@jshookmcp/jshook 0.2.5 → 0.2.7

package/dist/src/native/NativeMemoryManager.utils.js

@@ -1,240 +0,0 @@
-import { PAGE, MEM, MEM_TYPE, isKoffiAvailable as isWin32KoffiAvailable, } from './Win32API.js';
-export function isKoffiAvailable() {
-    return isWin32KoffiAvailable();
-}
-export function parsePattern(pattern, patternType) {
-    const patternBytes = [];
-    const mask = [];
-    switch (patternType) {
-        case 'hex': {
-            const parts = pattern.trim().split(/\s+/);
-            for (const part of parts) {
-                if (part === '??' || part === '**' || part === '?') {
-                    patternBytes.push(0);
-                    mask.push(0);
-                }
-                else {
-                    const byte = parseInt(part, 16);
-                    if (!isNaN(byte)) {
-                        patternBytes.push(byte);
-                        mask.push(1);
-                    }
-                }
-            }
-            break;
-        }
-        case 'int32': {
-            const int32Val = parseInt(pattern);
-            if (!isNaN(int32Val)) {
-                const buf = Buffer.allocUnsafe(4);
-                buf.writeInt32LE(int32Val, 0);
-                patternBytes.push(...buf);
-                mask.push(1, 1, 1, 1);
-            }
-            break;
-        }
-        case 'int64': {
-            const int64Val = BigInt(pattern);
-            const buf64 = Buffer.allocUnsafe(8);
-            buf64.writeBigInt64LE(int64Val, 0);
-            patternBytes.push(...buf64);
-            mask.push(1, 1, 1, 1, 1, 1, 1, 1);
-            break;
-        }
-        case 'float': {
-            const floatVal = parseFloat(pattern);
-            if (!isNaN(floatVal)) {
-                const bufFloat = Buffer.allocUnsafe(4);
-                bufFloat.writeFloatLE(floatVal, 0);
-                patternBytes.push(...bufFloat);
-                mask.push(1, 1, 1, 1);
-            }
-            break;
-        }
-        case 'double': {
-            const doubleVal = parseFloat(pattern);
-            if (!isNaN(doubleVal)) {
-                const bufDouble = Buffer.allocUnsafe(8);
-                bufDouble.writeDoubleLE(doubleVal, 0);
-                patternBytes.push(...bufDouble);
-                mask.push(1, 1, 1, 1, 1, 1, 1, 1);
-            }
-            break;
-        }
-        case 'string': {
-            const strBuf = Buffer.from(pattern, 'utf8');
-            patternBytes.push(...strBuf);
-            mask.push(...strBuf.map(() => 1));
-            break;
-        }
-        case 'byte': {
-            const byteVal = parseInt(pattern) & 0xff;
-            patternBytes.push(byteVal);
-            mask.push(1);
-            break;
-        }
-        case 'int8': {
-            const int8Val = parseInt(pattern);
-            const buf8 = Buffer.allocUnsafe(1);
-            buf8.writeInt8(int8Val, 0);
-            patternBytes.push(...buf8);
-            mask.push(1);
-            break;
-        }
-        case 'int16': {
-            const int16Val = parseInt(pattern);
-            const buf16s = Buffer.allocUnsafe(2);
-            buf16s.writeInt16LE(int16Val, 0);
-            patternBytes.push(...buf16s);
-            mask.push(1, 1);
-            break;
-        }
-        case 'uint16': {
-            const uint16Val = parseInt(pattern);
-            const buf16u = Buffer.allocUnsafe(2);
-            buf16u.writeUInt16LE(uint16Val, 0);
-            patternBytes.push(...buf16u);
-            mask.push(1, 1);
-            break;
-        }
-        case 'uint32': {
-            const uint32Val = parseInt(pattern) >>> 0;
-            const buf32u = Buffer.allocUnsafe(4);
-            buf32u.writeUInt32LE(uint32Val, 0);
-            patternBytes.push(...buf32u);
-            mask.push(1, 1, 1, 1);
-            break;
-        }
-        case 'uint64':
-        case 'pointer': {
-            const uint64Val = BigInt(pattern);
-            const buf64u = Buffer.allocUnsafe(8);
-            buf64u.writeBigUInt64LE(uint64Val, 0);
-            patternBytes.push(...buf64u);
-            mask.push(1, 1, 1, 1, 1, 1, 1, 1);
-            break;
-        }
-    }
-    return { patternBytes, mask };
-}
-function findExactPatternBMH(buffer, pattern) {
-    const matches = [];
-    const patternLength = pattern.length;
-    if (patternLength === 0 || buffer.length < patternLength) {
-        return matches;
-    }
-    const lastIndex = patternLength - 1;
-    const skipTable = new Uint32Array(256);
-    skipTable.fill(patternLength);
-    for (let i = 0; i < lastIndex; i++) {
-        const patternByte = pattern[i];
-        if (patternByte !== undefined) {
-            skipTable[patternByte] = lastIndex - i;
-        }
-    }
-    let offset = 0;
-    while (offset <= buffer.length - patternLength) {
-        let patternIndex = lastIndex;
-        while (patternIndex >= 0 && buffer[offset + patternIndex] === pattern[patternIndex]) {
-            patternIndex--;
-        }
-        if (patternIndex < 0) {
-            matches.push(offset);
-            offset += 1;
-            continue;
-        }
-        const skipByte = buffer[offset + lastIndex];
-        if (skipByte === undefined) {
-            break;
-        }
-        offset += skipTable[skipByte] ?? patternLength;
-    }
-    return matches;
-}
-export function findPatternInBuffer(buffer, pattern, mask) {
-    if (pattern.length === 0) {
-        return [];
-    }
-    if (mask.every((value) => value === 1)) {
-        return findExactPatternBMH(buffer, pattern);
-    }
-    const matches = [];
-    for (let i = 0; i <= buffer.length - pattern.length; i++) {
-        let found = true;
-        for (let j = 0; j < pattern.length; j++) {
-            if (mask[j] === 1 && buffer[i + j] !== pattern[j]) {
-                found = false;
-                break;
-            }
-        }
-        if (found) {
-            matches.push(i);
-        }
-    }
-    return matches;
-}
-export function getStateString(state) {
-    switch (state) {
-        case MEM.COMMIT:
-            return 'COMMIT';
-        case MEM.RESERVE:
-            return 'RESERVE';
-        case MEM.FREE:
-            return 'FREE';
-        default:
-            return 'UNKNOWN';
-    }
-}
-export function getProtectionString(protect) {
-    if (!protect)
-        return 'NOACCESS';
-    const parts = [];
-    if (protect & PAGE.NOACCESS)
-        parts.push('NOACCESS');
-    if (protect & PAGE.READONLY)
-        parts.push('R');
-    if (protect & PAGE.READWRITE)
-        parts.push('RW');
-    if (protect & PAGE.WRITECOPY)
-        parts.push('WC');
-    if (protect & PAGE.EXECUTE)
-        parts.push('X');
-    if (protect & PAGE.EXECUTE_READ)
-        parts.push('RX');
-    if (protect & PAGE.EXECUTE_READWRITE)
-        parts.push('RWX');
-    if (protect & PAGE.GUARD)
-        parts.push('GUARD');
-    return parts.join(' ') || 'UNKNOWN';
-}
-export function getTypeString(type) {
-    switch (type) {
-        case MEM_TYPE.IMAGE:
-            return 'IMAGE';
-        case MEM_TYPE.MAPPED:
-            return 'MAPPED';
-        case MEM_TYPE.PRIVATE:
-            return 'PRIVATE';
-        default:
-            return 'UNKNOWN';
-    }
-}
-export function isReadable(info) {
-    if (info.State !== MEM.COMMIT)
-        return false;
-    return ((info.Protect & PAGE.READONLY) !== 0 ||
-        (info.Protect & PAGE.READWRITE) !== 0 ||
-        (info.Protect & PAGE.WRITECOPY) !== 0 ||
-        (info.Protect & PAGE.EXECUTE_READ) !== 0 ||
-        (info.Protect & PAGE.EXECUTE_READWRITE) !== 0);
-}
-export function isWritable(protect) {
-    return ((protect & PAGE.READWRITE) !== 0 ||
-        (protect & PAGE.WRITECOPY) !== 0 ||
-        (protect & PAGE.EXECUTE_READWRITE) !== 0);
-}
-export function isExecutable(protect) {
-    return ((protect & PAGE.EXECUTE) !== 0 ||
-        (protect & PAGE.EXECUTE_READ) !== 0 ||
-        (protect & PAGE.EXECUTE_READWRITE) !== 0);
-}

package/dist/src/native/PEAnalyzer.d.ts

@@ -1,16 +0,0 @@
-import type { PEHeaders, PESection, ImportEntry, ExportEntry, InlineHookDetection, SectionAnomaly } from './PEAnalyzer.types.js';
-export declare class PEAnalyzer {
-    parseHeaders(pid: number, moduleBase: string): Promise<PEHeaders>;
-    listSections(pid: number, moduleBase: string): Promise<PESection[]>;
-    parseImports(pid: number, moduleBase: string): Promise<ImportEntry[]>;
-    parseExports(pid: number, moduleBase: string): Promise<ExportEntry[]>;
-    detectInlineHooks(pid: number, moduleName?: string): Promise<InlineHookDetection[]>;
-    analyzeSections(pid: number, moduleBase: string): Promise<SectionAnomaly[]>;
-    private _readCoreHeaders;
-    private _readThunkArray;
-    private _enumerateModulesInternal;
-    private _rvaToFileOffset;
-    private _classifyHook;
-    private _decodeJumpTarget;
-}
-export declare const peAnalyzer: PEAnalyzer;

package/dist/src/native/PEAnalyzer.js

@@ -1,379 +0,0 @@
-import { promises as fs } from 'node:fs';
-import { logger } from '../utils/logger.js';
-import { openProcessForMemory, CloseHandle, ReadProcessMemory, EnumProcessModules, GetModuleBaseName, GetModuleFileNameEx, GetModuleInformation, } from './Win32API.js';
-import { IMAGE_SCN, IMAGE_DIRECTORY_ENTRY } from './PEAnalyzer.types.js';
-const MZ_MAGIC = 0x5a4d;
-const PE_SIGNATURE = 0x00004550;
-const PE32PLUS_MAGIC = 0x20b;
-const SECTION_HEADER_SIZE = 40;
-const IMPORT_DESCRIPTOR_SIZE = 20;
-const COMPARE_BYTES = 16;
-export class PEAnalyzer {
-    async parseHeaders(pid, moduleBase) {
-        const base = BigInt(moduleBase);
-        const hProcess = openProcessForMemory(pid);
-        try {
-            const dosData = ReadProcessMemory(hProcess, base, 64);
-            const e_magic = dosData.readUInt16LE(0);
-            if (e_magic !== MZ_MAGIC) {
-                throw new Error(`Invalid DOS header: expected 0x5A4D, got 0x${e_magic.toString(16)}`);
-            }
-            const e_lfanew = dosData.readUInt32LE(60);
-            const ntData = ReadProcessMemory(hProcess, base + BigInt(e_lfanew), 264);
-            const ntSignature = ntData.readUInt32LE(0);
-            if (ntSignature !== PE_SIGNATURE) {
-                throw new Error(`Invalid PE signature: expected 0x4550, got 0x${ntSignature.toString(16)}`);
-            }
-            const machine = ntData.readUInt16LE(4);
-            const numberOfSections = ntData.readUInt16LE(6);
-            const timeDateStamp = ntData.readUInt32LE(8);
-            const characteristics = ntData.readUInt16LE(22);
-            const magic = ntData.readUInt16LE(24);
-            const isPE32Plus = magic === PE32PLUS_MAGIC;
-            let imageBase;
-            let entryPoint;
-            let sizeOfImage;
-            let numberOfRvaAndSizes;
-            if (isPE32Plus) {
-                entryPoint = ntData.readUInt32LE(40);
-                imageBase = ntData.readBigUInt64LE(48);
-                sizeOfImage = ntData.readUInt32LE(80);
-                numberOfRvaAndSizes = ntData.readUInt32LE(132);
-            }
-            else {
-                entryPoint = ntData.readUInt32LE(40);
-                imageBase = BigInt(ntData.readUInt32LE(52));
-                sizeOfImage = ntData.readUInt32LE(80);
-                numberOfRvaAndSizes = ntData.readUInt32LE(116);
-            }
-            return {
-                dosHeader: { e_magic, e_lfanew },
-                ntSignature,
-                fileHeader: { machine, numberOfSections, timeDateStamp, characteristics },
-                optionalHeader: {
-                    magic,
-                    imageBase: `0x${imageBase.toString(16)}`,
-                    entryPoint: `0x${entryPoint.toString(16)}`,
-                    sizeOfImage,
-                    numberOfRvaAndSizes,
-                },
-            };
-        }
-        finally {
-            CloseHandle(hProcess);
-        }
-    }
-    async listSections(pid, moduleBase) {
-        const base = BigInt(moduleBase);
-        const hProcess = openProcessForMemory(pid);
-        try {
-            const headers = await this._readCoreHeaders(hProcess, base);
-            const sections = [];
-            for (let i = 0; i < headers.numSections; i++) {
-                const off = headers.firstSectionOffset + i * SECTION_HEADER_SIZE;
-                const secData = ReadProcessMemory(hProcess, base + BigInt(off), SECTION_HEADER_SIZE);
-                const nameEnd = secData.indexOf(0);
-                const name = secData
-                    .subarray(0, nameEnd > 0 && nameEnd <= 8 ? nameEnd : 8)
-                    .toString('ascii');
-                const virtualSize = secData.readUInt32LE(8);
-                const virtualAddress = secData.readUInt32LE(12);
-                const rawSize = secData.readUInt32LE(16);
-                const chars = secData.readUInt32LE(36);
-                sections.push({
-                    name,
-                    virtualAddress: `0x${virtualAddress.toString(16)}`,
-                    virtualSize,
-                    rawSize,
-                    characteristics: chars,
-                    isExecutable: (chars & IMAGE_SCN.MEM_EXECUTE) !== 0,
-                    isWritable: (chars & IMAGE_SCN.MEM_WRITE) !== 0,
-                    isReadable: (chars & IMAGE_SCN.MEM_READ) !== 0,
-                });
-            }
-            return sections;
-        }
-        finally {
-            CloseHandle(hProcess);
-        }
-    }
-    async parseImports(pid, moduleBase) {
-        const base = BigInt(moduleBase);
-        const hProcess = openProcessForMemory(pid);
-        try {
-            const headers = await this._readCoreHeaders(hProcess, base);
-            const importRva = headers.dataDirectories[IMAGE_DIRECTORY_ENTRY.IMPORT];
-            if (!importRva || importRva.rva === 0)
-                return [];
-            const imports = [];
-            let descOffset = importRva.rva;
-            for (let i = 0; i < 500; i++) {
-                const desc = ReadProcessMemory(hProcess, base + BigInt(descOffset), IMPORT_DESCRIPTOR_SIZE);
-                const nameRva = desc.readUInt32LE(12);
-                if (nameRva === 0)
-                    break;
-                const nameData = ReadProcessMemory(hProcess, base + BigInt(nameRva), 256);
-                const nullIdx = nameData.indexOf(0);
-                const dllName = nameData.subarray(0, nullIdx > 0 ? nullIdx : 256).toString('ascii');
-                const originalFirstThunkRva = desc.readUInt32LE(0) || desc.readUInt32LE(16);
-                const functions = this._readThunkArray(hProcess, base, originalFirstThunkRva, headers.isPE32Plus);
-                imports.push({ dllName, functions });
-                descOffset += IMPORT_DESCRIPTOR_SIZE;
-            }
-            return imports;
-        }
-        finally {
-            CloseHandle(hProcess);
-        }
-    }
-    async parseExports(pid, moduleBase) {
-        const base = BigInt(moduleBase);
-        const hProcess = openProcessForMemory(pid);
-        try {
-            const headers = await this._readCoreHeaders(hProcess, base);
-            const exportDir = headers.dataDirectories[IMAGE_DIRECTORY_ENTRY.EXPORT];
-            if (!exportDir || exportDir.rva === 0)
-                return [];
-            const expData = ReadProcessMemory(hProcess, base + BigInt(exportDir.rva), 40);
-            const numberOfNames = expData.readUInt32LE(24);
-            const addressOfFunctionsRva = expData.readUInt32LE(28);
-            const addressOfNamesRva = expData.readUInt32LE(32);
-            const addressOfNameOrdinalsRva = expData.readUInt32LE(36);
-            const ordinalBase = expData.readUInt32LE(16);
-            const exports = [];
-            const namesBuf = ReadProcessMemory(hProcess, base + BigInt(addressOfNamesRva), numberOfNames * 4);
-            const ordsBuf = ReadProcessMemory(hProcess, base + BigInt(addressOfNameOrdinalsRva), numberOfNames * 2);
-            for (let i = 0; i < Math.min(numberOfNames, 2000); i++) {
-                const nameRva = namesBuf.readUInt32LE(i * 4);
-                const ordIndex = ordsBuf.readUInt16LE(i * 2);
-                const nameBuf = ReadProcessMemory(hProcess, base + BigInt(nameRva), 256);
-                const nullIdx = nameBuf.indexOf(0);
-                const name = nameBuf.subarray(0, nullIdx > 0 ? nullIdx : 256).toString('ascii');
-                const funcRva = ReadProcessMemory(hProcess, base + BigInt(addressOfFunctionsRva + ordIndex * 4), 4).readUInt32LE(0);
-                let forwardedTo = null;
-                if (funcRva >= exportDir.rva && funcRva < exportDir.rva + exportDir.size) {
-                    const fwdBuf = ReadProcessMemory(hProcess, base + BigInt(funcRva), 256);
-                    const fwdEnd = fwdBuf.indexOf(0);
-                    forwardedTo = fwdBuf.subarray(0, fwdEnd > 0 ? fwdEnd : 256).toString('ascii');
-                }
-                exports.push({
-                    name,
-                    ordinal: ordinalBase + ordIndex,
-                    rva: `0x${funcRva.toString(16)}`,
-                    forwardedTo,
-                });
-            }
-            return exports;
-        }
-        finally {
-            CloseHandle(hProcess);
-        }
-    }
-    async detectInlineHooks(pid, moduleName) {
-        const hProcess = openProcessForMemory(pid);
-        const detections = [];
-        try {
-            const modules = this._enumerateModulesInternal(hProcess);
-            const targets = moduleName
-                ? modules.filter((m) => m.name.toLowerCase().includes(moduleName.toLowerCase()))
-                : modules;
-            for (const mod of targets) {
-                try {
-                    const diskData = await fs.readFile(mod.path);
-                    const exports = await this.parseExports(pid, mod.base);
-                    for (const exp of exports) {
-                        const funcRva = parseInt(exp.rva, 16);
-                        if (funcRva === 0 || exp.forwardedTo)
-                            continue;
-                        const memBytes = ReadProcessMemory(hProcess, BigInt(mod.base) + BigInt(funcRva), COMPARE_BYTES);
-                        const diskOffset = this._rvaToFileOffset(diskData, funcRva);
-                        if (diskOffset < 0 || diskOffset + COMPARE_BYTES > diskData.length)
-                            continue;
-                        const diskBytes = diskData.subarray(diskOffset, diskOffset + COMPARE_BYTES);
-                        if (!memBytes.equals(diskBytes)) {
-                            const hookType = this._classifyHook(memBytes);
-                            const jumpTarget = this._decodeJumpTarget(memBytes, BigInt(mod.base) + BigInt(funcRva));
-                            detections.push({
-                                address: `0x${(BigInt(mod.base) + BigInt(funcRva)).toString(16)}`,
-                                moduleName: mod.name,
-                                functionName: exp.name,
-                                originalBytes: Array.from(diskBytes),
-                                currentBytes: Array.from(memBytes),
-                                hookType,
-                                jumpTarget,
-                            });
-                        }
-                    }
-                }
-                catch (e) {
-                    logger.debug(`Hook check skipped for ${mod.name}: ${e}`);
-                }
-            }
-        }
-        finally {
-            CloseHandle(hProcess);
-        }
-        return detections;
-    }
-    async analyzeSections(pid, moduleBase) {
-        const sections = await this.listSections(pid, moduleBase);
-        const anomalies = [];
-        for (const sec of sections) {
-            if (sec.isReadable && sec.isWritable && sec.isExecutable) {
-                anomalies.push({
-                    sectionName: sec.name,
-                    anomalyType: 'rwx',
-                    severity: 'high',
-                    details: `Section ${sec.name} has Read+Write+Execute permissions — unusual and potentially malicious`,
-                });
-            }
-            else if (sec.isWritable && sec.isExecutable) {
-                anomalies.push({
-                    sectionName: sec.name,
-                    anomalyType: 'writable_code',
-                    severity: 'high',
-                    details: `Section ${sec.name} is writable and executable — code may be self-modifying or packed`,
-                });
-            }
-            else if (sec.isExecutable &&
-                !sec.name.startsWith('.text') &&
-                !sec.name.startsWith('.code') &&
-                (sec.characteristics & IMAGE_SCN.CNT_INITIALIZED_DATA) !== 0) {
-                anomalies.push({
-                    sectionName: sec.name,
-                    anomalyType: 'executable_data',
-                    severity: 'medium',
-                    details: `Data section ${sec.name} has execute permission`,
-                });
-            }
-        }
-        return anomalies;
-    }
-    async _readCoreHeaders(hProcess, base) {
-        const dosData = ReadProcessMemory(hProcess, base, 64);
-        const e_lfanew = dosData.readUInt32LE(60);
-        const ntData = ReadProcessMemory(hProcess, base + BigInt(e_lfanew), 264);
-        const numSections = ntData.readUInt16LE(6);
-        const sizeOfOptionalHeader = ntData.readUInt16LE(20);
-        const magic = ntData.readUInt16LE(24);
-        const isPE32Plus = magic === PE32PLUS_MAGIC;
-        const numberOfRvaAndSizes = isPE32Plus ? ntData.readUInt32LE(132) : ntData.readUInt32LE(116);
-        const dataDirectoriesOffset = isPE32Plus ? 136 : 120;
-        const dataDirectories = [];
-        for (let i = 0; i < Math.min(numberOfRvaAndSizes, 16); i++) {
-            const off = dataDirectoriesOffset + i * 8;
-            if (off + 8 <= ntData.length) {
-                dataDirectories.push({
-                    rva: ntData.readUInt32LE(off),
-                    size: ntData.readUInt32LE(off + 4),
-                });
-            }
-        }
-        const firstSectionOffset = e_lfanew + 4 + 20 + sizeOfOptionalHeader;
-        return { numSections, isPE32Plus, firstSectionOffset, dataDirectories };
-    }
-    _readThunkArray(hProcess, base, thunkRva, isPE32Plus) {
-        const thunkSize = isPE32Plus ? 8 : 4;
-        const functions = [];
-        const IMAGE_ORDINAL_FLAG = isPE32Plus ? 0x8000000000000000n : 0x80000000n;
-        for (let i = 0; i < 2000; i++) {
-            const thunkData = ReadProcessMemory(hProcess, base + BigInt(thunkRva + i * thunkSize), thunkSize);
-            const thunkValue = isPE32Plus
-                ? thunkData.readBigUInt64LE(0)
-                : BigInt(thunkData.readUInt32LE(0));
-            if (thunkValue === 0n)
-                break;
-            if ((thunkValue & IMAGE_ORDINAL_FLAG) !== 0n) {
-                functions.push({
-                    name: `Ordinal#${Number(thunkValue & 0xffffn)}`,
-                    ordinal: Number(thunkValue & 0xffffn),
-                    hint: 0,
-                    thunkRva: `0x${(thunkRva + i * thunkSize).toString(16)}`,
-                });
-            }
-            else {
-                const hintNameRva = Number(thunkValue);
-                const hintNameData = ReadProcessMemory(hProcess, base + BigInt(hintNameRva), 258);
-                const hint = hintNameData.readUInt16LE(0);
-                const nullIdx = hintNameData.indexOf(0, 2);
-                const name = hintNameData.subarray(2, nullIdx > 2 ? nullIdx : 258).toString('ascii');
-                functions.push({
-                    name,
-                    ordinal: 0,
-                    hint,
-                    thunkRva: `0x${(thunkRva + i * thunkSize).toString(16)}`,
-                });
-            }
-        }
-        return functions;
-    }
-    _enumerateModulesInternal(hProcess) {
-        const modules = [];
-        try {
-            const { modules: modHandles, count } = EnumProcessModules(hProcess);
-            for (let i = 0; i < count; i++) {
-                const hMod = modHandles[i];
-                const name = GetModuleBaseName(hProcess, hMod);
-                const info = GetModuleInformation(hProcess, hMod);
-                const modulePath = GetModuleFileNameEx(hProcess, hMod) ?? name;
-                if (info.success) {
-                    modules.push({
-                        name,
-                        base: `0x${info.info.lpBaseOfDll.toString(16)}`,
-                        path: modulePath,
-                        size: info.info.SizeOfImage,
-                    });
-                }
-            }
-        }
-        catch (e) {
-            logger.debug(`Module enumeration failed: ${e}`);
-        }
-        return modules;
-    }
-    _rvaToFileOffset(peData, rva) {
-        const e_lfanew = peData.readUInt32LE(60);
-        const numSections = peData.readUInt16LE(e_lfanew + 6);
-        const sizeOfOptionalHeader = peData.readUInt16LE(e_lfanew + 20);
-        const secStart = e_lfanew + 24 + sizeOfOptionalHeader;
-        for (let i = 0; i < numSections; i++) {
-            const off = secStart + i * 40;
-            if (off + 40 > peData.length)
-                break;
-            const virtualAddr = peData.readUInt32LE(off + 12);
-            const virtualSize = peData.readUInt32LE(off + 8);
-            const rawOffset = peData.readUInt32LE(off + 20);
-            if (rva >= virtualAddr && rva < virtualAddr + virtualSize) {
-                return rawOffset + (rva - virtualAddr);
-            }
-        }
-        return -1;
-    }
-    _classifyHook(memBytes) {
-        if (memBytes[0] === 0xe9)
-            return 'jmp_rel32';
-        if (memBytes[0] === 0xff && memBytes[1] === 0x25)
-            return 'jmp_abs64';
-        if (memBytes[0] === 0x68 && memBytes[5] === 0xc3)
-            return 'push_ret';
-        return 'unknown';
-    }
-    _decodeJumpTarget(memBytes, funcAddr) {
-        if (memBytes[0] === 0xe9) {
-            const rel32 = memBytes.readInt32LE(1);
-            return `0x${(funcAddr + 5n + BigInt(rel32)).toString(16)}`;
-        }
-        if (memBytes[0] === 0xff && memBytes[1] === 0x25) {
-            if (memBytes.length >= 14) {
-                const target = memBytes.readBigUInt64LE(6);
-                return `0x${target.toString(16)}`;
-            }
-        }
-        if (memBytes[0] === 0x68) {
-            const target = memBytes.readUInt32LE(1);
-            return `0x${target.toString(16)}`;
-        }
-        return '0x0';
-    }
-}
-export const peAnalyzer = new PEAnalyzer();