@jshookmcp/jshook 0.2.6 → 0.2.7

package/dist/DarwinAPI-B8hg_yhz.mjs

@@ -0,0 +1,363 @@
+import { t as __exportAll } from "./chunk-CjcI7cDX.mjs";
+import { t as logger } from "./logger-BmWzC2lM.mjs";
+import koffi from "koffi";
+//#region src/native/platform/darwin/DarwinAPI.ts
+/**
+* Darwin (macOS) API Bindings using koffi FFI
+* Direct native calls to libSystem.B.dylib Mach kernel APIs
+*
+* This is the macOS counterpart to Win32API.ts — provides raw Mach API
+* function wrappers that DarwinMemoryProvider consumes.
+*
+* Pattern: lazy library loading, inline koffi function signatures,
+* Buffer-based struct parsing (no koffi struct registration to avoid
+* "Duplicate type name" errors in test environments).
+*
+* @module platform/darwin/DarwinAPI
+*/
+var DarwinAPI_exports = /* @__PURE__ */ __exportAll({
+	KERN: () => KERN,
+	SM: () => SM,
+	VM_FLAGS: () => VM_FLAGS,
+	VM_PROT: () => VM_PROT,
+	VM_REGION_BASIC_INFO_64: () => 9,
+	VM_REGION_BASIC_INFO_COUNT_64: () => 9,
+	dyldGetImageHeader: () => dyldGetImageHeader,
+	dyldGetImageName: () => dyldGetImageName,
+	dyldImageCount: () => dyldImageCount,
+	isDarwin: () => isDarwin,
+	isKoffiAvailableOnDarwin: () => isKoffiAvailableOnDarwin,
+	kernReturnName: () => kernReturnName,
+	machPortDeallocate: () => machPortDeallocate,
+	machTaskSelf: () => machTaskSelf,
+	machVmAllocate: () => machVmAllocate,
+	machVmDeallocate: () => machVmDeallocate,
+	machVmProtect: () => machVmProtect,
+	machVmReadOverwrite: () => machVmReadOverwrite,
+	machVmRegion: () => machVmRegion,
+	machVmWrite: () => machVmWrite,
+	taskForPid: () => taskForPid,
+	taskResume: () => taskResume,
+	taskSuspend: () => taskSuspend
+});
+/** Mach kernel return codes */
+const KERN = {
+	SUCCESS: 0,
+	INVALID_ADDRESS: 1,
+	PROTECTION_FAILURE: 2,
+	NO_SPACE: 3,
+	INVALID_ARGUMENT: 4,
+	FAILURE: 5,
+	RESOURCE_SHORTAGE: 6,
+	NOT_RECEIVER: 7,
+	NO_ACCESS: 8,
+	MEMORY_FAILURE: 9,
+	MEMORY_ERROR: 10,
+	ALREADY_IN_SET: 11,
+	NOT_IN_SET: 12,
+	NAME_EXISTS: 13,
+	ABORTED: 14,
+	INVALID_NAME: 15,
+	INVALID_TASK: 16,
+	INVALID_RIGHT: 17,
+	INVALID_VALUE: 18,
+	UREFS_OVERFLOW: 19,
+	INVALID_CAPABILITY: 20,
+	RIGHT_EXISTS: 21,
+	INVALID_HOST: 22,
+	MEMORY_PRESENT: 23,
+	MEMORY_DATA_MOVED: 24,
+	MEMORY_RESTART_COPY: 25,
+	INVALID_PROCESSOR_SET: 26,
+	POLICY_LIMIT: 27,
+	INVALID_POLICY: 28,
+	INVALID_OBJECT: 29,
+	ALREADY_WAITING: 30,
+	DEFAULT_SET: 31,
+	EXCEPTION_PROTECTED: 32,
+	INVALID_LEDGER: 33,
+	INVALID_MEMORY_CONTROL: 34,
+	INVALID_SECURITY: 35,
+	NOT_DEPRESSED: 36,
+	TERMINATED: 37,
+	LOCK_SET_DESTROYED: 38,
+	LOCK_UNSTABLE: 39,
+	LOCK_OWNED: 40,
+	LOCK_OWNED_SELF: 41,
+	SEMAPHORE_DESTROYED: 42,
+	RPC_SERVER_TERMINATED: 43,
+	RPC_TERMINATE_ORPHAN: 44,
+	RPC_CONTINUE_ORPHAN: 45,
+	NOT_SUPPORTED: 46,
+	NODE_DOWN: 47,
+	NOT_WAITING: 48,
+	OPERATION_TIMED_OUT: 49,
+	CODESIGN_ERROR: 50,
+	POLICY_STATIC: 51
+};
+/** Human-readable kernel return code names */
+const KERN_NAMES = {
+	[KERN.SUCCESS]: "KERN_SUCCESS",
+	[KERN.INVALID_ADDRESS]: "KERN_INVALID_ADDRESS",
+	[KERN.PROTECTION_FAILURE]: "KERN_PROTECTION_FAILURE",
+	[KERN.NO_SPACE]: "KERN_NO_SPACE",
+	[KERN.INVALID_ARGUMENT]: "KERN_INVALID_ARGUMENT",
+	[KERN.FAILURE]: "KERN_FAILURE",
+	[KERN.NO_ACCESS]: "KERN_NO_ACCESS",
+	[KERN.INVALID_TASK]: "KERN_INVALID_TASK",
+	[KERN.INVALID_RIGHT]: "KERN_INVALID_RIGHT",
+	[KERN.CODESIGN_ERROR]: "KERN_CODESIGN_ERROR"
+};
+/** Get human-readable name for a kern_return_t value */
+function kernReturnName(kr) {
+	return KERN_NAMES[kr] ?? `KERN_UNKNOWN(${kr})`;
+}
+/** VM protection flags */
+const VM_PROT = {
+	NONE: 0,
+	READ: 1,
+	WRITE: 2,
+	EXECUTE: 4,
+	ALL: 7
+};
+/** VM allocation flags */
+const VM_FLAGS = {
+	FIXED: 0,
+	ANYWHERE: 1,
+	PURGABLE: 2,
+	RANDOM_ADDR: 8,
+	OVERWRITE: 16384
+};
+/** VM region share modes */
+const SM = {
+	COW: 1,
+	PRIVATE: 2,
+	EMPTY: 3,
+	SHARED: 4,
+	TRUESHARED: 5,
+	PRIVATE_ALIASED: 6,
+	SHARED_ALIASED: 7,
+	LARGE_PAGE: 8
+};
+let libSystem = null;
+let koffiAvailableDarwin = null;
+/**
+* Check if running on macOS
+*/
+function isDarwin() {
+	return process.platform === "darwin";
+}
+/**
+* Check if koffi can load libSystem.B.dylib on macOS
+*/
+function isKoffiAvailableOnDarwin() {
+	if (koffiAvailableDarwin !== null) return koffiAvailableDarwin;
+	try {
+		koffi.load("/usr/lib/libSystem.B.dylib").unload();
+		koffiAvailableDarwin = true;
+		return true;
+	} catch {
+		koffiAvailableDarwin = false;
+		return false;
+	}
+}
+/**
+* Get or load libSystem.B.dylib (lazy)
+*/
+function getLibSystem() {
+	if (!libSystem) {
+		libSystem = koffi.load("/usr/lib/libSystem.B.dylib");
+		logger.debug("Loaded libSystem.B.dylib via koffi");
+	}
+	return libSystem;
+}
+/**
+* Get the current task's Mach port (mach_task_self_)
+* On macOS, mach_task_self() is actually a macro accessing the global mach_task_self_ variable.
+* For koffi, we call mach_task_self_ which is the actual symbol.
+*/
+function machTaskSelf() {
+	return getLibSystem().func("uint32 mach_task_self()")();
+}
+/**
+* Get a Mach task port for a target process
+*
+* Requires root privileges or debugger entitlement (com.apple.security.cs.debugger)
+*
+* @param targetTask - The task port of the caller (use machTaskSelf())
+* @param pid - Target process PID
+* @returns { kr, task } where kr is kern_return_t and task is the Mach task port
+*/
+function taskForPid(targetTask, pid) {
+	const fn = getLibSystem().func("int32 task_for_pid(uint32, int32, _Out_ uint32 *)");
+	const taskBuf = Buffer.alloc(4);
+	return {
+		kr: fn(targetTask, pid, taskBuf),
+		task: taskBuf.readUInt32LE(0)
+	};
+}
+/**
+* Deallocate a Mach port right
+*
+* @param task - The task owning the port
+* @param name - The port name to deallocate
+* @returns kern_return_t
+*/
+function machPortDeallocate(task, name) {
+	return getLibSystem().func("int32 mach_port_deallocate(uint32, uint32)")(task, name);
+}
+/**
+* Read memory from a remote process using mach_vm_read_overwrite.
+*
+* We use _overwrite variant because it writes directly into our pre-allocated
+* buffer, avoiding kernel-allocated memory and the need for mach_vm_deallocate.
+*
+* @param task - Target task port
+* @param address - Source address in target process
+* @param size - Number of bytes to read
+* @returns { kr, data, outsize }
+*/
+function machVmReadOverwrite(task, address, size) {
+	const fn = getLibSystem().func("int32 mach_vm_read_overwrite(uint32, uint64, uint64, _Out_ uint8_t *, uint64, _Out_ uint64 *)");
+	const data = Buffer.alloc(size);
+	const outsizeBuf = Buffer.alloc(8);
+	return {
+		kr: fn(task, address, BigInt(size), data, BigInt(size), outsizeBuf),
+		data,
+		outsize: outsizeBuf.readBigUInt64LE(0)
+	};
+}
+/**
+* Write memory to a remote process using mach_vm_write.
+*
+* @param task - Target task port
+* @param address - Destination address in target process
+* @param data - Data to write
+* @returns kern_return_t
+*/
+function machVmWrite(task, address, data) {
+	return getLibSystem().func("int32 mach_vm_write(uint32, uint64, uint8_t *, uint32)")(task, address, data, data.length);
+}
+/**
+* Query a memory region in a remote process using mach_vm_region.
+*
+* Returns vm_region_basic_info_data_64_t which is 36 bytes:
+*   protection(4) + max_protection(4) + inheritance(4) + shared(4) +
+*   reserved(4) + offset(8) + behavior(4) + user_wired_count(4)
+*
+* @param task - Target task port
+* @param address - Address to query (will be rounded down to region start)
+* @returns { kr, address, size, info, objectName }
+*/
+function machVmRegion(task, address) {
+	const fn = getLibSystem().func("int32 mach_vm_region(uint32, _Inout_ uint64 *, _Out_ uint64 *, int32, _Out_ uint8_t *, _Inout_ uint32 *, _Out_ uint32 *)");
+	const addressBuf = Buffer.alloc(8);
+	addressBuf.writeBigUInt64LE(address);
+	const sizeBuf = Buffer.alloc(8);
+	const infoBuf = Buffer.alloc(36);
+	const infoCntBuf = Buffer.alloc(4);
+	infoCntBuf.writeUInt32LE(9);
+	const kr = fn(task, addressBuf, sizeBuf, 9, infoBuf, infoCntBuf, Buffer.alloc(4));
+	const info = {
+		protection: infoBuf.readUInt32LE(0),
+		max_protection: infoBuf.readUInt32LE(4),
+		inheritance: infoBuf.readUInt32LE(8),
+		shared: infoBuf.readUInt32LE(12) !== 0,
+		reserved: infoBuf.readUInt32LE(16) !== 0,
+		offset: infoBuf.readBigUInt64LE(20),
+		behavior: infoBuf.readUInt32LE(28),
+		user_wired_count: infoBuf.readUInt32LE(32)
+	};
+	return {
+		kr,
+		address: addressBuf.readBigUInt64LE(0),
+		size: sizeBuf.readBigUInt64LE(0),
+		info
+	};
+}
+/**
+* Change memory protection for a region in a remote process.
+*
+* @param task - Target task port
+* @param address - Start address of the region
+* @param size - Size of the region
+* @param setMaximum - If true, sets maximum protection (needed for W^X workarounds)
+* @param newProtection - New VM_PROT_* flags
+* @returns kern_return_t
+*/
+function machVmProtect(task, address, size, setMaximum, newProtection) {
+	return getLibSystem().func("int32 mach_vm_protect(uint32, uint64, uint64, int32, int32)")(task, address, size, setMaximum ? 1 : 0, newProtection);
+}
+/**
+* Allocate memory in a remote process.
+*
+* @param task - Target task port
+* @param size - Number of bytes to allocate
+* @param flags - VM_FLAGS_* (typically VM_FLAGS_ANYWHERE)
+* @returns { kr, address }
+*/
+function machVmAllocate(task, size, flags) {
+	const fn = getLibSystem().func("int32 mach_vm_allocate(uint32, _Inout_ uint64 *, uint64, int32)");
+	const addressBuf = Buffer.alloc(8);
+	addressBuf.writeBigUInt64LE(0n);
+	return {
+		kr: fn(task, addressBuf, size, flags),
+		address: addressBuf.readBigUInt64LE(0)
+	};
+}
+/**
+* Deallocate (free) memory in a remote process.
+*
+* @param task - Target task port
+* @param address - Start address of the region to free
+* @param size - Size of the region to free
+* @returns kern_return_t
+*/
+function machVmDeallocate(task, address, size) {
+	return getLibSystem().func("int32 mach_vm_deallocate(uint32, uint64, uint64)")(task, address, size);
+}
+/**
+* Suspend all threads in a task (freeze target process).
+*
+* This pauses the entire process — useful for consistent memory snapshots.
+* Must be paired with `taskResume()` to avoid leaving the target frozen.
+*
+* @param task - Target task port (from taskForPid)
+* @returns kern_return_t
+*/
+function taskSuspend(task) {
+	return getLibSystem().func("int32 task_suspend(uint32)")(task);
+}
+/**
+* Resume all threads in a previously-suspended task.
+*
+* @param task - Target task port (from taskForPid)
+* @returns kern_return_t
+*/
+function taskResume(task) {
+	return getLibSystem().func("int32 task_resume(uint32)")(task);
+}
+/**
+* Get the number of loaded images in the current process.
+* Note: For remote process module enumeration, we need to read
+* dyld_all_image_infos from the target process memory instead.
+*/
+function dyldImageCount() {
+	return getLibSystem().func("uint32 _dyld_image_count()")();
+}
+/**
+* Get the name of a loaded image by index (current process only).
+*/
+function dyldGetImageName(index) {
+	const ptr = getLibSystem().func("const char * _dyld_get_image_name(uint32)")(index);
+	return ptr ? String(ptr) : "";
+}
+/**
+* Get the Mach header pointer of a loaded image by index (current process only).
+*/
+function dyldGetImageHeader(index) {
+	const fn = getLibSystem().func("void * _dyld_get_image_header(uint32)");
+	return BigInt(fn(index));
+}
+//#endregion
+export { machVmReadOverwrite as _, VM_PROT as a, taskForPid as b, dyldImageCount as c, kernReturnName as d, machPortDeallocate as f, machVmProtect as g, machVmDeallocate as h, VM_FLAGS as i, isDarwin as l, machVmAllocate as m, KERN as n, dyldGetImageHeader as o, machTaskSelf as p, SM as r, dyldGetImageName as s, DarwinAPI_exports as t, isKoffiAvailableOnDarwin as u, machVmRegion as v, machVmWrite as y };