@jshookmcp/jshook 0.2.6 → 0.2.7

package/dist/NativeMemoryManager.impl-CB6gJ0NM.mjs

@@ -0,0 +1,521 @@
+import { t as logger } from "./logger-BmWzC2lM.mjs";
+import { a as MemoryProtection, t as createPlatformProvider } from "./factory-CibqTNC8.mjs";
+import { v as isKoffiAvailable, y as isWindows } from "./Win32API-Bc0QnQsN.mjs";
+import { i as parsePattern, t as findPatternInBuffer } from "./NativeMemoryManager.utils-BML4q1ry.mjs";
+import { exec } from "node:child_process";
+import { promisify } from "node:util";
+//#region src/utils/concurrency.ts
+function pLimit(concurrency) {
+	if (concurrency < 1) throw new RangeError("concurrency must be >= 1");
+	let activeCount = 0;
+	const queue = [];
+	function next() {
+		if (queue.length > 0 && activeCount < concurrency) {
+			activeCount++;
+			queue.shift()();
+		}
+	}
+	function run(fn) {
+		return new Promise((resolve, reject) => {
+			const execute = async () => {
+				try {
+					resolve(await fn());
+				} catch (err) {
+					reject(err);
+				} finally {
+					activeCount--;
+					next();
+				}
+			};
+			if (activeCount < concurrency) {
+				activeCount++;
+				execute();
+			} else queue.push(() => {
+				execute();
+			});
+		});
+	}
+	return run;
+}
+/** External CLI calls, HAR export, large file I/O */
+const ioLimit = pLimit(parseInt(process.env.jshook_IO_CONCURRENCY || "4", 10));
+/** CPU-heavy: AST parsing, deobfuscation, binary decoding */
+const cpuLimit = pLimit(parseInt(process.env.jshook_CPU_CONCURRENCY || "2", 10));
+/** CDP-heavy: heap snapshots, traces, profiling */
+const cdpLimit = pLimit(parseInt(process.env.jshook_CDP_CONCURRENCY || "2", 10));
+//#endregion
+//#region src/native/NativeMemoryManager.availability.ts
+async function checkNativeMemoryAvailability(execAsync) {
+	if (process.platform === "darwin") return checkDarwinAvailability(execAsync);
+	if (!isWindows()) return {
+		available: false,
+		reason: `Native memory operations require Windows or macOS. Current platform: ${process.platform}`
+	};
+	if (!isKoffiAvailable()) return {
+		available: false,
+		reason: "koffi library not available. Install with: pnpm add koffi"
+	};
+	try {
+		const { stdout } = await execAsync("powershell.exe -NoProfile -Command \"([Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)\"", { timeout: 5e3 });
+		if (stdout.trim().toLowerCase() !== "true") return {
+			available: false,
+			reason: "Native memory operations require Administrator privileges. Run as Administrator."
+		};
+	} catch {
+		return {
+			available: false,
+			reason: "Failed to check Administrator privileges."
+		};
+	}
+	return { available: true };
+}
+async function checkDarwinAvailability(execAsync) {
+	try {
+		(await import("koffi")).default.load("/usr/lib/libSystem.B.dylib").unload();
+	} catch {
+		return {
+			available: false,
+			reason: "koffi library cannot load libSystem.B.dylib. Install koffi with: pnpm add koffi"
+		};
+	}
+	let sipInfo = "";
+	try {
+		const { stdout } = await execAsync("csrutil status 2>&1 || true", { timeout: 5e3 });
+		sipInfo = stdout.trim();
+	} catch {}
+	if (process.getuid && process.getuid() !== 0) return {
+		available: false,
+		reason: `macOS memory operations require root privileges for task_for_pid. Run with: sudo node <your-script>.${sipInfo ? ` SIP status: ${sipInfo}` : ""}`
+	};
+	return { available: true };
+}
+//#endregion
+//#region src/native/NativeMemoryManager.impl.ts
+/**
+* Native Memory Manager — Cross-platform memory operations.
+*
+* Uses PlatformMemoryAPI for read/write/scan/regions/modules.
+* Win32-only injection and debug methods remain guarded by platform checks.
+*
+* Performance improvement: 10-100x faster than PowerShell-based approach
+* - No process spawning overhead
+* - Direct memory access via FFI
+* - Lower latency and higher throughput
+*
+* @module NativeMemoryManager
+*/
+const execAsync = promisify(exec);
+const SCAN_CHUNK_SIZE = 16 * 1024 * 1024;
+function scanRegionInChunks(region, patternBytes, mask, readChunk, chunkSize = SCAN_CHUNK_SIZE) {
+	if (patternBytes.length === 0 || region.regionSize < patternBytes.length || chunkSize <= 0) return [];
+	const overlap = Math.max(patternBytes.length - 1, 0);
+	let carryOver = Buffer.alloc(0);
+	const matches = [];
+	for (let chunkOffset = 0; chunkOffset < region.regionSize; chunkOffset += chunkSize) {
+		const readSize = Math.min(chunkSize, region.regionSize - chunkOffset);
+		const chunk = readChunk(region.baseAddress + BigInt(chunkOffset), readSize);
+		const scanBuffer = carryOver.length > 0 ? Buffer.concat([carryOver, chunk]) : chunk;
+		const chunkMatches = findPatternInBuffer(scanBuffer, patternBytes, mask);
+		for (const matchOffset of chunkMatches) {
+			const regionOffset = chunkOffset + matchOffset - carryOver.length;
+			matches.push(region.baseAddress + BigInt(regionOffset));
+		}
+		if (overlap === 0 || chunkOffset + readSize >= region.regionSize) {
+			carryOver = Buffer.alloc(0);
+			continue;
+		}
+		const carrySize = Math.min(overlap, scanBuffer.length);
+		carryOver = scanBuffer.subarray(scanBuffer.length - carrySize);
+	}
+	return matches;
+}
+/**
+* High-performance cross-platform memory manager.
+* Uses PlatformMemoryAPI for read/write/scan/regions/modules.
+* Win32-only methods (injection, debug) are guarded by platform checks.
+*/
+var NativeMemoryManager = class {
+	_provider = null;
+	/** Lazily create the platform memory provider */
+	get provider() {
+		if (!this._provider) this._provider = createPlatformProvider();
+		return this._provider;
+	}
+	async checkAvailability() {
+		return checkNativeMemoryAvailability(execAsync);
+	}
+	async readMemory(pid, address, size) {
+		try {
+			const addrNum = BigInt(address.startsWith("0x") ? address : `0x${address}`);
+			const handle = this.provider.openProcess(pid, false);
+			try {
+				const { data: buffer } = this.provider.readMemory(handle, addrNum, size);
+				return {
+					success: true,
+					data: buffer.toString("hex").toUpperCase().match(/.{2}/g)?.join(" ") || ""
+				};
+			} finally {
+				this.provider.closeProcess(handle);
+			}
+		} catch (error) {
+			logger.error("Native memory read failed", {
+				pid,
+				address,
+				size,
+				error: error instanceof Error ? error.message : String(error)
+			});
+			return {
+				success: false,
+				error: error instanceof Error ? error.message : String(error)
+			};
+		}
+	}
+	async writeMemory(pid, address, data, encoding = "hex") {
+		try {
+			const addrNum = BigInt(address.startsWith("0x") ? address : `0x${address}`);
+			let buffer;
+			if (encoding === "base64") buffer = Buffer.from(data, "base64");
+			else buffer = Buffer.from(data.replace(/\s/g, ""), "hex");
+			const handle = this.provider.openProcess(pid, true);
+			try {
+				const { bytesWritten } = this.provider.writeMemory(handle, addrNum, buffer);
+				return {
+					success: true,
+					bytesWritten
+				};
+			} finally {
+				this.provider.closeProcess(handle);
+			}
+		} catch (error) {
+			logger.error("Native memory write failed", {
+				pid,
+				address,
+				encoding,
+				dataLength: data.length,
+				error: error instanceof Error ? error.message : String(error)
+			});
+			return {
+				success: false,
+				error: error instanceof Error ? error.message : String(error)
+			};
+		}
+	}
+	async enumerateRegions(pid) {
+		try {
+			const handle = this.provider.openProcess(pid, false);
+			const regions = [];
+			try {
+				let address = 0n;
+				const maxAddress = BigInt("0x7FFFFFFF0000");
+				while (address < maxAddress) {
+					const regionInfo = this.provider.queryRegion(handle, address);
+					if (!regionInfo) break;
+					regions.push(regionInfoToMemoryRegion(regionInfo));
+					address = regionInfo.baseAddress + BigInt(regionInfo.size);
+				}
+				return {
+					success: true,
+					regions
+				};
+			} finally {
+				this.provider.closeProcess(handle);
+			}
+		} catch (error) {
+			logger.error("Native region enumeration failed", {
+				pid,
+				error: error instanceof Error ? error.message : String(error)
+			});
+			return {
+				success: false,
+				error: error instanceof Error ? error.message : String(error)
+			};
+		}
+	}
+	async checkMemoryProtection(pid, address) {
+		try {
+			const addrNum = BigInt(address.startsWith("0x") ? address : `0x${address}`);
+			const handle = this.provider.openProcess(pid, false);
+			try {
+				const regionInfo = this.provider.queryRegion(handle, addrNum);
+				if (!regionInfo) return {
+					success: false,
+					error: "Failed to query memory region"
+				};
+				return {
+					success: true,
+					protection: protectionToString(regionInfo.protection),
+					isWritable: regionInfo.isWritable,
+					isReadable: regionInfo.isReadable,
+					isExecutable: regionInfo.isExecutable,
+					regionStart: `0x${regionInfo.baseAddress.toString(16).toUpperCase()}`,
+					regionSize: regionInfo.size
+				};
+			} finally {
+				this.provider.closeProcess(handle);
+			}
+		} catch (error) {
+			logger.error("Native protection check failed", {
+				pid,
+				address,
+				error: error instanceof Error ? error.message : String(error)
+			});
+			return {
+				success: false,
+				error: error instanceof Error ? error.message : String(error)
+			};
+		}
+	}
+	async scanMemory(pid, pattern, patternType = "hex") {
+		try {
+			const { patternBytes, mask } = parsePattern(pattern, patternType);
+			if (patternBytes.length === 0) return {
+				success: false,
+				addresses: [],
+				error: "Invalid pattern"
+			};
+			const maxResults = 1e4;
+			const readableRegions = [];
+			const handle = this.provider.openProcess(pid, false);
+			let regionMatches = [];
+			try {
+				let address = 0n;
+				const maxAddress = BigInt("0x7FFFFFFF0000");
+				while (address < maxAddress) {
+					const regionInfo = this.provider.queryRegion(handle, address);
+					if (!regionInfo) break;
+					if (regionInfo.isReadable && regionInfo.size > 0 && regionInfo.size <= Number.MAX_SAFE_INTEGER) readableRegions.push({
+						baseAddress: regionInfo.baseAddress,
+						regionSize: regionInfo.size
+					});
+					address = regionInfo.baseAddress + BigInt(regionInfo.size);
+				}
+				const providerRef = this.provider;
+				regionMatches = await Promise.all(readableRegions.map((region) => cpuLimit(async () => {
+					try {
+						return scanRegionInChunks(region, patternBytes, mask, (addr, size) => providerRef.readMemory(handle, addr, size).data);
+					} catch {
+						return [];
+					}
+				})));
+			} finally {
+				this.provider.closeProcess(handle);
+			}
+			const addresses = [];
+			for (const matches of regionMatches) {
+				for (const foundAddr of matches) {
+					addresses.push(`0x${foundAddr.toString(16).toUpperCase()}`);
+					if (addresses.length >= maxResults) break;
+				}
+				if (addresses.length >= maxResults) break;
+			}
+			return {
+				success: true,
+				addresses,
+				stats: {
+					patternLength: patternBytes.length,
+					resultsFound: addresses.length
+				}
+			};
+		} catch (error) {
+			logger.error("Native memory scan failed", {
+				pid,
+				patternType,
+				patternLength: pattern.length,
+				error: error instanceof Error ? error.message : String(error)
+			});
+			return {
+				success: false,
+				addresses: [],
+				error: error instanceof Error ? error.message : String(error)
+			};
+		}
+	}
+	async enumerateModules(pid) {
+		try {
+			const handle = this.provider.openProcess(pid, false);
+			try {
+				return {
+					success: true,
+					modules: this.provider.enumerateModules(handle).map((m) => ({
+						name: m.name,
+						baseAddress: `0x${m.baseAddress.toString(16).toUpperCase()}`,
+						size: m.size
+					}))
+				};
+			} finally {
+				this.provider.closeProcess(handle);
+			}
+		} catch (error) {
+			logger.error("Native module enumeration failed", {
+				pid,
+				error: error instanceof Error ? error.message : String(error)
+			});
+			return {
+				success: false,
+				error: error instanceof Error ? error.message : String(error)
+			};
+		}
+	}
+	/** Win32 only — uses CreateRemoteThread + LoadLibraryA */
+	async injectDll(pid, dllPath) {
+		if (process.platform !== "win32") return {
+			success: false,
+			error: "DLL injection is only supported on Windows"
+		};
+		try {
+			const { openProcessForMemory, CloseHandle, WriteProcessMemory, VirtualAllocEx, CreateRemoteThread, GetModuleHandle, GetProcAddress, PAGE, MEM } = await import("./Win32API-Bc0QnQsN.mjs").then((n) => n.g);
+			const handle = openProcessForMemory(pid, true);
+			try {
+				const loadLibraryAddr = GetProcAddress(GetModuleHandle("kernel32.dll"), "LoadLibraryA");
+				if (!loadLibraryAddr) return {
+					success: false,
+					error: "Failed to get LoadLibraryA address"
+				};
+				const pathBuffer = Buffer.from(dllPath + "\0", "ascii");
+				const remoteMem = VirtualAllocEx(handle, 0n, pathBuffer.length, MEM.COMMIT | MEM.RESERVE, PAGE.READWRITE);
+				if (!remoteMem) return {
+					success: false,
+					error: "Failed to allocate remote memory"
+				};
+				WriteProcessMemory(handle, remoteMem, pathBuffer);
+				const { handle: threadHandle, threadId } = CreateRemoteThread(handle, loadLibraryAddr, remoteMem);
+				if (!threadHandle) return {
+					success: false,
+					error: "Failed to create remote thread"
+				};
+				CloseHandle(threadHandle);
+				return {
+					success: true,
+					remoteThreadId: threadId
+				};
+			} finally {
+				CloseHandle(handle);
+			}
+		} catch (error) {
+			logger.error("Native DLL injection failed", {
+				pid,
+				dllPath,
+				error: error instanceof Error ? error.message : String(error)
+			});
+			return {
+				success: false,
+				error: error instanceof Error ? error.message : String(error)
+			};
+		}
+	}
+	/** Win32 only — uses VirtualAllocEx + CreateRemoteThread */
+	async injectShellcode(pid, shellcode, encoding = "hex") {
+		if (process.platform !== "win32") return {
+			success: false,
+			error: "Shellcode injection is only supported on Windows"
+		};
+		try {
+			let buffer;
+			if (encoding === "base64") buffer = Buffer.from(shellcode, "base64");
+			else buffer = Buffer.from(shellcode.replace(/\s/g, ""), "hex");
+			const { openProcessForMemory, CloseHandle, WriteProcessMemory, VirtualAllocEx, VirtualProtectEx, CreateRemoteThread, PAGE, MEM } = await import("./Win32API-Bc0QnQsN.mjs").then((n) => n.g);
+			const handle = openProcessForMemory(pid, true);
+			try {
+				const remoteMem = VirtualAllocEx(handle, 0n, buffer.length, MEM.COMMIT | MEM.RESERVE, PAGE.READWRITE);
+				if (!remoteMem) return {
+					success: false,
+					error: "Failed to allocate remote memory"
+				};
+				WriteProcessMemory(handle, remoteMem, buffer);
+				const { success: protectSuccess } = VirtualProtectEx(handle, remoteMem, buffer.length, PAGE.EXECUTE_READWRITE);
+				if (!protectSuccess) return {
+					success: false,
+					error: "Failed to change memory protection"
+				};
+				const { handle: threadHandle, threadId } = CreateRemoteThread(handle, remoteMem, 0n);
+				if (!threadHandle) return {
+					success: false,
+					error: "Failed to create remote thread"
+				};
+				CloseHandle(threadHandle);
+				return {
+					success: true,
+					remoteThreadId: threadId
+				};
+			} finally {
+				CloseHandle(handle);
+			}
+		} catch (error) {
+			logger.error("Native shellcode injection failed", {
+				pid,
+				encoding,
+				shellcodeLength: shellcode.length,
+				error: error instanceof Error ? error.message : String(error)
+			});
+			return {
+				success: false,
+				error: error instanceof Error ? error.message : String(error)
+			};
+		}
+	}
+	/** Win32 only — uses NtQueryInformationProcess */
+	async checkDebugPort(pid) {
+		if (process.platform !== "win32") return {
+			success: false,
+			error: "Debug port check is only supported on Windows"
+		};
+		try {
+			const { openProcessForMemory, CloseHandle, NtQueryInformationProcess } = await import("./Win32API-Bc0QnQsN.mjs").then((n) => n.g);
+			const handle = openProcessForMemory(pid, false);
+			try {
+				const { status, debugPort } = NtQueryInformationProcess(handle, 7);
+				if (status !== 0) return {
+					success: false,
+					error: `NtQueryInformationProcess failed with status 0x${status.toString(16)}`
+				};
+				return {
+					success: true,
+					isDebugged: debugPort !== 0
+				};
+			} finally {
+				CloseHandle(handle);
+			}
+		} catch (error) {
+			logger.error("Native debug port check failed", {
+				pid,
+				error: error instanceof Error ? error.message : String(error)
+			});
+			return {
+				success: false,
+				error: error instanceof Error ? error.message : String(error)
+			};
+		}
+	}
+};
+/** Convert platform-agnostic MemoryRegionInfo to legacy MemoryRegion format */
+function regionInfoToMemoryRegion(info) {
+	return {
+		baseAddress: `0x${info.baseAddress.toString(16).toUpperCase()}`,
+		size: info.size,
+		state: info.state.toUpperCase(),
+		protection: protectionToString(info.protection),
+		isReadable: info.isReadable,
+		isWritable: info.isWritable,
+		isExecutable: info.isExecutable,
+		type: info.type.toUpperCase()
+	};
+}
+/** Convert MemoryProtection flags to human-readable string */
+function protectionToString(prot) {
+	if (prot === MemoryProtection.NoAccess) return "NOACCESS";
+	const parts = [];
+	const hasRead = (prot & MemoryProtection.Read) !== 0;
+	const hasWrite = (prot & MemoryProtection.Write) !== 0;
+	const hasExec = (prot & MemoryProtection.Execute) !== 0;
+	const hasGuard = (prot & MemoryProtection.Guard) !== 0;
+	if (hasRead && hasWrite && hasExec) parts.push("RWX");
+	else if (hasRead && hasExec) parts.push("RX");
+	else if (hasRead && hasWrite) parts.push("RW");
+	else if (hasRead) parts.push("R");
+	else if (hasExec) parts.push("X");
+	if (hasGuard) parts.push("GUARD");
+	return parts.join(" ") || "UNKNOWN";
+}
+const nativeMemoryManager = new NativeMemoryManager();
+//#endregion
+export { ioLimit as i, cdpLimit as n, cpuLimit as r, nativeMemoryManager as t };

package/dist/NativeMemoryManager.utils-BML4q1ry.mjs

@@ -0,0 +1,165 @@
+import { u as PAGE, v as isKoffiAvailable$1 } from "./Win32API-Bc0QnQsN.mjs";
+//#region src/native/NativeMemoryManager.utils.ts
+function isKoffiAvailable() {
+	return isKoffiAvailable$1();
+}
+function parsePattern(pattern, patternType) {
+	const patternBytes = [];
+	const mask = [];
+	switch (patternType) {
+		case "hex": {
+			const parts = pattern.trim().split(/\s+/);
+			for (const part of parts) if (part === "??" || part === "**" || part === "?") {
+				patternBytes.push(0);
+				mask.push(0);
+			} else {
+				const byte = parseInt(part, 16);
+				if (!isNaN(byte)) {
+					patternBytes.push(byte);
+					mask.push(1);
+				}
+			}
+			break;
+		}
+		case "int32": {
+			const int32Val = parseInt(pattern);
+			if (!isNaN(int32Val)) {
+				const buf = Buffer.allocUnsafe(4);
+				buf.writeInt32LE(int32Val, 0);
+				patternBytes.push(...buf);
+				mask.push(1, 1, 1, 1);
+			}
+			break;
+		}
+		case "int64": {
+			const int64Val = BigInt(pattern);
+			const buf64 = Buffer.allocUnsafe(8);
+			buf64.writeBigInt64LE(int64Val, 0);
+			patternBytes.push(...buf64);
+			mask.push(1, 1, 1, 1, 1, 1, 1, 1);
+			break;
+		}
+		case "float": {
+			const floatVal = parseFloat(pattern);
+			if (!isNaN(floatVal)) {
+				const bufFloat = Buffer.allocUnsafe(4);
+				bufFloat.writeFloatLE(floatVal, 0);
+				patternBytes.push(...bufFloat);
+				mask.push(1, 1, 1, 1);
+			}
+			break;
+		}
+		case "double": {
+			const doubleVal = parseFloat(pattern);
+			if (!isNaN(doubleVal)) {
+				const bufDouble = Buffer.allocUnsafe(8);
+				bufDouble.writeDoubleLE(doubleVal, 0);
+				patternBytes.push(...bufDouble);
+				mask.push(1, 1, 1, 1, 1, 1, 1, 1);
+			}
+			break;
+		}
+		case "string": {
+			const strBuf = Buffer.from(pattern, "utf8");
+			patternBytes.push(...strBuf);
+			mask.push(...strBuf.map(() => 1));
+			break;
+		}
+		case "byte": {
+			const byteVal = parseInt(pattern) & 255;
+			patternBytes.push(byteVal);
+			mask.push(1);
+			break;
+		}
+		case "int8": {
+			const int8Val = parseInt(pattern);
+			const buf8 = Buffer.allocUnsafe(1);
+			buf8.writeInt8(int8Val, 0);
+			patternBytes.push(...buf8);
+			mask.push(1);
+			break;
+		}
+		case "int16": {
+			const int16Val = parseInt(pattern);
+			const buf16s = Buffer.allocUnsafe(2);
+			buf16s.writeInt16LE(int16Val, 0);
+			patternBytes.push(...buf16s);
+			mask.push(1, 1);
+			break;
+		}
+		case "uint16": {
+			const uint16Val = parseInt(pattern);
+			const buf16u = Buffer.allocUnsafe(2);
+			buf16u.writeUInt16LE(uint16Val, 0);
+			patternBytes.push(...buf16u);
+			mask.push(1, 1);
+			break;
+		}
+		case "uint32": {
+			const uint32Val = parseInt(pattern) >>> 0;
+			const buf32u = Buffer.allocUnsafe(4);
+			buf32u.writeUInt32LE(uint32Val, 0);
+			patternBytes.push(...buf32u);
+			mask.push(1, 1, 1, 1);
+			break;
+		}
+		case "uint64":
+		case "pointer": {
+			const uint64Val = BigInt(pattern);
+			const buf64u = Buffer.allocUnsafe(8);
+			buf64u.writeBigUInt64LE(uint64Val, 0);
+			patternBytes.push(...buf64u);
+			mask.push(1, 1, 1, 1, 1, 1, 1, 1);
+			break;
+		}
+	}
+	return {
+		patternBytes,
+		mask
+	};
+}
+function findExactPatternBMH(buffer, pattern) {
+	const matches = [];
+	const patternLength = pattern.length;
+	if (patternLength === 0 || buffer.length < patternLength) return matches;
+	const lastIndex = patternLength - 1;
+	const skipTable = new Uint32Array(256);
+	skipTable.fill(patternLength);
+	for (let i = 0; i < lastIndex; i++) {
+		const patternByte = pattern[i];
+		if (patternByte !== void 0) skipTable[patternByte] = lastIndex - i;
+	}
+	let offset = 0;
+	while (offset <= buffer.length - patternLength) {
+		let patternIndex = lastIndex;
+		while (patternIndex >= 0 && buffer[offset + patternIndex] === pattern[patternIndex]) patternIndex--;
+		if (patternIndex < 0) {
+			matches.push(offset);
+			offset += 1;
+			continue;
+		}
+		const skipByte = buffer[offset + lastIndex];
+		if (skipByte === void 0) break;
+		offset += skipTable[skipByte] ?? patternLength;
+	}
+	return matches;
+}
+function findPatternInBuffer(buffer, pattern, mask) {
+	if (pattern.length === 0) return [];
+	if (mask.every((value) => value === 1)) return findExactPatternBMH(buffer, pattern);
+	const matches = [];
+	for (let i = 0; i <= buffer.length - pattern.length; i++) {
+		let found = true;
+		for (let j = 0; j < pattern.length; j++) if (mask[j] === 1 && buffer[i + j] !== pattern[j]) {
+			found = false;
+			break;
+		}
+		if (found) matches.push(i);
+	}
+	return matches;
+}
+function isExecutable(protect) {
+	return (protect & PAGE.EXECUTE) !== 0 || (protect & PAGE.EXECUTE_READ) !== 0 || (protect & PAGE.EXECUTE_READWRITE) !== 0;
+}
+//#endregion
+export { parsePattern as i, isExecutable as n, isKoffiAvailable as r, findPatternInBuffer as t };