if (regionInfo.isReadable &&
-                regionSize > 0 &&
-                regionSize <= Number.MAX_SAFE_INTEGER) {
+            if (regionInfo.isReadable && regionSize > 0 && regionSize <= Number.MAX_SAFE_INTEGER) {
                 let include = true;
                 if (filter?.writable && !regionInfo.isWritable)
                     include = false;

package/dist/src/native/NativeMemoryManager.impl.js

@@ -4,7 +4,7 @@ import { promisify } from 'node:util';
 import { cpuLimit } from '../utils/concurrency.js';
 import { createPlatformProvider } from './platform/factory.js';
 import { MemoryProtection } from './platform/types.js';
-import { findPatternInBuffer, parsePattern, } from './NativeMemoryManager.utils.js';
+import { findPatternInBuffer, parsePattern } from './NativeMemoryManager.utils.js';
 import { checkNativeMemoryAvailability } from './NativeMemoryManager.availability.js';
 const execAsync = promisify(exec);
 const SCAN_CHUNK_SIZE = 16 * 1024 * 1024;
@@ -374,7 +374,7 @@ export class NativeMemoryManager {
             return { success: false, error: 'Debug port check is only supported on Windows' };
         }
         try {
-            const { openProcessForMemory, CloseHandle, NtQueryInformationProcess, } = await import('./Win32API.js');
+            const { openProcessForMemory, CloseHandle, NtQueryInformationProcess } = await import('./Win32API.js');
             const handle = openProcessForMemory(pid, false);
             try {
                 const { status, debugPort } = NtQueryInformationProcess(handle, 7);

package/dist/src/native/PEAnalyzer.js

@@ -1,6 +1,6 @@
-import { readFileSync } from 'node:fs';
+import { promises as fs } from 'node:fs';
 import { logger } from '../utils/logger.js';
-import { openProcessForMemory, CloseHandle, ReadProcessMemory, EnumProcessModules, GetModuleBaseName, GetModuleInformation, } from './Win32API.js';
+import { openProcessForMemory, CloseHandle, ReadProcessMemory, EnumProcessModules, GetModuleBaseName, GetModuleFileNameEx, GetModuleInformation, } from './Win32API.js';
 import { IMAGE_SCN, IMAGE_DIRECTORY_ENTRY } from './PEAnalyzer.types.js';
 const MZ_MAGIC = 0x5a4d;
 const PE_SIGNATURE = 0x00004550;
@@ -73,7 +73,9 @@ export class PEAnalyzer {
                 const off = headers.firstSectionOffset + i * SECTION_HEADER_SIZE;
                 const secData = ReadProcessMemory(hProcess, base + BigInt(off), SECTION_HEADER_SIZE);
                 const nameEnd = secData.indexOf(0);
-                const name = secData.subarray(0, nameEnd > 0 && nameEnd <= 8 ? nameEnd : 8).toString('ascii');
+                const name = secData
+                    .subarray(0, nameEnd > 0 && nameEnd <= 8 ? nameEnd : 8)
+                    .toString('ascii');
                 const virtualSize = secData.readUInt32LE(8);
                 const virtualAddress = secData.readUInt32LE(12);
                 const rawSize = secData.readUInt32LE(16);
@@ -114,7 +116,7 @@ export class PEAnalyzer {
                 const nullIdx = nameData.indexOf(0);
                 const dllName = nameData.subarray(0, nullIdx > 0 ? nullIdx : 256).toString('ascii');
                 const originalFirstThunkRva = desc.readUInt32LE(0) || desc.readUInt32LE(16);
-                const functions = await this._readThunkArray(hProcess, base, originalFirstThunkRva, headers.isPE32Plus);
+                const functions = this._readThunkArray(hProcess, base, originalFirstThunkRva, headers.isPE32Plus);
                 imports.push({ dllName, functions });
                 descOffset += IMPORT_DESCRIPTOR_SIZE;
             }
@@ -147,8 +149,7 @@ export class PEAnalyzer {
                 const nameBuf = ReadProcessMemory(hProcess, base + BigInt(nameRva), 256);
                 const nullIdx = nameBuf.indexOf(0);
                 const name = nameBuf.subarray(0, nullIdx > 0 ? nullIdx : 256).toString('ascii');
-                const funcRva = ReadProcessMemory(hProcess, base + BigInt(addressOfFunctionsRva + ordIndex * 4), 4)
-                    .readUInt32LE(0);
+                const funcRva = ReadProcessMemory(hProcess, base + BigInt(addressOfFunctionsRva + ordIndex * 4), 4).readUInt32LE(0);
                 let forwardedTo = null;
                 if (funcRva >= exportDir.rva && funcRva < exportDir.rva + exportDir.size) {
                     const fwdBuf = ReadProcessMemory(hProcess, base + BigInt(funcRva), 256);
@@ -174,11 +175,11 @@ export class PEAnalyzer {
         try {
             const modules = this._enumerateModulesInternal(hProcess);
             const targets = moduleName
-                ? modules.filter(m => m.name.toLowerCase().includes(moduleName.toLowerCase()))
+                ? modules.filter((m) => m.name.toLowerCase().includes(moduleName.toLowerCase()))
                 : modules;
             for (const mod of targets) {
                 try {
-                    const diskData = readFileSync(mod.path);
+                    const diskData = await fs.readFile(mod.path);
                     const exports = await this.parseExports(pid, mod.base);
                     for (const exp of exports) {
                         const funcRva = parseInt(exp.rva, 16);
@@ -271,13 +272,15 @@ export class PEAnalyzer {
         const firstSectionOffset = e_lfanew + 4 + 20 + sizeOfOptionalHeader;
         return { numSections, isPE32Plus, firstSectionOffset, dataDirectories };
     }
-    async _readThunkArray(hProcess, base, thunkRva, isPE32Plus) {
+    _readThunkArray(hProcess, base, thunkRva, isPE32Plus) {
         const thunkSize = isPE32Plus ? 8 : 4;
         const functions = [];
         const IMAGE_ORDINAL_FLAG = isPE32Plus ? 0x8000000000000000n : 0x80000000n;
         for (let i = 0; i < 2000; i++) {
             const thunkData = ReadProcessMemory(hProcess, base + BigInt(thunkRva + i * thunkSize), thunkSize);
-            const thunkValue = isPE32Plus ? thunkData.readBigUInt64LE(0) : BigInt(thunkData.readUInt32LE(0));
+            const thunkValue = isPE32Plus
+                ? thunkData.readBigUInt64LE(0)
+                : BigInt(thunkData.readUInt32LE(0));
             if (thunkValue === 0n)
                 break;
             if ((thunkValue & IMAGE_ORDINAL_FLAG) !== 0n) {
@@ -312,11 +315,7 @@ export class PEAnalyzer {
                 const hMod = modHandles[i];
                 const name = GetModuleBaseName(hProcess, hMod);
                 const info = GetModuleInformation(hProcess, hMod);
-                let modulePath = name;
-                try {
-                    modulePath = `C:\\Windows\\System32\\${name}`;
-                }
-                catch { }
+                const modulePath = GetModuleFileNameEx(hProcess, hMod) ?? name;
                 if (info.success) {
                     modules.push({
                         name,

package/dist/src/native/PointerChainEngine.js

@@ -156,7 +156,7 @@ export class PointerChainEngine {
     scanLevel(handle, targetAddresses, maxOffset, alignment, _filter) {
         const matches = [];
         const chunkSize = POINTER_CHAIN_SCAN_CHUNK_SIZE;
-        const targets = Array.from(targetAddresses).sort((a, b) => (a < b ? -1 : a > b ? 1 : 0));
+        const targets = Array.from(targetAddresses).toSorted((a, b) => (a < b ? -1 : a > b ? 1 : 0));
         if (targets.length === 0)
             return matches;
         const maxOffsetBig = BigInt(maxOffset);
@@ -198,9 +198,7 @@ export class PointerChainEngine {
                         }
                         for (let t = lo; t < targets.length && targets[t] <= searchMax; t++) {
                             const target = targets[t];
-                            const diff = ptrValue > target
-                                ? Number(ptrValue - target)
-                                : Number(target - ptrValue);
+                            const diff = ptrValue > target ? Number(ptrValue - target) : Number(target - ptrValue);
                             if (diff <= maxOffset) {
                                 const pointerAddr = chunkAddr + BigInt(i);
                                 const matchOffset = Number(target - ptrValue);

package/dist/src/native/ScriptLoader.js

@@ -1,18 +1,13 @@
 import { promises as fs, existsSync } from 'fs';
-import { join, dirname, resolve } from 'path';
+import { join, resolve } from 'path';
 import { platform } from 'os';
 import { fileURLToPath } from 'node:url';
 let _scriptsBaseDir = null;
 function tryGetEsmBaseDir() {
     try {
-        const readImportMetaPath = new Function('try { return import.meta.dirname ?? import.meta.url ?? null; } catch { return null; }');
-        const metaPath = readImportMetaPath();
-        if (!metaPath)
-            return null;
-        if (metaPath.startsWith('file://')) {
-            return dirname(fileURLToPath(metaPath));
-        }
-        return metaPath;
+        const readImportMetaUrl = new Function('try { return import.meta.url ?? null; } catch { return null; }');
+        const metaUrl = readImportMetaUrl();
+        return metaUrl ? fileURLToPath(new URL('.', metaUrl)) : null;
     }
     catch {
         return null;

package/dist/src/native/Speedhack.js

@@ -149,7 +149,7 @@ export class Speedhack {
     }
     buildAbsoluteJump(target) {
         const buf = Buffer.alloc(14);
-        buf[0] = 0xFF;
+        buf[0] = 0xff;
         buf[1] = 0x25;
         buf.writeUInt32LE(0, 2);
         buf.writeBigUInt64LE(target, 6);

package/dist/src/native/StructureAnalyzer.js

@@ -1,4 +1,4 @@
-import { STRUCT_ANALYZE_DEFAULT_SIZE, STRUCT_VTABLE_MAX_FUNCTIONS, STRUCT_RTTI_MAX_STRING_LEN, STRUCT_CSTRING_MAX_LEN, } from '../constants.js';
+import { STRUCT_ANALYZE_DEFAULT_SIZE, STRUCT_VTABLE_MAX_FUNCTIONS, STRUCT_RTTI_MAX_STRING_LEN, } from '../constants.js';
 import { createPlatformProvider } from './platform/factory.js';
 import { nativeMemoryManager } from './NativeMemoryManager.impl.js';
 export class StructureAnalyzer {
@@ -126,7 +126,7 @@ export class StructureAnalyzer {
             const signature = colBuf.readUInt32LE(0);
             if (signature !== 1)
                 return null;
-            const typeDescRVA = colBuf.readUInt32LE(0x0C);
+            const typeDescRVA = colBuf.readUInt32LE(0x0c);
             const classDescRVA = colBuf.readUInt32LE(0x10);
             const objectLocRVA = colBuf.readUInt32LE(0x14);
             const moduleBase = colAddr - BigInt(objectLocRVA);
@@ -140,7 +140,7 @@ export class StructureAnalyzer {
                 const classDescAddr = moduleBase + BigInt(classDescRVA);
                 const classDescBuf = this.provider.readMemory(handle, classDescAddr, 0x10).data;
                 const numBaseClasses = classDescBuf.readUInt32LE(0x08);
-                const baseClassArrayRVA = classDescBuf.readUInt32LE(0x0C);
+                const baseClassArrayRVA = classDescBuf.readUInt32LE(0x0c);
                 if (numBaseClasses > 0 && numBaseClasses < 20) {
                     const baseArrayAddr = moduleBase + BigInt(baseClassArrayRVA);
                     const baseArrayBuf = this.provider.readMemory(handle, baseArrayAddr, numBaseClasses * 4).data;
@@ -280,15 +280,13 @@ export class StructureAnalyzer {
                 for (let i = offset; i < buf.length && buf[i] === 0; i++)
                     zeroLen++;
                 const padSize = Math.min(zeroLen, remaining);
-                const alignedPad = padSize >= 8 ? (padSize & ~7) : (padSize >= 4 ? (padSize & ~3) : padSize);
-                if (alignedPad > 0) {
-                    return {
-                        type: 'padding',
-                        size: alignedPad,
-                        value: `0x${'00'.repeat(Math.min(alignedPad, 8))}`,
-                        confidence: 0.6,
-                    };
-                }
+                const alignedPad = padSize & ~7;
+                return {
+                    type: 'padding',
+                    size: alignedPad,
+                    value: `0x${'00'.repeat(Math.min(alignedPad, 8))}`,
+                    confidence: 0.6,
+                };
             }
             if (val32u === 0) {
                 return {
@@ -308,7 +306,10 @@ export class StructureAnalyzer {
                     notes: 'value is 1 — could be boolean',
                 };
             }
-            if (isFinite(valFloat) && !isNaN(valFloat) && Math.abs(valFloat) > 1e-10 && Math.abs(valFloat) < 1e8) {
+            if (isFinite(valFloat) &&
+                !isNaN(valFloat) &&
+                Math.abs(valFloat) > 1e-10 &&
+                Math.abs(valFloat) < 1e8) {
                 const intLooksReasonable = val32u > 0 && val32u < 100_000;
                 const floatHasDecimals = Math.abs(valFloat - Math.round(valFloat)) > 0.001;
                 if (floatHasDecimals || (!intLooksReasonable && Math.abs(valFloat) < 10000)) {
@@ -317,7 +318,9 @@ export class StructureAnalyzer {
                         size: 4,
                         value: valFloat.toFixed(6),
                         confidence: floatHasDecimals ? 0.8 : 0.5,
-                        notes: floatHasDecimals ? 'IEEE 754 float with fractional part' : 'could be float or int',
+                        notes: floatHasDecimals
+                            ? 'IEEE 754 float with fractional part'
+                            : 'could be float or int',
                     };
                 }
             }
@@ -376,9 +379,8 @@ export class StructureAnalyzer {
         }
     }
     readCString(handle, address, maxLen) {
-        const len = maxLen ?? STRUCT_CSTRING_MAX_LEN;
         try {
-            const buf = this.provider.readMemory(handle, address, len).data;
+            const buf = this.provider.readMemory(handle, address, maxLen).data;
             const nullIdx = buf.indexOf(0);
             if (nullIdx < 0)
                 return null;
@@ -403,23 +405,40 @@ export class StructureAnalyzer {
     }
     fieldTypeToCType(type, size) {
         switch (type) {
-            case 'int8': return 'int8_t';
-            case 'uint8': return 'uint8_t';
-            case 'int16': return 'int16_t';
-            case 'uint16': return 'uint16_t';
-            case 'int32': return 'int32_t';
-            case 'uint32': return 'uint32_t';
-            case 'int64': return 'int64_t';
-            case 'uint64': return 'uint64_t';
-            case 'float': return 'float';
-            case 'double': return 'double';
-            case 'pointer': return 'void*';
-            case 'vtable_ptr': return 'void**';
-            case 'string_ptr': return 'char*';
-            case 'bool': return 'bool';
-            case 'padding': return `uint8_t[${size}]`;
-            case 'unknown': return `uint8_t[${size}]`;
-            default: return `uint8_t[${size}]`;
+            case 'int8':
+                return 'int8_t';
+            case 'uint8':
+                return 'uint8_t';
+            case 'int16':
+                return 'int16_t';
+            case 'uint16':
+                return 'uint16_t';
+            case 'int32':
+                return 'int32_t';
+            case 'uint32':
+                return 'uint32_t';
+            case 'int64':
+                return 'int64_t';
+            case 'uint64':
+                return 'uint64_t';
+            case 'float':
+                return 'float';
+            case 'double':
+                return 'double';
+            case 'pointer':
+                return 'void*';
+            case 'vtable_ptr':
+                return 'void**';
+            case 'string_ptr':
+                return 'char*';
+            case 'bool':
+                return 'bool';
+            case 'padding':
+                return `uint8_t[${size}]`;
+            case 'unknown':
+                return `uint8_t[${size}]`;
+            default:
+                return `uint8_t[${size}]`;
         }
     }
     async getModuleEntries(pid) {

package/dist/src/native/Win32API.d.ts

@@ -93,6 +93,7 @@ export declare function EnumProcessModules(hProcess: bigint, maxModules?: number
     count: number;
 };
 export declare function GetModuleBaseName(hProcess: bigint, hModule: bigint, maxSize?: number): string;
+export declare function GetModuleFileNameEx(hProcess: bigint, hModule: bigint, maxSize?: number): string | null;
 export declare function GetModuleInformation(hProcess: bigint, hModule: bigint): {
     success: boolean;
     info: ModuleInfoType;