@jshookmcp/jshook 0.2.5 → 0.2.7

package/dist/src/native/StructureAnalyzer.js

@@ -1,468 +0,0 @@
-import { STRUCT_ANALYZE_DEFAULT_SIZE, STRUCT_VTABLE_MAX_FUNCTIONS, STRUCT_RTTI_MAX_STRING_LEN, } from '../constants.js';
-import { createPlatformProvider } from './platform/factory.js';
-import { nativeMemoryManager } from './NativeMemoryManager.impl.js';
-export class StructureAnalyzer {
-    _provider = null;
-    get provider() {
-        if (!this._provider) {
-            this._provider = createPlatformProvider();
-        }
-        return this._provider;
-    }
-    async analyzeStructure(pid, address, options) {
-        const size = options?.size ?? STRUCT_ANALYZE_DEFAULT_SIZE;
-        const baseAddr = BigInt(address.startsWith('0x') ? address : `0x${address}`);
-        const handle = this.provider.openProcess(pid, false);
-        try {
-            const buf = this.provider.readMemory(handle, baseAddr, size).data;
-            const fields = [];
-            let offset = 0;
-            while (offset < size) {
-                const remaining = size - offset;
-                if (remaining < 1)
-                    break;
-                const classification = this.classifyValue(buf, handle, baseAddr, offset, remaining);
-                fields.push({
-                    offset,
-                    size: classification.size,
-                    type: classification.type,
-                    name: `field_0x${offset.toString(16).padStart(2, '0').toUpperCase()}`,
-                    value: classification.value,
-                    confidence: classification.confidence,
-                    notes: classification.notes,
-                });
-                offset += classification.size;
-            }
-            let vtableAddress;
-            let className;
-            let baseClasses;
-            if (fields.length > 0 && fields[0].type === 'vtable_ptr') {
-                vtableAddress = fields[0].value;
-                if (options?.parseRtti !== false && vtableAddress) {
-                    try {
-                        const rtti = await this.parseRtti(pid, vtableAddress, handle);
-                        if (rtti) {
-                            className = rtti.className;
-                            baseClasses = rtti.baseClasses;
-                        }
-                    }
-                    catch {
-                    }
-                }
-            }
-            return {
-                baseAddress: `0x${baseAddr.toString(16).toUpperCase()}`,
-                totalSize: size,
-                fields,
-                vtableAddress,
-                className,
-                baseClasses,
-                timestamp: Date.now(),
-            };
-        }
-        finally {
-            this.provider.closeProcess(handle);
-        }
-    }
-    async parseVtable(pid, vtableAddress) {
-        const vtableAddr = BigInt(vtableAddress.startsWith('0x') ? vtableAddress : `0x${vtableAddress}`);
-        const handle = this.provider.openProcess(pid, false);
-        try {
-            const functions = [];
-            const modules = await this.getModuleEntries(pid);
-            for (let i = 0; i < STRUCT_VTABLE_MAX_FUNCTIONS; i++) {
-                const ptrAddr = vtableAddr + BigInt(i * 8);
-                let funcPtr;
-                try {
-                    const buf = this.provider.readMemory(handle, ptrAddr, 8).data;
-                    funcPtr = buf.readBigUInt64LE(0);
-                }
-                catch {
-                    break;
-                }
-                if (!this.isValidExecutablePointer(handle, funcPtr))
-                    break;
-                const modInfo = this.resolveToModule(funcPtr, modules);
-                functions.push({
-                    index: i,
-                    address: `0x${funcPtr.toString(16).toUpperCase()}`,
-                    module: modInfo?.module,
-                    moduleOffset: modInfo?.offset,
-                });
-            }
-            let rttiName;
-            let baseClassList;
-            try {
-                const rtti = await this.parseRtti(pid, vtableAddress, handle);
-                if (rtti) {
-                    rttiName = rtti.className;
-                    baseClassList = rtti.baseClasses;
-                }
-            }
-            catch {
-            }
-            return {
-                address: `0x${vtableAddr.toString(16).toUpperCase()}`,
-                functionCount: functions.length,
-                functions,
-                rttiName,
-                baseClasses: baseClassList,
-            };
-        }
-        finally {
-            this.provider.closeProcess(handle);
-        }
-    }
-    async parseRtti(pid, vtableAddress, existingHandle) {
-        const vtableAddr = BigInt(vtableAddress.startsWith('0x') ? vtableAddress : `0x${vtableAddress}`);
-        const ownHandle = !existingHandle;
-        const handle = existingHandle ?? this.provider.openProcess(pid, false);
-        try {
-            const colPtrBuf = this.provider.readMemory(handle, vtableAddr - 8n, 8).data;
-            const colAddr = colPtrBuf.readBigUInt64LE(0);
-            if (!this.isValidReadablePointer(handle, colAddr))
-                return null;
-            const colBuf = this.provider.readMemory(handle, colAddr, 0x18).data;
-            const signature = colBuf.readUInt32LE(0);
-            if (signature !== 1)
-                return null;
-            const typeDescRVA = colBuf.readUInt32LE(0x0c);
-            const classDescRVA = colBuf.readUInt32LE(0x10);
-            const objectLocRVA = colBuf.readUInt32LE(0x14);
-            const moduleBase = colAddr - BigInt(objectLocRVA);
-            const typeDescAddr = moduleBase + BigInt(typeDescRVA);
-            const className = this.readCString(handle, typeDescAddr + 0x10n, STRUCT_RTTI_MAX_STRING_LEN);
-            if (!className)
-                return null;
-            const demangled = this.demangleMsvcName(className);
-            const baseClasses = [];
-            try {
-                const classDescAddr = moduleBase + BigInt(classDescRVA);
-                const classDescBuf = this.provider.readMemory(handle, classDescAddr, 0x10).data;
-                const numBaseClasses = classDescBuf.readUInt32LE(0x08);
-                const baseClassArrayRVA = classDescBuf.readUInt32LE(0x0c);
-                if (numBaseClasses > 0 && numBaseClasses < 20) {
-                    const baseArrayAddr = moduleBase + BigInt(baseClassArrayRVA);
-                    const baseArrayBuf = this.provider.readMemory(handle, baseArrayAddr, numBaseClasses * 4).data;
-                    for (let i = 1; i < numBaseClasses; i++) {
-                        const baseDescRVA = baseArrayBuf.readUInt32LE(i * 4);
-                        const baseDescAddr = moduleBase + BigInt(baseDescRVA);
-                        try {
-                            const baseDescBuf = this.provider.readMemory(handle, baseDescAddr, 0x08).data;
-                            const baseTypeDescRVA = baseDescBuf.readUInt32LE(0);
-                            const baseTypeDescAddr = moduleBase + BigInt(baseTypeDescRVA);
-                            const baseName = this.readCString(handle, baseTypeDescAddr + 0x10n, STRUCT_RTTI_MAX_STRING_LEN);
-                            if (baseName) {
-                                baseClasses.push(this.demangleMsvcName(baseName));
-                            }
-                        }
-                        catch {
-                            break;
-                        }
-                    }
-                }
-            }
-            catch {
-            }
-            return { className: demangled, baseClasses };
-        }
-        catch {
-            return null;
-        }
-        finally {
-            if (ownHandle)
-                this.provider.closeProcess(handle);
-        }
-    }
-    exportToCStruct(structure, name) {
-        const structName = name ?? structure.className ?? 'UnknownStruct';
-        const lines = [];
-        lines.push(`struct ${structName} { // size: 0x${structure.totalSize.toString(16).toUpperCase()} (${structure.totalSize} bytes)`);
-        for (const field of structure.fields) {
-            const cType = this.fieldTypeToCType(field.type, field.size);
-            const offsetStr = `0x${field.offset.toString(16).padStart(2, '0').toUpperCase()}`;
-            const comment = field.notes
-                ? `// +${offsetStr} ${field.notes}`
-                : `// +${offsetStr} = ${field.value}`;
-            if (field.type === 'padding') {
-                lines.push(`    uint8_t _pad_${field.offset.toString(16)}[${field.size}]; ${comment}`);
-            }
-            else {
-                lines.push(`    ${cType} ${field.name}; ${comment}`);
-            }
-        }
-        lines.push('};');
-        const definition = lines.join('\n');
-        return {
-            name: structName,
-            definition,
-            size: structure.totalSize,
-            fieldCount: structure.fields.filter((f) => f.type !== 'padding').length,
-        };
-    }
-    async compareInstances(pid, address1, address2, size) {
-        const analysisSize = size ?? STRUCT_ANALYZE_DEFAULT_SIZE;
-        const [struct1, struct2] = await Promise.all([
-            this.analyzeStructure(pid, address1, { size: analysisSize, parseRtti: false }),
-            this.analyzeStructure(pid, address2, { size: analysisSize, parseRtti: false }),
-        ]);
-        const matching = [];
-        const differing = [];
-        const fieldMap2 = new Map(struct2.fields.map((f) => [f.offset, f]));
-        for (const f1 of struct1.fields) {
-            const f2 = fieldMap2.get(f1.offset);
-            if (!f2)
-                continue;
-            if (f1.value === f2.value && f1.type === f2.type) {
-                matching.push(f1);
-            }
-            else {
-                differing.push({
-                    offset: f1.offset,
-                    value1: f1.value,
-                    value2: f2.value,
-                    type: f1.type,
-                });
-            }
-        }
-        return { matching, differing };
-    }
-    classifyValue(buf, handle, _baseAddr, offset, remaining) {
-        if (remaining >= 8) {
-            const val64 = buf.readBigUInt64LE(offset);
-            if (offset === 0 && val64 !== 0n) {
-                if (this.isValidExecutablePointer(handle, val64)) {
-                    try {
-                        const vtableCheck = this.provider.readMemory(handle, val64, 16).data;
-                        const firstFunc = vtableCheck.readBigUInt64LE(0);
-                        if (this.isValidExecutablePointer(handle, firstFunc)) {
-                            return {
-                                type: 'vtable_ptr',
-                                size: 8,
-                                value: `0x${val64.toString(16).toUpperCase()}`,
-                                confidence: 0.9,
-                                notes: 'likely vtable pointer (points to array of executable pointers)',
-                            };
-                        }
-                    }
-                    catch {
-                    }
-                }
-            }
-            if (val64 !== 0n && val64 > 0x10000n && val64 < 0x7fffffffffffn) {
-                if (this.isValidReadablePointer(handle, val64)) {
-                    const str = this.readCString(handle, val64, 64);
-                    if (str && str.length >= 2) {
-                        return {
-                            type: 'string_ptr',
-                            size: 8,
-                            value: `0x${val64.toString(16).toUpperCase()} → "${str.slice(0, 32)}${str.length > 32 ? '...' : ''}"`,
-                            confidence: 0.75,
-                            notes: `string pointer: "${str.slice(0, 64)}"`,
-                        };
-                    }
-                    return {
-                        type: 'pointer',
-                        size: 8,
-                        value: `0x${val64.toString(16).toUpperCase()}`,
-                        confidence: 0.7,
-                        notes: 'valid pointer to readable memory',
-                    };
-                }
-            }
-        }
-        if (remaining >= 4) {
-            const val32u = buf.readUInt32LE(offset);
-            const val32s = buf.readInt32LE(offset);
-            const valFloat = buf.readFloatLE(offset);
-            if (val32u === 0 && remaining >= 8 && buf.readUInt32LE(offset + 4) === 0) {
-                let zeroLen = 0;
-                for (let i = offset; i < buf.length && buf[i] === 0; i++)
-                    zeroLen++;
-                const padSize = Math.min(zeroLen, remaining);
-                const alignedPad = padSize & ~7;
-                return {
-                    type: 'padding',
-                    size: alignedPad,
-                    value: `0x${'00'.repeat(Math.min(alignedPad, 8))}`,
-                    confidence: 0.6,
-                };
-            }
-            if (val32u === 0) {
-                return {
-                    type: 'int32',
-                    size: 4,
-                    value: '0',
-                    confidence: 0.4,
-                    notes: 'zero value — could be int, bool, or padding',
-                };
-            }
-            if (val32u === 1) {
-                return {
-                    type: 'bool',
-                    size: 4,
-                    value: 'true',
-                    confidence: 0.5,
-                    notes: 'value is 1 — could be boolean',
-                };
-            }
-            if (isFinite(valFloat) &&
-                !isNaN(valFloat) &&
-                Math.abs(valFloat) > 1e-10 &&
-                Math.abs(valFloat) < 1e8) {
-                const intLooksReasonable = val32u > 0 && val32u < 100_000;
-                const floatHasDecimals = Math.abs(valFloat - Math.round(valFloat)) > 0.001;
-                if (floatHasDecimals || (!intLooksReasonable && Math.abs(valFloat) < 10000)) {
-                    return {
-                        type: 'float',
-                        size: 4,
-                        value: valFloat.toFixed(6),
-                        confidence: floatHasDecimals ? 0.8 : 0.5,
-                        notes: floatHasDecimals
-                            ? 'IEEE 754 float with fractional part'
-                            : 'could be float or int',
-                    };
-                }
-            }
-            if (val32u < 0x80000000) {
-                return {
-                    type: 'int32',
-                    size: 4,
-                    value: val32s.toString(),
-                    confidence: 0.6,
-                };
-            }
-            return {
-                type: 'uint32',
-                size: 4,
-                value: val32u.toString(),
-                confidence: 0.5,
-            };
-        }
-        if (remaining >= 2) {
-            const val16 = buf.readUInt16LE(offset);
-            return {
-                type: 'uint16',
-                size: 2,
-                value: val16.toString(),
-                confidence: 0.4,
-            };
-        }
-        const val8 = buf.readUInt8(offset);
-        return {
-            type: 'uint8',
-            size: 1,
-            value: val8.toString(),
-            confidence: 0.3,
-        };
-    }
-    isValidReadablePointer(handle, address) {
-        try {
-            const regionInfo = this.provider.queryRegion(handle, address);
-            if (!regionInfo)
-                return false;
-            return regionInfo.isReadable;
-        }
-        catch {
-            return false;
-        }
-    }
-    isValidExecutablePointer(handle, address) {
-        try {
-            const regionInfo = this.provider.queryRegion(handle, address);
-            if (!regionInfo)
-                return false;
-            return regionInfo.isReadable && regionInfo.isExecutable;
-        }
-        catch {
-            return false;
-        }
-    }
-    readCString(handle, address, maxLen) {
-        try {
-            const buf = this.provider.readMemory(handle, address, maxLen).data;
-            const nullIdx = buf.indexOf(0);
-            if (nullIdx < 0)
-                return null;
-            const str = buf.subarray(0, nullIdx).toString('ascii');
-            if (/^[\x20-\x7E]+$/.test(str) && str.length >= 1) {
-                return str;
-            }
-            return null;
-        }
-        catch {
-            return null;
-        }
-    }
-    demangleMsvcName(name) {
-        const match = name.match(/\.?\?A[VU](.+?)@@/);
-        if (match)
-            return match[1];
-        const enumMatch = name.match(/\.?\?AW4(.+?)@@/);
-        if (enumMatch)
-            return enumMatch[1];
-        return name.replace(/^\./, '').replace(/@@$/, '');
-    }
-    fieldTypeToCType(type, size) {
-        switch (type) {
-            case 'int8':
-                return 'int8_t';
-            case 'uint8':
-                return 'uint8_t';
-            case 'int16':
-                return 'int16_t';
-            case 'uint16':
-                return 'uint16_t';
-            case 'int32':
-                return 'int32_t';
-            case 'uint32':
-                return 'uint32_t';
-            case 'int64':
-                return 'int64_t';
-            case 'uint64':
-                return 'uint64_t';
-            case 'float':
-                return 'float';
-            case 'double':
-                return 'double';
-            case 'pointer':
-                return 'void*';
-            case 'vtable_ptr':
-                return 'void**';
-            case 'string_ptr':
-                return 'char*';
-            case 'bool':
-                return 'bool';
-            case 'padding':
-                return `uint8_t[${size}]`;
-            case 'unknown':
-                return `uint8_t[${size}]`;
-            default:
-                return `uint8_t[${size}]`;
-        }
-    }
-    async getModuleEntries(pid) {
-        const modules = new Map();
-        try {
-            const result = await nativeMemoryManager.enumerateModules(pid);
-            if (result.success && result.modules) {
-                for (const mod of result.modules) {
-                    const base = BigInt(mod.baseAddress.startsWith('0x') ? mod.baseAddress : `0x${mod.baseAddress}`);
-                    modules.set(mod.name.toLowerCase(), { name: mod.name, base, size: mod.size });
-                }
-            }
-        }
-        catch {
-        }
-        return modules;
-    }
-    resolveToModule(address, moduleMap) {
-        for (const entry of moduleMap.values()) {
-            if (address >= entry.base && address < entry.base + BigInt(entry.size)) {
-                return { module: entry.name, offset: Number(address - entry.base) };
-            }
-        }
-        return null;
-    }
-}
-export const structureAnalyzer = new StructureAnalyzer();

package/dist/src/native/StructureAnalyzer.types.d.ts

@@ -1,42 +0,0 @@
-export type FieldType = 'int8' | 'uint8' | 'int16' | 'uint16' | 'int32' | 'uint32' | 'int64' | 'uint64' | 'float' | 'double' | 'pointer' | 'vtable_ptr' | 'string_ptr' | 'bool' | 'padding' | 'unknown';
-export interface InferredField {
-    offset: number;
-    size: number;
-    type: FieldType;
-    name: string;
-    value: string;
-    confidence: number;
-    notes?: string;
-}
-export interface InferredStruct {
-    baseAddress: string;
-    totalSize: number;
-    fields: InferredField[];
-    vtableAddress?: string;
-    className?: string;
-    baseClasses?: string[];
-    timestamp: number;
-}
-export interface VtableInfo {
-    address: string;
-    functionCount: number;
-    functions: Array<{
-        index: number;
-        address: string;
-        module?: string;
-        moduleOffset?: number;
-    }>;
-    rttiName?: string;
-    baseClasses?: string[];
-}
-export interface StructureAnalysisOptions {
-    size?: number;
-    otherInstances?: string[];
-    parseRtti?: boolean;
-}
-export interface CStructExport {
-    name: string;
-    definition: string;
-    size: number;
-    fieldCount: number;
-}

package/dist/src/native/StructureAnalyzer.types.js

@@ -1 +0,0 @@
-export {};

package/dist/src/native/Win32API.d.ts

@@ -1,102 +0,0 @@
-export type MemoryBasicInfo = {
-    BaseAddress: bigint;
-    AllocationBase: bigint;
-    AllocationProtect: number;
-    RegionSize: bigint;
-    State: number;
-    Protect: number;
-    Type: number;
-};
-export type ModuleInfoType = {
-    lpBaseOfDll: bigint;
-    SizeOfImage: number;
-    EntryPoint: bigint;
-};
-export declare const PROCESS_ACCESS: {
-    readonly TERMINATE: 1;
-    readonly CREATE_THREAD: 2;
-    readonly SET_SESSIONID: 4;
-    readonly VM_OPERATION: 8;
-    readonly VM_READ: 16;
-    readonly VM_WRITE: 32;
-    readonly DUP_HANDLE: 64;
-    readonly CREATE_PROCESS: 128;
-    readonly SET_QUOTA: 256;
-    readonly SET_INFORMATION: 512;
-    readonly QUERY_INFORMATION: 1024;
-    readonly SUSPEND_RESUME: 2048;
-    readonly QUERY_LIMITED_INFORMATION: 4096;
-    readonly ALL_ACCESS: 2035711;
-};
-export declare const MEM: {
-    readonly COMMIT: 4096;
-    readonly RESERVE: 8192;
-    readonly DECOMMIT: 16384;
-    readonly RELEASE: 32768;
-    readonly FREE: 65536;
-    readonly PRIVATE: 131072;
-    readonly MAPPED: 262144;
-    readonly RESET: 524288;
-    readonly TOP_DOWN: 1048576;
-    readonly WRITE_WATCH: 2097152;
-    readonly PHYSICAL: 4194304;
-    readonly LARGE_PAGES: 536870912;
-};
-export declare const PAGE: {
-    readonly NOACCESS: 1;
-    readonly READONLY: 2;
-    readonly READWRITE: 4;
-    readonly WRITECOPY: 8;
-    readonly EXECUTE: 16;
-    readonly EXECUTE_READ: 32;
-    readonly EXECUTE_READWRITE: 64;
-    readonly EXECUTE_WRITECOPY: 128;
-    readonly GUARD: 256;
-    readonly NOCACHE: 512;
-    readonly WRITECOMBINE: 1024;
-};
-export declare const MEM_TYPE: {
-    readonly IMAGE: 16777216;
-    readonly MAPPED: 262144;
-    readonly PRIVATE: 131072;
-};
-export declare function isKoffiAvailable(): boolean;
-export declare function isWindows(): boolean;
-export declare function OpenProcess(dwDesiredAccess: number, bInheritHandle: boolean, dwProcessId: number): bigint;
-export declare function CloseHandle(hObject: bigint): boolean;
-export declare function ReadProcessMemory(hProcess: bigint, lpBaseAddress: bigint, size: number): Buffer;
-export declare function WriteProcessMemory(hProcess: bigint, lpBaseAddress: bigint, data: Buffer): number;
-export declare function VirtualQueryEx(hProcess: bigint, lpAddress: bigint): {
-    success: boolean;
-    info: MemoryBasicInfo;
-};
-export declare function VirtualProtectEx(hProcess: bigint, lpAddress: bigint, dwSize: number, flNewProtect: number): {
-    success: boolean;
-    oldProtect: number;
-};
-export declare function VirtualAllocEx(hProcess: bigint, lpAddress: bigint, dwSize: number, flAllocationType: number, flProtect: number): bigint;
-export declare function VirtualFreeEx(hProcess: bigint, lpAddress: bigint, dwSize: number, dwFreeType: number): boolean;
-export declare function CreateRemoteThread(hProcess: bigint, lpStartAddress: bigint, lpParameter: bigint): {
-    handle: bigint;
-    threadId: number;
-};
-export declare function GetModuleHandle(lpModuleName: string | null): bigint;
-export declare function GetProcAddress(hModule: bigint, lpProcName: string): bigint;
-export declare function GetLastError(): number;
-export declare function NtQueryInformationProcess(hProcess: bigint, processInformationClass: number): {
-    status: number;
-    debugPort: number;
-};
-export declare function EnumProcessModules(hProcess: bigint, maxModules?: number): {
-    success: boolean;
-    modules: bigint[];
-    count: number;
-};
-export declare function GetModuleBaseName(hProcess: bigint, hModule: bigint, maxSize?: number): string;
-export declare function GetModuleFileNameEx(hProcess: bigint, hModule: bigint, maxSize?: number): string | null;
-export declare function GetModuleInformation(hProcess: bigint, hModule: bigint): {
-    success: boolean;
-    info: ModuleInfoType;
-};
-export declare function openProcessForMemory(pid: number, writeAccess?: boolean): bigint;
-export declare function unloadLibraries(): void;