@jshookmcp/jshook 0.2.5 → 0.2.7

package/dist/Win32Debug-DUHt9XUn.mjs

@@ -0,0 +1,274 @@
+import { t as logger } from "./logger-BmWzC2lM.mjs";
+import { r as GetLastError, t as CloseHandle } from "./Win32API-Bc0QnQsN.mjs";
+import koffi from "koffi";
+//#region src/native/Win32Debug.ts
+/**
+* Win32 Debug API Bindings using koffi FFI.
+*
+* Thread management, debug registers, debug events, and instruction cache.
+* These extend Win32API.ts with debug-specific functionality needed for
+* hardware breakpoints and code injection.
+*
+* @module Win32Debug
+*/
+const THREAD_ACCESS = {
+	TERMINATE: 1,
+	SUSPEND_RESUME: 2,
+	GET_CONTEXT: 8,
+	SET_CONTEXT: 16,
+	SET_INFORMATION: 32,
+	QUERY_INFORMATION: 64,
+	SET_THREAD_TOKEN: 128,
+	IMPERSONATE: 256,
+	DIRECT_IMPERSONATION: 512,
+	ALL_ACCESS: 2032639
+};
+/** CONTEXT flags for GetThreadContext / SetThreadContext */
+const CONTEXT_FLAGS = {
+	AMD64: 1048576,
+	CONTROL: 1048577,
+	INTEGER: 1048578,
+	SEGMENTS: 1048580,
+	FLOATING_POINT: 1048584,
+	DEBUG_REGISTERS: 1048592,
+	FULL: 1048587,
+	ALL: 1048607
+};
+/** Debug event codes */
+const DEBUG_EVENT_CODE = {
+	EXCEPTION_DEBUG_EVENT: 1,
+	CREATE_THREAD_DEBUG_EVENT: 2,
+	CREATE_PROCESS_DEBUG_EVENT: 3,
+	EXIT_THREAD_DEBUG_EVENT: 4,
+	EXIT_PROCESS_DEBUG_EVENT: 5,
+	LOAD_DLL_DEBUG_EVENT: 6,
+	UNLOAD_DLL_DEBUG_EVENT: 7,
+	OUTPUT_DEBUG_STRING_EVENT: 8,
+	RIP_EVENT: 9
+};
+/** Exception codes */
+const EXCEPTION_CODE = {
+	SINGLE_STEP: 2147483652,
+	BREAKPOINT: 2147483651,
+	ACCESS_VIOLATION: 3221225477
+};
+/** Continue status for ContinueDebugEvent */
+const DBG = {
+	CONTINUE: 65538,
+	EXCEPTION_NOT_HANDLED: 2147549185,
+	REPLY_LATER: 1073807361
+};
+/** TH32CS flags for CreateToolhelp32Snapshot */
+const TH32CS = {
+	SNAPHEAPLIST: 1,
+	SNAPTHREAD: 4,
+	SNAPMODULE: 8
+};
+const CONTEXT_SIZE = 1232;
+/** Parse x64 CONTEXT from raw buffer */
+function parseContext(buf) {
+	return {
+		contextFlags: buf.readUInt32LE(48),
+		eflags: buf.readUInt32LE(68),
+		dr0: buf.readBigUInt64LE(72),
+		dr1: buf.readBigUInt64LE(80),
+		dr2: buf.readBigUInt64LE(88),
+		dr3: buf.readBigUInt64LE(96),
+		dr6: buf.readBigUInt64LE(104),
+		dr7: buf.readBigUInt64LE(112),
+		rax: buf.readBigUInt64LE(120),
+		rcx: buf.readBigUInt64LE(128),
+		rdx: buf.readBigUInt64LE(136),
+		rbx: buf.readBigUInt64LE(144),
+		rsp: buf.readBigUInt64LE(152),
+		rbp: buf.readBigUInt64LE(160),
+		rsi: buf.readBigUInt64LE(168),
+		rdi: buf.readBigUInt64LE(176),
+		r8: buf.readBigUInt64LE(184),
+		r9: buf.readBigUInt64LE(192),
+		r10: buf.readBigUInt64LE(200),
+		r11: buf.readBigUInt64LE(208),
+		r12: buf.readBigUInt64LE(216),
+		r13: buf.readBigUInt64LE(224),
+		r14: buf.readBigUInt64LE(232),
+		r15: buf.readBigUInt64LE(240),
+		rip: buf.readBigUInt64LE(248)
+	};
+}
+/** Write x64 CONTEXT fields into a raw buffer */
+function writeContext(buf, ctx) {
+	if (ctx.contextFlags !== void 0) buf.writeUInt32LE(ctx.contextFlags, 48);
+	if (ctx.eflags !== void 0) buf.writeUInt32LE(ctx.eflags, 68);
+	if (ctx.dr0 !== void 0) buf.writeBigUInt64LE(ctx.dr0, 72);
+	if (ctx.dr1 !== void 0) buf.writeBigUInt64LE(ctx.dr1, 80);
+	if (ctx.dr2 !== void 0) buf.writeBigUInt64LE(ctx.dr2, 88);
+	if (ctx.dr3 !== void 0) buf.writeBigUInt64LE(ctx.dr3, 96);
+	if (ctx.dr6 !== void 0) buf.writeBigUInt64LE(ctx.dr6, 104);
+	if (ctx.dr7 !== void 0) buf.writeBigUInt64LE(ctx.dr7, 112);
+	if (ctx.rip !== void 0) buf.writeBigUInt64LE(ctx.rip, 248);
+}
+let kernel32Debug = null;
+function getKernel32() {
+	if (!kernel32Debug) {
+		kernel32Debug = koffi.load("kernel32.dll");
+		logger.debug("Loaded kernel32.dll for debug APIs");
+	}
+	return kernel32Debug;
+}
+/** Open a thread handle */
+function OpenThread(dwDesiredAccess, bInheritHandle, dwThreadId) {
+	return getKernel32().func("void * OpenThread(uint32, int, uint32)")(dwDesiredAccess, bInheritHandle ? 1 : 0, dwThreadId);
+}
+/** Suspend a thread, returns previous suspend count */
+function SuspendThread(hThread) {
+	const result = getKernel32().func("uint32 SuspendThread(void *)")(hThread);
+	if (result === 4294967295) throw new Error(`SuspendThread failed. Error: 0x${GetLastError().toString(16)}`);
+	return result;
+}
+/** Resume a thread, returns previous suspend count */
+function ResumeThread(hThread) {
+	const result = getKernel32().func("uint32 ResumeThread(void *)")(hThread);
+	if (result === 4294967295) throw new Error(`ResumeThread failed. Error: 0x${GetLastError().toString(16)}`);
+	return result;
+}
+/** Get thread context (CPU registers including debug registers) */
+function GetThreadContext(hThread, contextFlags) {
+	const fn = getKernel32().func("int GetThreadContext(void *, _Inout_ uint8_t[1232])");
+	const buf = Buffer.alloc(CONTEXT_SIZE);
+	buf.writeUInt32LE(contextFlags, 48);
+	if (fn(hThread, buf) === 0) throw new Error(`GetThreadContext failed. Error: 0x${GetLastError().toString(16)}`);
+	return buf;
+}
+/** Set thread context (CPU registers including debug registers) */
+function SetThreadContext(hThread, contextBuf) {
+	if (getKernel32().func("int SetThreadContext(void *, uint8_t[1232])")(hThread, contextBuf) === 0) throw new Error(`SetThreadContext failed. Error: 0x${GetLastError().toString(16)}`);
+}
+/** Attach as debugger to a process */
+function DebugActiveProcess(dwProcessId) {
+	if (getKernel32().func("int DebugActiveProcess(uint32)")(dwProcessId) === 0) throw new Error(`DebugActiveProcess failed for pid ${dwProcessId}. Error: 0x${GetLastError().toString(16)}`);
+}
+/** Detach debugger from process */
+function DebugActiveProcessStop(dwProcessId) {
+	if (getKernel32().func("int DebugActiveProcessStop(uint32)")(dwProcessId) === 0) throw new Error(`DebugActiveProcessStop failed. Error: 0x${GetLastError().toString(16)}`);
+}
+/** Don't kill the process when debugger detaches */
+function DebugSetProcessKillOnExit(killOnExit) {
+	getKernel32().func("int DebugSetProcessKillOnExit(int)")(killOnExit ? 1 : 0);
+}
+function WaitForDebugEvent(timeoutMs) {
+	const fn = getKernel32().func("int WaitForDebugEvent(_Out_ uint8_t[176], uint32)");
+	const buf = Buffer.alloc(176);
+	if (fn(buf, timeoutMs) === 0) return null;
+	const info = {
+		debugEventCode: buf.readUInt32LE(0),
+		processId: buf.readUInt32LE(4),
+		threadId: buf.readUInt32LE(8)
+	};
+	if (info.debugEventCode === DEBUG_EVENT_CODE.EXCEPTION_DEBUG_EVENT) {
+		info.exceptionCode = buf.readUInt32LE(16);
+		info.exceptionAddress = buf.readBigUInt64LE(32);
+		info.firstChance = buf.readUInt32LE(20) === 0;
+	}
+	return info;
+}
+/** Continue after handling a debug event */
+function ContinueDebugEvent(dwProcessId, dwThreadId, dwContinueStatus) {
+	if (getKernel32().func("int ContinueDebugEvent(uint32, uint32, uint32)")(dwProcessId, dwThreadId, dwContinueStatus) === 0) throw new Error(`ContinueDebugEvent failed. Error: 0x${GetLastError().toString(16)}`);
+}
+/** Flush instruction cache after writing code */
+function FlushInstructionCache(hProcess, lpBaseAddress, dwSize) {
+	getKernel32().func("int FlushInstructionCache(void *, void *, size_t)")(hProcess, lpBaseAddress, BigInt(dwSize));
+}
+/**
+* Enumerate all thread IDs of a process using CreateToolhelp32Snapshot.
+*
+* THREADENTRY32 layout (28 bytes):
+*   +0x00: dwSize (uint32)
+*   +0x04: cntUsage (uint32)
+*   +0x08: th32ThreadID (uint32)
+*   +0x0C: th32OwnerProcessID (uint32)
+*   +0x10: tpBasePri (int32)
+*   +0x14: tpDeltaPri (int32)
+*   +0x18: dwFlags (uint32)
+*/
+function EnumerateProcessThreads(pid) {
+	const fnSnapshot = getKernel32().func("void * CreateToolhelp32Snapshot(uint32, uint32)");
+	const fnFirst = getKernel32().func("int Thread32First(void *, _Inout_ uint8_t[28])");
+	const fnNext = getKernel32().func("int Thread32Next(void *, _Inout_ uint8_t[28])");
+	const snapshot = fnSnapshot(TH32CS.SNAPTHREAD, 0);
+	if (snapshot === 0n || snapshot === BigInt("0xFFFFFFFFFFFFFFFF")) throw new Error(`CreateToolhelp32Snapshot failed. Error: 0x${GetLastError().toString(16)}`);
+	const threads = [];
+	const entry = Buffer.alloc(28);
+	entry.writeUInt32LE(28, 0);
+	try {
+		if (fnFirst(snapshot, entry) !== 0) do {
+			if (entry.readUInt32LE(12) === pid) threads.push(entry.readUInt32LE(8));
+			entry.writeUInt32LE(28, 0);
+		} while (fnNext(snapshot, entry) !== 0);
+		CloseHandle(snapshot);
+	} catch (e) {
+		console.error("[EnumerateProcessThreads] cleanup error:", e);
+	}
+	return threads;
+}
+/** Open a thread with debug-appropriate access rights */
+function openThreadForDebug(threadId) {
+	const handle = OpenThread(THREAD_ACCESS.SUSPEND_RESUME | THREAD_ACCESS.GET_CONTEXT | THREAD_ACCESS.SET_CONTEXT | THREAD_ACCESS.QUERY_INFORMATION, false, threadId);
+	if (handle === 0n) throw new Error(`Failed to open thread ${threadId}. Error: 0x${GetLastError().toString(16)}`);
+	return handle;
+}
+/**
+* Encode DR7 breakpoint configuration.
+*
+* DR7 layout (x64):
+* Bits 0-7: Local/Global enable for DR0-DR3 (L0, G0, L1, G1, ...)
+* Bits 16-17: DR0 condition (00=exec, 01=write, 11=readwrite)
+* Bits 18-19: DR0 size (00=1byte, 01=2byte, 11=4byte, 10=8byte)
+* Bits 20-21: DR1 condition
+* Bits 22-23: DR1 size
+* Bits 24-25: DR2 condition
+* Bits 26-27: DR2 size
+* Bits 28-29: DR3 condition
+* Bits 30-31: DR3 size
+*/
+function encodeDR7(entries) {
+	let dr7 = 0n;
+	for (const entry of entries) {
+		if (!entry.enabled) continue;
+		const { drIndex, access, size } = entry;
+		dr7 |= 1n << BigInt(drIndex * 2);
+		let condition = 0;
+		switch (access) {
+			case "execute":
+				condition = 0;
+				break;
+			case "write":
+				condition = 1;
+				break;
+			case "readwrite":
+			case "read":
+				condition = 3;
+				break;
+		}
+		dr7 |= BigInt(condition) << BigInt(16 + drIndex * 4);
+		let sizeCode = 0;
+		switch (size) {
+			case 1:
+				sizeCode = 0;
+				break;
+			case 2:
+				sizeCode = 1;
+				break;
+			case 4:
+				sizeCode = 3;
+				break;
+			case 8:
+				sizeCode = 2;
+				break;
+		}
+		dr7 |= BigInt(sizeCode) << BigInt(18 + drIndex * 4);
+	}
+	return dr7;
+}
+//#endregion
+export { openThreadForDebug as _, DebugActiveProcessStop as a, EnumerateProcessThreads as c, ResumeThread as d, SetThreadContext as f, encodeDR7 as g, WaitForDebugEvent as h, DebugActiveProcess as i, FlushInstructionCache as l, TH32CS as m, ContinueDebugEvent as n, DebugSetProcessKillOnExit as o, SuspendThread as p, DBG as r, EXCEPTION_CODE as s, CONTEXT_FLAGS as t, GetThreadContext as u, parseContext as v, writeContext as y };