@jshookmcp/jshook 0.2.6 → 0.2.7

package/dist/src/modules/process/memory/linux/mapsParser.d.ts

@@ -1,16 +0,0 @@
-export interface LinuxMemoryRegion {
-    start: bigint;
-    end: bigint;
-    permissions: {
-        read: boolean;
-        write: boolean;
-        exec: boolean;
-        private: boolean;
-    };
-    offset: bigint;
-    dev: string;
-    inode: number;
-    pathname: string;
-}
-export declare function parseProcMaps(content: string): LinuxMemoryRegion[];
-export declare function formatLinuxProtection(perms: LinuxMemoryRegion['permissions']): string;

package/dist/src/modules/process/memory/linux/mapsParser.js

@@ -1,28 +0,0 @@
-const PROC_MAPS_LINE_RE = /^([0-9a-f]+)-([0-9a-f]+)\s+([r-][w-][x-][ps])\s+([0-9a-f]+)\s+(\S+)\s+(\d+)\s*(.*)$/i;
-export function parseProcMaps(content) {
-    const regions = [];
-    for (const line of content.split(/\r?\n/)) {
-        const match = line.trimEnd().match(PROC_MAPS_LINE_RE);
-        if (!match)
-            continue;
-        const perms = match[3];
-        regions.push({
-            start: BigInt(`0x${match[1]}`),
-            end: BigInt(`0x${match[2]}`),
-            permissions: {
-                read: perms[0] === 'r',
-                write: perms[1] === 'w',
-                exec: perms[2] === 'x',
-                private: perms[3] === 'p',
-            },
-            offset: BigInt(`0x${match[4]}`),
-            dev: match[5],
-            inode: parseInt(match[6], 10),
-            pathname: match[7]?.trim() ?? '',
-        });
-    }
-    return regions;
-}
-export function formatLinuxProtection(perms) {
-    return `${perms.read ? 'r' : '-'}${perms.write ? 'w' : '-'}${perms.exec ? 'x' : '-'}`;
-}

package/dist/src/modules/process/memory/monitor.d.ts

@@ -1,6 +0,0 @@
-import { type MemoryReadResult } from '../../process/memory/types.js';
-export declare class MemoryMonitorManager {
-    private activeMonitors;
-    start(pid: number, address: string, size: number | undefined, intervalMs: number | undefined, readMemoryFn: (pid: number, address: string, size: number) => Promise<MemoryReadResult>, onChange?: (oldValue: string, newValue: string) => void): string;
-    stop(monitorId: string): boolean;
-}

package/dist/src/modules/process/memory/monitor.js

@@ -1,38 +0,0 @@
-import {} from '../../process/memory/types.js';
-export class MemoryMonitorManager {
-    activeMonitors = new Map();
-    start(pid, address, size = 4, intervalMs = 1000, readMemoryFn, onChange) {
-        const monitorId = `monitor_${Date.now()}_${Math.random().toString(36).substr(2, 9)}`;
-        const timer = setInterval(async () => {
-            const monitor = this.activeMonitors.get(monitorId);
-            if (!monitor)
-                return;
-            const result = await readMemoryFn(pid, address, size);
-            if (result.success && result.data) {
-                if (monitor.lastValue !== result.data) {
-                    if (onChange && monitor.lastValue !== '') {
-                        onChange(monitor.lastValue, result.data);
-                    }
-                    monitor.lastValue = result.data;
-                }
-            }
-        }, intervalMs);
-        this.activeMonitors.set(monitorId, {
-            pid,
-            address,
-            interval: intervalMs,
-            lastValue: '',
-            timer,
-        });
-        return monitorId;
-    }
-    stop(monitorId) {
-        const monitor = this.activeMonitors.get(monitorId);
-        if (monitor) {
-            clearInterval(monitor.timer);
-            this.activeMonitors.delete(monitorId);
-            return true;
-        }
-        return false;
-    }
-}

package/dist/src/modules/process/memory/reader.d.ts

@@ -1,2 +0,0 @@
-import { type Platform, type MemoryReadResult, type MemoryProtectionInfo } from '../../process/memory/types.js';
-export declare function readMemory(platform: Platform, pid: number, address: string, size: number, checkProtectionFn: (pid: number, address: string) => Promise<MemoryProtectionInfo>): Promise<MemoryReadResult>;

package/dist/src/modules/process/memory/reader.js

@@ -1,214 +0,0 @@
-import { promises as fs } from 'node:fs';
-import { logger } from '../../../utils/logger.js';
-import { nativeMemoryManager } from '../../../native/NativeMemoryManager.js';
-import { isKoffiAvailable } from '../../../native/Win32API.js';
-import { MEMORY_MAX_READ_BYTES } from '../../../constants.js';
-import { execAsync, executePowerShellScript, } from '../../process/memory/types.js';
-const HEX_ADDR = /^(?:0x)?[0-9a-fA-F]{1,16}$/;
-async function readMemoryWindows(pid, address, size) {
-    try {
-        const psScript = `
-        Add-Type @"
-          using System;
-          using System.Runtime.InteropServices;
-          using System.ComponentModel;
-
-          public class MemoryReader {
-            [DllImport("kernel32.dll", SetLastError = true)]
-            public static extern IntPtr OpenProcess(int access, bool inherit, int pid);
-
-            [DllImport("kernel32.dll", SetLastError = true)]
-            public static extern bool ReadProcessMemory(IntPtr hProcess, IntPtr addr, byte[] buffer, int size, out int read);
-
-            [DllImport("kernel32.dll", SetLastError = true)]
-            public static extern bool CloseHandle(IntPtr handle);
-
-            const int PROCESS_VM_READ = 0x0010;
-            const int PROCESS_QUERY_INFORMATION = 0x0400;
-
-            public static string ReadMemory(int pid, long address, int size) {
-              IntPtr hProcess = OpenProcess(PROCESS_VM_READ | PROCESS_QUERY_INFORMATION, false, pid);
-              if (hProcess == IntPtr.Zero) {
-                int error = Marshal.GetLastWin32Error();
-                throw new Win32Exception(error, "Failed to open process. Run as Administrator.");
-              }
-
-              try {
-                byte[] buffer = new byte[size];
-                int bytesRead;
-                bool success = ReadProcessMemory(hProcess, (IntPtr)address, buffer, size, out bytesRead);
-
-                if (!success) {
-                  int error = Marshal.GetLastWin32Error();
-                  throw new Win32Exception(error, "Failed to read memory");
-                }
-
-                return BitConverter.ToString(buffer, 0, bytesRead).Replace("-", " ");
-              } finally {
-                CloseHandle(hProcess);
-              }
-            }
-          }
-"@
-
-        try {
-          $result = [MemoryReader]::ReadMemory(${pid}, ${address}, ${size})
-          @{ success = $true; data = $result } | ConvertTo-Json -Compress
-        } catch {
-          @{ success = $false; error = $_.Exception.Message } | ConvertTo-Json -Compress
-        }
-      `;
-        const { stdout } = await executePowerShellScript(psScript, { maxBuffer: 1024 * 1024 * 10 });
-        const _trimmed = stdout.trim();
-        if (!_trimmed)
-            throw new Error('PowerShell returned empty output');
-        const result = JSON.parse(_trimmed);
-        return {
-            success: result.success,
-            data: result.data,
-            error: result.error,
-        };
-    }
-    catch (error) {
-        logger.error('Windows memory read failed:', error);
-        return {
-            success: false,
-            error: error instanceof Error
-                ? error.message
-                : 'PowerShell execution failed. Run as Administrator.',
-        };
-    }
-}
-async function readMemoryLinux(pid, address, size) {
-    try {
-        const { stdout } = await execAsync(`sudo dd if=/proc/${pid}/mem bs=1 skip=${address} count=${size} 2>/dev/null | xxd -p | tr -d '\\n' || echo ""`, { maxBuffer: 1024 * 1024 * 10, timeout: 10000 });
-        if (!stdout.trim()) {
-            return {
-                success: false,
-                error: 'Failed to read memory. Requires root privileges or ptrace access.',
-            };
-        }
-        const hexData = stdout
-            .trim()
-            .match(/.{1,2}/g)
-            ?.join(' ') || stdout.trim();
-        return {
-            success: true,
-            data: hexData.toUpperCase(),
-        };
-    }
-    catch (error) {
-        logger.error('Linux memory read failed:', error);
-        return {
-            success: false,
-            error: 'Memory read failed. Run as root or use ptrace.',
-        };
-    }
-}
-async function readMemoryMac(pid, address, size, checkProtectionFn) {
-    if (address === 0) {
-        return { success: false, error: 'Invalid address: null pointer (0x0)' };
-    }
-    if (size <= 0 || size > MEMORY_MAX_READ_BYTES) {
-        return { success: false, error: `Invalid size: must be 1–${MEMORY_MAX_READ_BYTES} bytes` };
-    }
-    const addrHex = `0x${address.toString(16)}`;
-    try {
-        const { createPlatformProvider } = await import('../../../native/platform/factory.js');
-        const provider = createPlatformProvider();
-        const avail = await provider.checkAvailability();
-        if (avail.available) {
-            const handle = provider.openProcess(pid, false);
-            try {
-                const result = provider.readMemory(handle, BigInt(address), size);
-                const hex = Array.from(result.data.subarray(0, result.bytesRead))
-                    .map((b) => b.toString(16).padStart(2, '0').toUpperCase())
-                    .join(' ');
-                logger.debug('Native Mach memory read succeeded (zero-pause)');
-                return { success: true, data: hex };
-            }
-            finally {
-                provider.closeProcess(handle);
-            }
-        }
-    }
-    catch (nativeErr) {
-        logger.debug('Native Mach read failed, falling back to lldb:', nativeErr);
-    }
-    const prot = await checkProtectionFn(pid, addrHex);
-    if (!prot.success) {
-        return { success: false, error: `Cannot verify memory region: ${prot.error}` };
-    }
-    if (!prot.isReadable) {
-        return {
-            success: false,
-            error: `Address ${addrHex} is not readable (protection: ${prot.protection ?? 'unknown'})`,
-        };
-    }
-    const tmpFile = `/tmp/mread_${pid}_${Date.now()}.bin`;
-    try {
-        const { stdout } = await execAsync(`lldb --batch -p ${pid} -o "memory read --outfile ${tmpFile} --binary ${addrHex} -c ${size}" -o "process detach"`, { timeout: 15000, maxBuffer: 1024 * 1024 * 10 });
-        if (!stdout.includes('bytes written')) {
-            const errLine = stdout.split('\n').find((l) => l.includes('error:')) ?? stdout;
-            return { success: false, error: `lldb memory read failed: ${errLine.trim()}` };
-        }
-        const data = await fs.readFile(tmpFile);
-        const hex = Array.from(data)
-            .map((b) => b.toString(16).padStart(2, '0').toUpperCase())
-            .join(' ');
-        return { success: true, data: hex };
-    }
-    catch (error) {
-        return { success: false, error: error instanceof Error ? error.message : String(error) };
-    }
-    finally {
-        await fs.unlink(tmpFile).catch(() => { });
-    }
-}
-export async function readMemory(platform, pid, address, size, checkProtectionFn) {
-    try {
-        if (!HEX_ADDR.test(address)) {
-            return { success: false, error: 'Invalid address format. Use hex like "0x12345678"' };
-        }
-        const addrNum = parseInt(address, 16);
-        if (isNaN(addrNum)) {
-            return { success: false, error: 'Invalid address format. Use hex like "0x12345678"' };
-        }
-        if (size <= 0 || size > MEMORY_MAX_READ_BYTES) {
-            return {
-                success: false,
-                error: `Read size must be 1–${MEMORY_MAX_READ_BYTES} bytes (${(MEMORY_MAX_READ_BYTES / 1024 / 1024).toFixed(0)} MB)`,
-            };
-        }
-        if (platform === 'win32' && isKoffiAvailable()) {
-            try {
-                const result = await nativeMemoryManager.readMemory(pid, address, size);
-                if (result.success) {
-                    logger.debug('Native memory read succeeded');
-                    return result;
-                }
-                logger.warn('Native memory read failed, falling back to PowerShell:', result.error);
-            }
-            catch (nativeError) {
-                logger.warn('Native memory read error, falling back to PowerShell:', nativeError);
-            }
-        }
-        switch (platform) {
-            case 'win32':
-                return readMemoryWindows(pid, addrNum, size);
-            case 'linux':
-                return readMemoryLinux(pid, addrNum, size);
-            case 'darwin':
-                return readMemoryMac(pid, addrNum, size, checkProtectionFn);
-            default:
-                return {
-                    success: false,
-                    error: `Memory operations not supported on platform: ${platform}`,
-                };
-        }
-    }
-    catch (error) {
-        logger.error('Memory read failed:', error);
-        return { success: false, error: error instanceof Error ? error.message : String(error) };
-    }
-}

package/dist/src/modules/process/memory/regions.d.ts

@@ -1 +0,0 @@
-export { dumpMemoryRegion, enumerateRegions, checkMemoryProtection, enumerateModules, } from '../../process/memory/regions.impl.js';

package/dist/src/modules/process/memory/regions.dump.d.ts

@@ -1,5 +0,0 @@
-import { type Platform } from '../../process/memory/types.js';
-export declare function dumpMemoryRegion(platform: Platform, pid: number, startAddress: string, size: number, outputPath: string): Promise<{
-    success: boolean;
-    error?: string;
-}>;

package/dist/src/modules/process/memory/regions.dump.js

@@ -1,119 +0,0 @@
-import { logger } from '../../../utils/logger.js';
-import { execFileAsync, executePowerShellScript, } from '../../process/memory/types.js';
-function buildMemoryDumpScript(pid, address, size, outputPath) {
-    return `
-Add-Type @"
-using System;
-using System.Runtime.InteropServices;
-using System.IO;
-using System.ComponentModel;
-
-public class MemoryDumper {
-    [DllImport("kernel32.dll", SetLastError = true)]
-    public static extern IntPtr OpenProcess(int access, bool inherit, int pid);
-
-    [DllImport("kernel32.dll", SetLastError = true)]
-    public static extern bool ReadProcessMemory(IntPtr hProcess, IntPtr addr, byte[] buffer, int size, out int read);
-
-    [DllImport("kernel32.dll", SetLastError = true)]
-    public static extern bool CloseHandle(IntPtr handle);
-
-    const int PROCESS_VM_READ = 0x0010;
-    const int PROCESS_QUERY_INFORMATION = 0x0400;
-
-    public static string DumpMemory(int pid, long address, int size, string outputPath) {
-        IntPtr hProcess = OpenProcess(PROCESS_VM_READ | PROCESS_QUERY_INFORMATION, false, pid);
-        if (hProcess == IntPtr.Zero) {
-            int error = Marshal.GetLastWin32Error();
-            throw new Win32Exception(error, "Failed to open process. Run as Administrator.");
-        }
-
-        try {
-            byte[] buffer = new byte[size];
-            int bytesRead;
-
-            if (!ReadProcessMemory(hProcess, (IntPtr)address, buffer, size, out bytesRead)) {
-                int error = Marshal.GetLastWin32Error();
-                throw new Win32Exception(error, "Failed to read memory");
-            }
-
-            File.WriteAllBytes(outputPath, buffer);
-            return "Dumped " + bytesRead + " bytes to " + outputPath;
-        } finally {
-            CloseHandle(hProcess);
-        }
-    }
-}
-"@
-
-try {
-    $result = [MemoryDumper]::DumpMemory(${pid}, ${address}, ${size}, "${outputPath.replace(/\\/g, '\\\\').replace(/"/g, '`"').replace(/\$/g, '`$')}")
-    @{ success = $true; message = $result } | ConvertTo-Json -Compress
-} catch {
-    @{ success = $false; error = $_.Exception.Message } | ConvertTo-Json -Compress
-}
-  `.trim();
-}
-export async function dumpMemoryRegion(platform, pid, startAddress, size, outputPath) {
-    if (platform !== 'win32' && platform !== 'darwin') {
-        return {
-            success: false,
-            error: 'Memory dump currently only implemented for Windows and macOS',
-        };
-    }
-    if (platform === 'darwin') {
-        const addrNum = parseInt(startAddress, 16);
-        if (isNaN(addrNum))
-            return { success: false, error: 'Invalid address format' };
-        if (!Number.isInteger(pid) || pid <= 0)
-            return { success: false, error: 'Invalid pid' };
-        if (!Number.isInteger(size) || size <= 0)
-            return { success: false, error: 'Invalid size' };
-        const addrHex = `0x${addrNum.toString(16)}`;
-        try {
-            const { stdout } = await execFileAsync('lldb', [
-                '--batch',
-                '-p',
-                String(pid),
-                '-o',
-                `memory read --outfile ${outputPath} --binary ${addrHex} -c ${size}`,
-                '-o',
-                'process detach',
-            ], { timeout: 60000, maxBuffer: 1024 * 1024 });
-            if (!stdout.includes('bytes written')) {
-                const errLine = stdout.split('\n').find((l) => l.includes('error:')) ?? stdout;
-                return { success: false, error: `lldb dump failed: ${errLine.trim()}` };
-            }
-            return { success: true };
-        }
-        catch (error) {
-            return { success: false, error: error instanceof Error ? error.message : String(error) };
-        }
-    }
-    try {
-        const addrNum = parseInt(startAddress, 16);
-        if (isNaN(addrNum))
-            return { success: false, error: 'Invalid address format' };
-        if (!Number.isInteger(pid) || pid <= 0)
-            return { success: false, error: 'Invalid pid' };
-        if (!Number.isInteger(size) || size <= 0)
-            return { success: false, error: 'Invalid size' };
-        const psScript = buildMemoryDumpScript(pid, addrNum, size, outputPath);
-        const { stdout } = await executePowerShellScript(psScript, {
-            maxBuffer: 1024 * 1024,
-            timeout: 60000,
-        });
-        const _trimmed = stdout.trim();
-        if (!_trimmed)
-            throw new Error('PowerShell returned empty output');
-        const result = JSON.parse(_trimmed);
-        return { success: result.success, error: result.error };
-    }
-    catch (error) {
-        logger.error('Memory dump failed:', error);
-        return {
-            success: false,
-            error: error instanceof Error ? error.message : 'PowerShell execution failed',
-        };
-    }
-}

package/dist/src/modules/process/memory/regions.enumerate.d.ts

@@ -1,18 +0,0 @@
-import { type MemoryRegion, type Platform } from '../../process/memory/types.js';
-interface DarwinMemoryRegion {
-    baseAddress: string;
-    size: number;
-    type: string;
-    protect: string;
-    maxProtect: string;
-    isReadable: boolean;
-    isWritable: boolean;
-    isExecutable: boolean;
-}
-export type EnumeratedRegion = MemoryRegion | DarwinMemoryRegion;
-export declare function enumerateRegions(platform: Platform, pid: number): Promise<{
-    success: boolean;
-    regions?: EnumeratedRegion[];
-    error?: string;
-}>;
-export {};

package/dist/src/modules/process/memory/regions.enumerate.js

@@ -1,219 +0,0 @@
-import { readFileSync } from 'fs';
-import { logger } from '../../../utils/logger.js';
-import { execAsync, executePowerShellScript, } from '../../process/memory/types.js';
-import { nativeMemoryManager } from '../../../native/NativeMemoryManager.js';
-import { isKoffiAvailable } from '../../../native/NativeMemoryManager.utils.js';
-import { parseProcMaps, formatLinuxProtection } from './linux/mapsParser.js';
-function buildEnumerateRegionsScript(pid) {
-    return `
-Add-Type @"
-using System;
-using System.Runtime.InteropServices;
-using System.Collections.Generic;
-using System.ComponentModel;
-
-public class RegionEnumerator {
-    [DllImport("kernel32.dll", SetLastError = true)]
-    public static extern IntPtr OpenProcess(int access, bool inherit, int pid);
-
-    [DllImport("kernel32.dll", SetLastError = true)]
-    public static extern int VirtualQueryEx(IntPtr hProcess, IntPtr addr, out MEMORY_BASIC_INFORMATION info, int size);
-
-    [DllImport("kernel32.dll", SetLastError = true)]
-    public static extern bool CloseHandle(IntPtr handle);
-
-    const int PROCESS_QUERY_INFORMATION = 0x0400;
-
-    [StructLayout(LayoutKind.Sequential)]
-    public struct MEMORY_BASIC_INFORMATION {
-        public IntPtr BaseAddress;
-        public IntPtr AllocationBase;
-        public uint AllocationProtect;
-        public IntPtr RegionSize;
-        public uint State;
-        public uint Protect;
-        public uint Type;
-    }
-
-    const uint MEM_COMMIT = 0x1000;
-    const uint MEM_FREE = 0x10000;
-    const uint MEM_RESERVE = 0x2000;
-    const uint PAGE_READONLY = 0x02;
-    const uint PAGE_READWRITE = 0x04;
-    const uint PAGE_WRITECOPY = 0x08;
-    const uint PAGE_EXECUTE = 0x10;
-    const uint PAGE_EXECUTE_READ = 0x20;
-    const uint PAGE_EXECUTE_READWRITE = 0x40;
-
-    public static List<object> EnumerateRegions(int pid) {
-        var regions = new List<object>();
-        IntPtr hProcess = OpenProcess(PROCESS_QUERY_INFORMATION, false, pid);
-        if (hProcess == IntPtr.Zero) {
-            int error = Marshal.GetLastWin32Error();
-            throw new Win32Exception(error, "Failed to open process. Run as Administrator.");
-        }
-
-        try {
-            IntPtr addr = IntPtr.Zero;
-            MEMORY_BASIC_INFORMATION info;
-            int infoSize = Marshal.SizeOf(typeof(MEMORY_BASIC_INFORMATION));
-            int scannedRegions = 0;
-
-            while (VirtualQueryEx(hProcess, addr, out info, infoSize) == infoSize) {
-                scannedRegions++;
-                string state = info.State == MEM_COMMIT ? "COMMIT" : (info.State == MEM_RESERVE ? "RESERVE" : (info.State == MEM_FREE ? "FREE" : "UNKNOWN"));
-                string protect = GetProtectionString(info.Protect);
-                bool isReadable = (info.State == MEM_COMMIT) && ((info.Protect & (PAGE_READONLY | PAGE_READWRITE | PAGE_EXECUTE_READ | PAGE_EXECUTE_READWRITE)) != 0);
-
-                regions.Add(new {
-                    baseAddress = "0x" + info.BaseAddress.ToInt64().ToString("X"),
-                    size = info.RegionSize.ToInt64(),
-                    state = state,
-                    protection = protect,
-                    isReadable = isReadable,
-                    type = info.Type == 0x1000000 ? "IMAGE" : (info.Type == 0x40000 ? "MAPPED" : "PRIVATE")
-                });
-
-                if (regions.Count >= 10000 || scannedRegions >= 50000) break;
-                long baseAddr = info.BaseAddress.ToInt64();
-                long regionSize = info.RegionSize.ToInt64();
-                if (regionSize <= 0) break;
-                long nextAddr = baseAddr + regionSize;
-                if (nextAddr <= baseAddr) break;
-                addr = new IntPtr(nextAddr);
-                if (addr.ToInt64() >= 0x7FFFFFFF0000) break;
-            }
-
-            return regions;
-        } finally {
-            CloseHandle(hProcess);
-        }
-    }
-
-    private static string GetProtectionString(uint protect) {
-        if (protect == 0) return "NOACCESS";
-        string s = "";
-        if ((protect & 0x100) != 0) s += "NOACCESS ";
-        if ((protect & PAGE_READONLY) != 0) s += "R ";
-        if ((protect & PAGE_READWRITE) != 0) s += "RW ";
-        if ((protect & PAGE_WRITECOPY) != 0) s += "W ";
-        if ((protect & PAGE_EXECUTE) != 0) s += "X ";
-        if ((protect & PAGE_EXECUTE_READ) != 0) s += "RX ";
-        if ((protect & PAGE_EXECUTE_READWRITE) != 0) s += "RWX ";
-        if ((protect & 0x100) != 0) s += "GUARD ";
-        return s.Trim();
-    }
-}
-"@
-
-try {
-    $regions = [RegionEnumerator]::EnumerateRegions(${pid})
-    @{ success = $true; regions = $regions; count = $regions.Count } | ConvertTo-Json -Compress -Depth 10
-} catch {
-    @{ success = $false; error = $_.Exception.Message } | ConvertTo-Json -Compress
-}
-  `.trim();
-}
-export async function enumerateRegions(platform, pid) {
-    if (platform === 'linux') {
-        try {
-            const mapsContent = readFileSync(`/proc/${pid}/maps`, 'utf-8');
-            const readableRegions = parseProcMaps(mapsContent).filter((region) => region.permissions.read);
-            const regions = readableRegions.map((region) => ({
-                baseAddress: `0x${region.start.toString(16)}`,
-                size: Number(region.end - region.start),
-                state: 'COMMIT',
-                protection: formatLinuxProtection(region.permissions),
-                isReadable: true,
-                type: region.pathname || 'anonymous',
-            }));
-            return { success: true, regions };
-        }
-        catch (error) {
-            logger.error('Linux region enumeration failed:', error);
-            return { success: false, error: error instanceof Error ? error.message : String(error) };
-        }
-    }
-    if (platform !== 'win32' && platform !== 'darwin') {
-        return {
-            success: false,
-            error: 'Region enumeration currently only implemented for Windows, Linux, and macOS',
-        };
-    }
-    if (platform === 'darwin') {
-        try {
-            const { stdout } = await execAsync(`vmmap -v ${pid}`, {
-                timeout: 15000,
-                maxBuffer: 1024 * 1024 * 5,
-            });
-            const regions = [];
-            const regionRe = /^(\S[^\t]*?)\s{2,}([0-9a-f]+)-([0-9a-f]+)\s+\[.*?\]\s+([a-z-]+)\/([a-z-]+)/;
-            for (const line of stdout.split('\n')) {
-                const m = line.match(regionRe);
-                if (!m)
-                    continue;
-                const type = m[1];
-                const start = m[2];
-                const end = m[3];
-                const prot = m[4];
-                const maxProt = m[5];
-                const startNum = parseInt(start, 16);
-                const endNum = parseInt(end, 16);
-                regions.push({
-                    baseAddress: `0x${start}`,
-                    size: endNum - startNum,
-                    type: type.trim(),
-                    protect: prot,
-                    maxProtect: maxProt,
-                    isReadable: prot.includes('r'),
-                    isWritable: prot.includes('w'),
-                    isExecutable: prot.includes('x'),
-                });
-            }
-            return { success: true, regions };
-        }
-        catch (error) {
-            logger.error('macOS region enumeration failed:', error);
-            return { success: false, error: error instanceof Error ? error.message : String(error) };
-        }
-    }
-    if (isKoffiAvailable()) {
-        try {
-            const nativeResult = await nativeMemoryManager.enumerateRegions(pid);
-            if (nativeResult.success) {
-                return nativeResult;
-            }
-            logger.warn('Native Windows region enumeration failed, falling back to PowerShell', {
-                pid,
-                error: nativeResult.error,
-                nativeAvailable: isKoffiAvailable(),
-            });
-        }
-        catch (error) {
-            logger.warn('Native Windows region enumeration threw, falling back to PowerShell', {
-                pid,
-                error: error instanceof Error ? error.message : String(error),
-                nativeAvailable: isKoffiAvailable(),
-            });
-        }
-    }
-    try {
-        const psScript = buildEnumerateRegionsScript(pid);
-        const { stdout } = await executePowerShellScript(psScript, {
-            maxBuffer: 1024 * 1024 * 10,
-            timeout: 30000,
-        });
-        const _trimmed = stdout.trim();
-        if (!_trimmed)
-            throw new Error('PowerShell returned empty output');
-        const result = JSON.parse(_trimmed);
-        return { success: result.success, regions: result.regions, error: result.error };
-    }
-    catch (error) {
-        logger.error('Region enumeration failed:', error);
-        return {
-            success: false,
-            error: error instanceof Error ? error.message : 'PowerShell execution failed',
-        };
-    }
-}