@jshookmcp/jshook 0.2.6 → 0.2.7

package/README.md

@@ -50,10 +50,8 @@ Provides a comprehensive suite of tools for AI-assisted JavaScript analysis, bro
 The built-in surface below is generated from the runtime registry and checked in CI.
 
 <!-- metadata-sync:start -->
-- Package version: `0.2.6`
-- Built-in domains: `24`
-- Built-in tools: `337`
-- Domains: `antidebug`, `browser`, `coordination`, `core`, `debugger`, `encoding`, `evidence`, `graphql`, `hooks`, `instrumentation`, `macro`, `maintenance`, `memory`, `network`, `platform`, `process`, `sandbox`, `shared-state-board`, `sourcemap`, `streaming`, `trace`, `transform`, `wasm`, `workflow`
+- Package version: `0.2.7`
+- Domains: `adb-bridge`, `antidebug`, `binary-instrument`, `boringssl-inspector`, `browser`, `canvas`, `coordination`, `core`, `cross-domain`, `debugger`, `encoding`, `evidence`, `extension-registry`, `graphql`, `hooks`, `instrumentation`, `macro`, `maintenance`, `memory`, `mojo-ipc`, `network`, `platform`, `process`, `protocol-analysis`, `proxy`, `sandbox`, `shared-state-board`, `skia-capture`, `sourcemap`, `streaming`, `syscall-hook`, `trace`, `transform`, `v8-inspector`, `wasm`, `workflow`
 - Note: this snapshot is generated from the runtime registry; do not edit the counts by hand.
 <!-- metadata-sync:end -->
 

package/README.zh.md

@@ -50,10 +50,8 @@
 下面的内置能力快照由运行时 registry 动态生成，并在 CI 中校验。
 
 <!-- metadata-sync:start -->
-- 包版本：`0.2.6`
-- 内置工具域：`24`
-- 内置工具数：`337`
-- 域列表：`antidebug`, `browser`, `coordination`, `core`, `debugger`, `encoding`, `evidence`, `graphql`, `hooks`, `instrumentation`, `macro`, `maintenance`, `memory`, `network`, `platform`, `process`, `sandbox`, `shared-state-board`, `sourcemap`, `streaming`, `trace`, `transform`, `wasm`, `workflow`
+- 包版本：`0.2.7`
+- 域列表：`adb-bridge`, `antidebug`, `binary-instrument`, `boringssl-inspector`, `browser`, `canvas`, `coordination`, `core`, `cross-domain`, `debugger`, `encoding`, `evidence`, `extension-registry`, `graphql`, `hooks`, `instrumentation`, `macro`, `maintenance`, `memory`, `mojo-ipc`, `network`, `platform`, `process`, `protocol-analysis`, `proxy`, `sandbox`, `shared-state-board`, `skia-capture`, `sourcemap`, `streaming`, `syscall-hook`, `trace`, `transform`, `v8-inspector`, `wasm`, `workflow`
 - 说明：以上数据由运行时 registry 动态生成，不要手改计数。
 <!-- metadata-sync:end -->
 

package/dist/AntiCheatDetector-S8VRj-dD.mjs

@@ -0,0 +1,244 @@
+import { t as logger } from "./logger-BmWzC2lM.mjs";
+import { a as GetModuleFileNameEx, b as openProcessForMemory, d as ReadProcessMemory, h as VirtualQueryEx, i as GetModuleBaseName, n as EnumProcessModules, s as GetModuleInformation, t as CloseHandle, u as PAGE } from "./Win32API-Bc0QnQsN.mjs";
+import { PEAnalyzer } from "./PEAnalyzer-CK0xe0Fs.mjs";
+import { createHash } from "node:crypto";
+import { promises } from "node:fs";
+//#region src/native/AntiCheatDetector.ts
+/**
+* Anti-Cheat / Anti-Debug Detection Engine.
+*
+* Scans processes for anti-debug mechanisms, guard pages, and code integrity
+* checks by analyzing imports, memory regions, and section hashes.
+*
+* @module AntiCheatDetector
+*/
+const ANTI_DEBUG_IMPORTS = [{
+	dll: "kernel32.dll",
+	funcs: [
+		{
+			name: "IsDebuggerPresent",
+			mechanism: "anti_debug_api",
+			confidence: "high",
+			bypass: "Hook IsDebuggerPresent to return 0, or patch PEB.BeingDebugged field"
+		},
+		{
+			name: "CheckRemoteDebuggerPresent",
+			mechanism: "anti_debug_api",
+			confidence: "high",
+			bypass: "Hook CheckRemoteDebuggerPresent to set output to FALSE and return TRUE"
+		},
+		{
+			name: "OutputDebugStringA",
+			mechanism: "exception_based",
+			confidence: "low",
+			bypass: "May be used for anti-debug timing — monitor for exception handler abuse"
+		},
+		{
+			name: "GetTickCount",
+			mechanism: "timing_check",
+			confidence: "low",
+			bypass: "Hook GetTickCount to return consistent delta values"
+		},
+		{
+			name: "GetTickCount64",
+			mechanism: "timing_check",
+			confidence: "low",
+			bypass: "Hook GetTickCount64 to return consistent delta values"
+		},
+		{
+			name: "QueryPerformanceCounter",
+			mechanism: "timing_check",
+			confidence: "medium",
+			bypass: "Hook QPC to filter out debugging time deltas"
+		}
+	]
+}, {
+	dll: "ntdll.dll",
+	funcs: [
+		{
+			name: "NtQueryInformationProcess",
+			mechanism: "ntquery_debug",
+			confidence: "high",
+			bypass: "Hook NtQueryInformationProcess: return 0 for ProcessDebugPort (7), ProcessDebugObjectHandle (30), ProcessDebugFlags (31)"
+		},
+		{
+			name: "NtSetInformationThread",
+			mechanism: "thread_hiding",
+			confidence: "medium",
+			bypass: "Hook NtSetInformationThread: intercept ThreadHideFromDebugger (0x11) calls"
+		},
+		{
+			name: "NtClose",
+			mechanism: "exception_based",
+			confidence: "low",
+			bypass: "NtClose with invalid handle detects debugger via exception — hook to suppress"
+		},
+		{
+			name: "RtlGetNtGlobalFlags",
+			mechanism: "heap_flags",
+			confidence: "medium",
+			bypass: "Clear NtGlobalFlag (FLG_HEAP_*) in PEB at offset 0xBC (x64)"
+		}
+	]
+}];
+const DR_CHECK_IMPORTS = ["GetThreadContext", "SetThreadContext"];
+var AntiCheatDetector = class {
+	peAnalyzer = new PEAnalyzer();
+	/**
+	* Scan process for anti-debug / anti-cheat mechanisms by analyzing imports.
+	*/
+	async detect(pid) {
+		const detections = [];
+		const hProcess = openProcessForMemory(pid);
+		try {
+			const modules = this._enumerateModules(hProcess);
+			for (const mod of modules) try {
+				const imports = await this.peAnalyzer.parseImports(pid, mod.base);
+				for (const imp of imports) {
+					const dllLower = imp.dllName.toLowerCase();
+					for (const knownDll of ANTI_DEBUG_IMPORTS) if (dllLower.includes(knownDll.dll.toLowerCase().replace(".dll", ""))) {
+						for (const func of knownDll.funcs) if (imp.functions.some((f) => f.name === func.name)) detections.push({
+							mechanism: func.mechanism,
+							confidence: func.confidence,
+							location: `import:${func.name}`,
+							moduleName: mod.name,
+							details: `${mod.name} imports ${func.name} from ${imp.dllName}`,
+							bypassSuggestion: func.bypass
+						});
+					}
+					for (const func of imp.functions) if (DR_CHECK_IMPORTS.includes(func.name)) detections.push({
+						mechanism: "hardware_breakpoint",
+						confidence: "medium",
+						location: `import:${func.name}`,
+						moduleName: mod.name,
+						details: `${mod.name} imports ${func.name} — may check debug registers for hardware breakpoints`,
+						bypassSuggestion: "Hook GetThreadContext to zero out DR0-DR3 and DR6/DR7 before returning"
+					});
+				}
+			} catch (e) {
+				logger.debug(`Import scan skipped for ${mod.name}: ${e}`);
+			}
+		} finally {
+			CloseHandle(hProcess);
+		}
+		return detections;
+	}
+	/**
+	* Find all guard page regions in the process.
+	*/
+	async findGuardPages(pid) {
+		const guardPages = [];
+		const hProcess = openProcessForMemory(pid);
+		try {
+			const modules = this._enumerateModules(hProcess);
+			let address = 0n;
+			const maxAddress = 140737488355327n;
+			while (address < maxAddress) try {
+				const result = VirtualQueryEx(hProcess, address);
+				if (!result.success) break;
+				const mbi = result.info;
+				if ((mbi.Protect & PAGE.GUARD) !== 0) {
+					let moduleName = null;
+					for (const mod of modules) {
+						const modBase = BigInt(mod.base);
+						if (mbi.BaseAddress >= modBase && mbi.BaseAddress < modBase + BigInt(mod.size)) {
+							moduleName = mod.name;
+							break;
+						}
+					}
+					guardPages.push({
+						address: `0x${mbi.BaseAddress.toString(16)}`,
+						size: Number(mbi.RegionSize),
+						moduleName,
+						nearbySymbol: null
+					});
+				}
+				address = mbi.BaseAddress + mbi.RegionSize;
+				if (address <= mbi.BaseAddress) break;
+			} catch {
+				address += 4096n;
+			}
+		} finally {
+			CloseHandle(hProcess);
+		}
+		return guardPages;
+	}
+	/**
+	* Check code section integrity by comparing disk vs memory hashes.
+	*/
+	async checkIntegrity(pid, moduleName) {
+		const results = [];
+		const hProcess = openProcessForMemory(pid);
+		try {
+			const modules = this._enumerateModules(hProcess);
+			const targets = moduleName ? modules.filter((m) => m.name.toLowerCase().includes(moduleName.toLowerCase())) : modules;
+			for (const mod of targets) try {
+				const diskData = await promises.readFile(mod.path);
+				const sections = await this.peAnalyzer.listSections(pid, mod.base);
+				for (const sec of sections) {
+					if (!sec.isExecutable) continue;
+					const secRva = parseInt(sec.virtualAddress, 16);
+					const secSize = Math.min(sec.virtualSize, sec.rawSize);
+					if (secSize <= 0) continue;
+					const memBytes = ReadProcessMemory(hProcess, BigInt(mod.base) + BigInt(secRva), secSize);
+					const diskOffset = this._rvaToFileOffset(diskData, secRva);
+					if (diskOffset < 0 || diskOffset + secSize > diskData.length) continue;
+					const diskBytes = diskData.subarray(diskOffset, diskOffset + secSize);
+					const memoryHash = createHash("sha256").update(memBytes).digest("hex");
+					const diskHash = createHash("sha256").update(diskBytes).digest("hex");
+					results.push({
+						sectionName: sec.name,
+						moduleName: mod.name,
+						diskHash,
+						memoryHash,
+						isModified: memoryHash !== diskHash
+					});
+				}
+			} catch (e) {
+				logger.debug(`Integrity check skipped for ${mod.name}: ${e}`);
+			}
+		} finally {
+			CloseHandle(hProcess);
+		}
+		return results;
+	}
+	_enumerateModules(hProcess) {
+		const modules = [];
+		try {
+			const { modules: modHandles, count } = EnumProcessModules(hProcess);
+			for (let i = 0; i < count; i++) {
+				const hMod = modHandles[i];
+				const name = GetModuleBaseName(hProcess, hMod);
+				const info = GetModuleInformation(hProcess, hMod);
+				const modulePath = GetModuleFileNameEx(hProcess, hMod) ?? name;
+				if (info.success) modules.push({
+					name,
+					base: `0x${info.info.lpBaseOfDll.toString(16)}`,
+					path: modulePath,
+					size: info.info.SizeOfImage
+				});
+			}
+		} catch (e) {
+			logger.debug(`Module enumeration failed: ${e}`);
+		}
+		return modules;
+	}
+	_rvaToFileOffset(peData, rva) {
+		const e_lfanew = peData.readUInt32LE(60);
+		const numSections = peData.readUInt16LE(e_lfanew + 6);
+		const sizeOfOptionalHeader = peData.readUInt16LE(e_lfanew + 20);
+		const secStart = e_lfanew + 24 + sizeOfOptionalHeader;
+		for (let i = 0; i < numSections; i++) {
+			const off = secStart + i * 40;
+			if (off + 40 > peData.length) break;
+			const virtualAddr = peData.readUInt32LE(off + 12);
+			const virtualSize = peData.readUInt32LE(off + 8);
+			const rawOffset = peData.readUInt32LE(off + 20);
+			if (rva >= virtualAddr && rva < virtualAddr + virtualSize) return rawOffset + (rva - virtualAddr);
+		}
+		return -1;
+	}
+};
+const antiCheatDetector = new AntiCheatDetector();
+//#endregion
+export { AntiCheatDetector, antiCheatDetector };

package/dist/CacheAdapters-CzFNpD9a.mjs

@@ -0,0 +1,80 @@
+//#region src/utils/CacheAdapters.ts
+var DetailedDataManagerAdapter = class {
+	name = "DetailedDataManager";
+	constructor(manager) {
+		this.manager = manager;
+	}
+	getStats() {
+		const stats = this.manager.getStats();
+		return {
+			entries: stats.cacheSize,
+			size: this.estimateSize(stats.cacheSize),
+			hits: 0,
+			misses: 0,
+			ttl: stats.defaultTTLSeconds * 1e3,
+			maxSize: stats.maxCacheSize
+		};
+	}
+	clear() {
+		this.manager.clear();
+	}
+	estimateSize(entries) {
+		return entries * 50 * 1024;
+	}
+};
+var CodeCacheAdapter = class {
+	name = "CodeCache";
+	constructor(cache) {
+		this.cache = cache;
+	}
+	async getStats() {
+		const stats = await this.cache.getStats();
+		return {
+			entries: stats.memoryEntries + stats.diskEntries,
+			size: stats.totalSize,
+			hits: 0,
+			misses: 0
+		};
+	}
+	async cleanup() {
+		await this.cache.cleanup();
+	}
+	async clear() {
+		await this.cache.clear();
+	}
+};
+var CodeCompressorAdapter = class {
+	name = "CodeCompressor";
+	constructor(compressor) {
+		this.compressor = compressor;
+	}
+	getStats() {
+		const stats = this.compressor.getStats();
+		const cacheSize = this.compressor.getCacheSize();
+		const total = stats.cacheHits + stats.cacheMisses;
+		const hitRate = total > 0 ? stats.cacheHits / total : 0;
+		return {
+			entries: cacheSize,
+			size: this.estimateSize(cacheSize, stats.totalCompressedSize),
+			hits: stats.cacheHits,
+			misses: stats.cacheMisses,
+			hitRate
+		};
+	}
+	clear() {
+		this.compressor.clearCache();
+	}
+	estimateSize(entries, totalCompressed) {
+		if (entries === 0) return 0;
+		return entries * (totalCompressed / Math.max(1, entries));
+	}
+};
+function createCacheAdapters(detailedDataManager, codeCache, codeCompressor) {
+	return [
+		new DetailedDataManagerAdapter(detailedDataManager),
+		new CodeCacheAdapter(codeCache),
+		new CodeCompressorAdapter(codeCompressor)
+	];
+}
+//#endregion
+export { createCacheAdapters };

package/dist/CodeInjector-4Z3ngPoX.mjs

@@ -0,0 +1,150 @@
+import { k as CODE_CAVE_MIN_SIZE } from "./constants-CCvsN80K.mjs";
+import { t as nativeMemoryManager } from "./NativeMemoryManager.impl-CB6gJ0NM.mjs";
+import { _ as WriteProcessMemory, b as openProcessForMemory, d as ReadProcessMemory, f as VirtualAllocEx, h as VirtualQueryEx, l as MEM, m as VirtualProtectEx, p as VirtualFreeEx, t as CloseHandle, u as PAGE } from "./Win32API-Bc0QnQsN.mjs";
+import { n as isExecutable } from "./NativeMemoryManager.utils-BML4q1ry.mjs";
+import { l as FlushInstructionCache } from "./Win32Debug-DUHt9XUn.mjs";
+import { randomUUID } from "node:crypto";
+//#region src/native/CodeInjector.ts
+/**
+* Code Injector — runtime code patching, NOP, code cave discovery.
+*
+* @module CodeInjector
+*/
+var CodeInjector = class {
+	patches = /* @__PURE__ */ new Map();
+	/** Write bytes to target process at address (runtime patch) */
+	async patchBytes(pid, address, bytes) {
+		const addr = BigInt(address.startsWith("0x") ? address : `0x${address}`);
+		const patchBuf = Buffer.from(bytes);
+		const handle = openProcessForMemory(pid, true);
+		try {
+			const originalBuf = ReadProcessMemory(handle, addr, patchBuf.length);
+			const { success: protOk, oldProtect } = VirtualProtectEx(handle, addr, patchBuf.length, PAGE.EXECUTE_READWRITE);
+			WriteProcessMemory(handle, addr, patchBuf);
+			FlushInstructionCache(handle, addr, patchBuf.length);
+			if (protOk) VirtualProtectEx(handle, addr, patchBuf.length, oldProtect);
+			const op = {
+				id: randomUUID(),
+				pid,
+				address: `0x${addr.toString(16).toUpperCase()}`,
+				originalBytes: Array.from(originalBuf),
+				patchBytes: bytes,
+				isApplied: true,
+				timestamp: Date.now()
+			};
+			this.patches.set(op.id, op);
+			return op;
+		} finally {
+			CloseHandle(handle);
+		}
+	}
+	/** Restore original bytes from a previous patch */
+	async unpatch(patchId) {
+		const patch = this.patches.get(patchId);
+		if (!patch?.isApplied) return false;
+		const addr = BigInt(patch.address);
+		const originalBuf = Buffer.from(patch.originalBytes);
+		const handle = openProcessForMemory(patch.pid, true);
+		try {
+			const { oldProtect } = VirtualProtectEx(handle, addr, originalBuf.length, PAGE.EXECUTE_READWRITE);
+			WriteProcessMemory(handle, addr, originalBuf);
+			FlushInstructionCache(handle, addr, originalBuf.length);
+			VirtualProtectEx(handle, addr, originalBuf.length, oldProtect);
+			patch.isApplied = false;
+			return true;
+		} finally {
+			CloseHandle(handle);
+		}
+	}
+	/** NOP out instructions at address (replace with 0x90) */
+	async nopBytes(pid, address, count) {
+		const nops = Array.from({ length: count }, () => 144);
+		return this.patchBytes(pid, address, nops);
+	}
+	/** Find code caves (runs of 0x00 or 0xCC in executable sections) */
+	async findCodeCaves(pid, minSize) {
+		const min = minSize ?? CODE_CAVE_MIN_SIZE;
+		const caves = [];
+		const handle = openProcessForMemory(pid, false);
+		try {
+			const modules = await nativeMemoryManager.enumerateModules(pid);
+			if (!modules.success || !modules.modules) return caves;
+			for (const mod of modules.modules) {
+				const modBase = BigInt(mod.baseAddress.startsWith("0x") ? mod.baseAddress : `0x${mod.baseAddress}`);
+				let addr = modBase;
+				const modEnd = modBase + BigInt(mod.size);
+				while (addr < modEnd) {
+					const { success, info } = VirtualQueryEx(handle, addr);
+					if (!success || info.RegionSize === 0n) break;
+					const regionSize = Number(info.RegionSize);
+					if (isExecutable(info.Protect) && regionSize > 0) try {
+						const chunk = ReadProcessMemory(handle, info.BaseAddress, Math.min(regionSize, 4 * 1024 * 1024));
+						let caveStart = -1;
+						for (let i = 0; i < chunk.length; i++) {
+							const b = chunk[i];
+							if (b === 0 || b === 204) {
+								if (caveStart === -1) caveStart = i;
+							} else if (caveStart !== -1) {
+								const caveSize = i - caveStart;
+								if (caveSize >= min) {
+									const caveAddr = info.BaseAddress + BigInt(caveStart);
+									caves.push({
+										address: `0x${caveAddr.toString(16).toUpperCase()}`,
+										size: caveSize,
+										module: mod.name,
+										section: ".text"
+									});
+								}
+								caveStart = -1;
+							}
+						}
+						if (caveStart !== -1) {
+							const caveSize = chunk.length - caveStart;
+							if (caveSize >= min) {
+								const caveAddr = info.BaseAddress + BigInt(caveStart);
+								caves.push({
+									address: `0x${caveAddr.toString(16).toUpperCase()}`,
+									size: caveSize,
+									module: mod.name,
+									section: ".text"
+								});
+							}
+						}
+					} catch {}
+					addr = info.BaseAddress + info.RegionSize;
+				}
+			}
+		} finally {
+			CloseHandle(handle);
+		}
+		return caves.toSorted((a, b) => b.size - a.size);
+	}
+	/** Allocate executable memory in target process */
+	async allocateRemote(pid, size) {
+		const handle = openProcessForMemory(pid, true);
+		try {
+			const addr = VirtualAllocEx(handle, 0n, size, MEM.COMMIT | MEM.RESERVE, PAGE.EXECUTE_READWRITE);
+			if (addr === 0n) throw new Error("VirtualAllocEx failed");
+			return `0x${addr.toString(16).toUpperCase()}`;
+		} finally {
+			CloseHandle(handle);
+		}
+	}
+	/** Free remote memory */
+	async freeRemote(pid, address, _size) {
+		const addr = BigInt(address.startsWith("0x") ? address : `0x${address}`);
+		const handle = openProcessForMemory(pid, true);
+		try {
+			return VirtualFreeEx(handle, addr, 0, MEM.RELEASE);
+		} finally {
+			CloseHandle(handle);
+		}
+	}
+	/** List all active patches */
+	listPatches() {
+		return Array.from(this.patches.values());
+	}
+};
+const codeInjector = new CodeInjector();
+//#endregion
+export { CodeInjector, codeInjector };