@jshookmcp/jshook 0.2.6 → 0.2.8

package/dist/factory-CibqTNC8.mjs

@@ -0,0 +1,590 @@
+import { t as __exportAll } from "./chunk-CjcI7cDX.mjs";
+import { _ as WriteProcessMemory, b as openProcessForMemory, d as ReadProcessMemory, f as VirtualAllocEx, h as VirtualQueryEx, i as GetModuleBaseName, l as MEM, m as VirtualProtectEx, n as EnumProcessModules, p as VirtualFreeEx, s as GetModuleInformation, t as CloseHandle, u as PAGE, v as isKoffiAvailable, y as isWindows } from "./Win32API-Bc0QnQsN.mjs";
+import { _ as machVmReadOverwrite, a as VM_PROT, b as taskForPid, c as dyldImageCount, d as kernReturnName, f as machPortDeallocate, g as machVmProtect, h as machVmDeallocate, i as VM_FLAGS, l as isDarwin, m as machVmAllocate, n as KERN, o as dyldGetImageHeader, p as machTaskSelf, r as SM, s as dyldGetImageName, u as isKoffiAvailableOnDarwin, v as machVmRegion, y as machVmWrite } from "./DarwinAPI-B8hg_yhz.mjs";
+import fs from "node:fs";
+//#region src/native/platform/types.ts
+/** Memory protection flags (platform-independent) */
+let MemoryProtection = /* @__PURE__ */ function(MemoryProtection) {
+	MemoryProtection[MemoryProtection["NoAccess"] = 0] = "NoAccess";
+	MemoryProtection[MemoryProtection["Read"] = 1] = "Read";
+	MemoryProtection[MemoryProtection["Write"] = 2] = "Write";
+	MemoryProtection[MemoryProtection["Execute"] = 4] = "Execute";
+	MemoryProtection[MemoryProtection["ReadWrite"] = 3] = "ReadWrite";
+	MemoryProtection[MemoryProtection["ReadExecute"] = 5] = "ReadExecute";
+	MemoryProtection[MemoryProtection["ReadWriteExecute"] = 7] = "ReadWriteExecute";
+	MemoryProtection[MemoryProtection["Guard"] = 8] = "Guard";
+	MemoryProtection[MemoryProtection["WriteCopy"] = 16] = "WriteCopy";
+	return MemoryProtection;
+}({});
+//#endregion
+//#region src/native/platform/win32/Win32MemoryProvider.ts
+const handleMap$1 = /* @__PURE__ */ new WeakMap();
+function getWin32Handle(handle) {
+	const h = handleMap$1.get(handle);
+	if (h === void 0) throw new Error("Invalid ProcessHandle — not a Win32 handle");
+	return h;
+}
+function win32ProtToMemoryProtection(prot) {
+	let flags = MemoryProtection.NoAccess;
+	if (prot & PAGE.READONLY) flags |= MemoryProtection.Read;
+	if (prot & PAGE.READWRITE) flags |= MemoryProtection.ReadWrite;
+	if (prot & PAGE.WRITECOPY) flags |= MemoryProtection.Read | MemoryProtection.WriteCopy;
+	if (prot & PAGE.EXECUTE) flags |= MemoryProtection.Execute;
+	if (prot & PAGE.EXECUTE_READ) flags |= MemoryProtection.ReadExecute;
+	if (prot & PAGE.EXECUTE_READWRITE) flags |= MemoryProtection.ReadWriteExecute;
+	if (prot & PAGE.EXECUTE_WRITECOPY) flags |= MemoryProtection.Execute | MemoryProtection.Read | MemoryProtection.WriteCopy;
+	if (prot & PAGE.GUARD) flags |= MemoryProtection.Guard;
+	return flags;
+}
+function memoryProtectionToWin32Prot(prot) {
+	const hasRead = (prot & MemoryProtection.Read) !== 0;
+	const hasWrite = (prot & MemoryProtection.Write) !== 0;
+	const hasExec = (prot & MemoryProtection.Execute) !== 0;
+	let page = PAGE.NOACCESS;
+	if (hasRead && hasWrite && hasExec) page = PAGE.EXECUTE_READWRITE;
+	else if (hasRead && hasExec) page = PAGE.EXECUTE_READ;
+	else if (hasRead && hasWrite) page = PAGE.READWRITE;
+	else if (hasExec) page = PAGE.EXECUTE;
+	else if (hasRead) page = PAGE.READONLY;
+	if ((prot & MemoryProtection.Guard) !== 0) page |= PAGE.GUARD;
+	return page;
+}
+function win32StateToState(state) {
+	if (state === MEM.COMMIT) return "committed";
+	if (state === MEM.RESERVE) return "reserved";
+	return "free";
+}
+function win32TypeToType(type) {
+	if (type === 16777216) return "image";
+	if (type === 262144) return "mapped";
+	if (type === 131072) return "private";
+	return "unknown";
+}
+var Win32MemoryProvider = class {
+	platform = "win32";
+	async checkAvailability() {
+		if (!isWindows()) return {
+			available: false,
+			reason: "Not running on Windows",
+			platform: "win32"
+		};
+		if (!isKoffiAvailable()) return {
+			available: false,
+			reason: "koffi FFI library not available",
+			platform: "win32"
+		};
+		return {
+			available: true,
+			platform: "win32"
+		};
+	}
+	openProcess(pid, writeAccess) {
+		const nativeHandle = openProcessForMemory(pid, writeAccess);
+		const handle = {
+			pid,
+			writeAccess
+		};
+		handleMap$1.set(handle, nativeHandle);
+		return handle;
+	}
+	closeProcess(handle) {
+		CloseHandle(getWin32Handle(handle));
+	}
+	readMemory(handle, address, size) {
+		const buffer = ReadProcessMemory(getWin32Handle(handle), address, size);
+		return {
+			data: buffer,
+			bytesRead: buffer.length
+		};
+	}
+	writeMemory(handle, address, data) {
+		return { bytesWritten: WriteProcessMemory(getWin32Handle(handle), address, data) };
+	}
+	queryRegion(handle, address) {
+		const { success, info } = VirtualQueryEx(getWin32Handle(handle), address);
+		if (!success || info.RegionSize === 0n) return null;
+		const protection = win32ProtToMemoryProtection(info.Protect);
+		return {
+			baseAddress: info.BaseAddress,
+			size: Number(info.RegionSize),
+			protection,
+			state: win32StateToState(info.State),
+			type: win32TypeToType(info.Type),
+			isReadable: (protection & MemoryProtection.Read) !== 0,
+			isWritable: (protection & MemoryProtection.Write) !== 0,
+			isExecutable: (protection & MemoryProtection.Execute) !== 0
+		};
+	}
+	changeProtection(handle, address, size, newProtection) {
+		const { success, oldProtect } = VirtualProtectEx(getWin32Handle(handle), address, size, memoryProtectionToWin32Prot(newProtection));
+		if (!success) throw new Error("VirtualProtectEx failed");
+		return { oldProtection: win32ProtToMemoryProtection(oldProtect) };
+	}
+	allocateMemory(handle, size, protection) {
+		const h = getWin32Handle(handle);
+		const win32Prot = memoryProtectionToWin32Prot(protection);
+		const address = VirtualAllocEx(h, 0n, size, MEM.COMMIT | MEM.RESERVE, win32Prot);
+		if (!address) throw new Error("VirtualAllocEx failed");
+		return { address };
+	}
+	freeMemory(handle, address, _size) {
+		VirtualFreeEx(getWin32Handle(handle), address, 0, MEM.RELEASE);
+	}
+	enumerateModules(handle) {
+		const h = getWin32Handle(handle);
+		const { success, modules: handles, count } = EnumProcessModules(h);
+		if (!success) throw new Error("EnumProcessModules failed");
+		const modules = [];
+		for (let i = 0; i < count; i++) {
+			const hModule = handles[i];
+			if (!hModule) continue;
+			const name = GetModuleBaseName(h, hModule);
+			const { success: infoSuccess, info } = GetModuleInformation(h, hModule);
+			if (infoSuccess && info) modules.push({
+				name,
+				baseAddress: BigInt(info.lpBaseOfDll),
+				size: info.SizeOfImage
+			});
+		}
+		return modules;
+	}
+};
+//#endregion
+//#region src/native/platform/darwin/DarwinMemoryProvider.ts
+const handleMap = /* @__PURE__ */ new WeakMap();
+function getDarwinHandle(handle) {
+	const h = handleMap.get(handle);
+	if (h === void 0) throw new Error("Invalid ProcessHandle — not a Darwin handle");
+	return h;
+}
+/**
+* Map Mach VM_PROT_* flags → platform-agnostic MemoryProtection
+*/
+function machProtToMemoryProtection(prot) {
+	let flags = MemoryProtection.NoAccess;
+	if (prot & VM_PROT.READ) flags |= MemoryProtection.Read;
+	if (prot & VM_PROT.WRITE) flags |= MemoryProtection.Write;
+	if (prot & VM_PROT.EXECUTE) flags |= MemoryProtection.Execute;
+	return flags;
+}
+/**
+* Map platform-agnostic MemoryProtection → Mach VM_PROT_* flags
+*/
+function memoryProtectionToMachProt(prot) {
+	let machProt = VM_PROT.NONE;
+	if (prot & MemoryProtection.Read) machProt |= VM_PROT.READ;
+	if (prot & MemoryProtection.Write) machProt |= VM_PROT.WRITE;
+	if (prot & MemoryProtection.Execute) machProt |= VM_PROT.EXECUTE;
+	return machProt;
+}
+/**
+* Map Mach share mode → platform-agnostic MemoryRegionType.
+* macOS doesn't distinguish "image" from "mapped" at the vm_region level,
+* so we use share mode as the best approximation.
+*/
+function darwinShareModeToType(shareMode) {
+	switch (shareMode) {
+		case SM.PRIVATE:
+		case SM.PRIVATE_ALIASED:
+		case SM.COW: return "private";
+		case SM.SHARED:
+		case SM.TRUESHARED:
+		case SM.SHARED_ALIASED: return "mapped";
+		case SM.EMPTY: return "unknown";
+		default: return "unknown";
+	}
+}
+var DarwinMemoryProvider = class {
+	platform = "darwin";
+	async checkAvailability() {
+		if (!isDarwin()) return {
+			available: false,
+			reason: "Not running on macOS",
+			platform: "darwin"
+		};
+		if (!isKoffiAvailableOnDarwin()) return {
+			available: false,
+			reason: "koffi FFI library cannot load libSystem.B.dylib",
+			platform: "darwin"
+		};
+		try {
+			const { kr } = taskForPid(machTaskSelf(), process.pid);
+			if (kr !== KERN.SUCCESS) return {
+				available: false,
+				reason: `task_for_pid failed (${kernReturnName(kr)}). Run with sudo or add debugger entitlement.`,
+				platform: "darwin"
+			};
+		} catch (err) {
+			const message = err instanceof Error ? err.message : String(err);
+			return {
+				available: false,
+				reason: /signal|bus error|segfault|abort/i.test(message) ? `Mach API call crashed (${message}). This may be caused by SIP (System Integrity Protection) on ARM64 macOS. Disable SIP or use a code-signed binary with com.apple.security.cs.debugger entitlement.` : `task_for_pid permission check failed: ${message}. Run with sudo or add debugger entitlement.`,
+				platform: "darwin"
+			};
+		}
+		return {
+			available: true,
+			platform: "darwin"
+		};
+	}
+	openProcess(pid, _writeAccess) {
+		const { kr, task } = taskForPid(machTaskSelf(), pid);
+		if (kr !== KERN.SUCCESS) throw new Error(`Failed to open process ${pid}: ${kernReturnName(kr)} (${kr}). ` + (kr === KERN.FAILURE ? "Run with sudo or sign with com.apple.security.cs.debugger entitlement." : kr === KERN.INVALID_ARGUMENT ? "Invalid PID — process may not exist." : "Check macOS permissions."));
+		const handle = {
+			pid,
+			writeAccess: _writeAccess
+		};
+		handleMap.set(handle, { task });
+		return handle;
+	}
+	closeProcess(handle) {
+		const h = getDarwinHandle(handle);
+		machPortDeallocate(machTaskSelf(), h.task);
+	}
+	readMemory(handle, address, size) {
+		const { kr, data, outsize } = machVmReadOverwrite(getDarwinHandle(handle).task, address, size);
+		if (kr !== KERN.SUCCESS) throw new Error(`mach_vm_read_overwrite failed at 0x${address.toString(16)}: ${kernReturnName(kr)} (${kr})`);
+		return {
+			data,
+			bytesRead: Number(outsize)
+		};
+	}
+	writeMemory(handle, address, data) {
+		const kr = machVmWrite(getDarwinHandle(handle).task, address, data);
+		if (kr !== KERN.SUCCESS) throw new Error(`mach_vm_write failed at 0x${address.toString(16)}: ${kernReturnName(kr)} (${kr})`);
+		return { bytesWritten: data.length };
+	}
+	queryRegion(handle, address) {
+		const { kr, address: regionBase, size: regionSize, info } = machVmRegion(getDarwinHandle(handle).task, address);
+		if (kr !== KERN.SUCCESS) return null;
+		const protection = machProtToMemoryProtection(info.protection);
+		return {
+			baseAddress: regionBase,
+			size: Number(regionSize),
+			protection,
+			state: "committed",
+			type: darwinShareModeToType(info.behavior),
+			isReadable: (protection & MemoryProtection.Read) !== 0,
+			isWritable: (protection & MemoryProtection.Write) !== 0,
+			isExecutable: (protection & MemoryProtection.Execute) !== 0
+		};
+	}
+	changeProtection(handle, address, size, newProtection) {
+		const h = getDarwinHandle(handle);
+		const machProt = memoryProtectionToMachProt(newProtection);
+		const { kr: queryKr, info } = machVmRegion(h.task, address);
+		const oldProtection = queryKr === KERN.SUCCESS ? machProtToMemoryProtection(info.protection) : MemoryProtection.NoAccess;
+		if ((machProt & VM_PROT.WRITE) !== 0 && (machProt & VM_PROT.EXECUTE) !== 0) {
+			const maxKr = machVmProtect(h.task, address, BigInt(size), true, VM_PROT.ALL);
+			if (maxKr !== KERN.SUCCESS) throw new Error(`mach_vm_protect (set_maximum) failed at 0x${address.toString(16)}: ${kernReturnName(maxKr)} (${maxKr})`);
+		}
+		const kr = machVmProtect(h.task, address, BigInt(size), false, machProt);
+		if (kr !== KERN.SUCCESS) throw new Error(`mach_vm_protect failed at 0x${address.toString(16)}: ${kernReturnName(kr)} (${kr})`);
+		return { oldProtection };
+	}
+	allocateMemory(handle, size, protection) {
+		const h = getDarwinHandle(handle);
+		const { kr, address } = machVmAllocate(h.task, BigInt(size), VM_FLAGS.ANYWHERE);
+		if (kr !== KERN.SUCCESS) throw new Error(`mach_vm_allocate failed: ${kernReturnName(kr)} (${kr})`);
+		const machProt = memoryProtectionToMachProt(protection);
+		if (machProt !== (VM_PROT.READ | VM_PROT.WRITE)) {
+			const protKr = machVmProtect(h.task, address, BigInt(size), false, machProt);
+			if (protKr !== KERN.SUCCESS) {
+				machVmDeallocate(h.task, address, BigInt(size));
+				throw new Error(`mach_vm_protect after allocate failed: ${kernReturnName(protKr)} (${protKr})`);
+			}
+		}
+		return { address };
+	}
+	freeMemory(handle, address, size) {
+		const kr = machVmDeallocate(getDarwinHandle(handle).task, address, BigInt(size));
+		if (kr !== KERN.SUCCESS) throw new Error(`mach_vm_deallocate failed at 0x${address.toString(16)}: ${kernReturnName(kr)} (${kr})`);
+	}
+	enumerateModules(handle) {
+		const h = getDarwinHandle(handle);
+		if (handle.pid === process.pid) return this._enumerateModulesSelf();
+		return this._enumerateModulesRemote(h.task);
+	}
+	/**
+	* Enumerate modules for the current process using dyld APIs (fast path).
+	*/
+	_enumerateModulesSelf() {
+		const count = dyldImageCount();
+		const modules = [];
+		for (let i = 0; i < count; i++) {
+			const name = dyldGetImageName(i);
+			const header = dyldGetImageHeader(i);
+			if (!name || header === 0n) continue;
+			const basename = name.split("/").pop() ?? name;
+			modules.push({
+				name: basename,
+				baseAddress: header,
+				size: 0
+			});
+		}
+		return modules;
+	}
+	/**
+	* Enumerate modules for a remote process by reading dyld_all_image_infos.
+	*
+	* This reads the target process's dyld info structures from memory.
+	* Falls back to an empty list if the info struct cannot be located.
+	*/
+	_enumerateModulesRemote(task) {
+		const modules = [];
+		let address = 0n;
+		for (let i = 0; i < 1e4; i++) {
+			const { kr, address: regionBase, size: regionSize, info } = machVmRegion(task, address);
+			if (kr !== KERN.SUCCESS) break;
+			const isReadable = (info.protection & VM_PROT.READ) !== 0;
+			const isExecutable = (info.protection & VM_PROT.EXECUTE) !== 0;
+			if (isReadable && isExecutable && regionSize > 0n) try {
+				const { kr: readKr, data } = machVmReadOverwrite(task, regionBase, 4);
+				if (readKr === KERN.SUCCESS && data.length >= 4) {
+					const magic = data.readUInt32LE(0);
+					if (magic === 4277009103 || magic === 4277009102) modules.push({
+						name: `module_0x${regionBase.toString(16)}`,
+						baseAddress: regionBase,
+						size: Number(regionSize)
+					});
+				}
+			} catch {}
+			address = regionBase + regionSize;
+		}
+		return modules;
+	}
+};
+//#endregion
+//#region src/modules/process/memory/linux/mapsParser.ts
+const PROC_MAPS_LINE_RE = /^([0-9a-f]+)-([0-9a-f]+)\s+([r-][w-][x-][ps])\s+([0-9a-f]+)\s+(\S+)\s+(\d+)\s*(.*)$/i;
+function parseProcMaps(content) {
+	const regions = [];
+	for (const line of content.split(/\r?\n/)) {
+		const match = line.trimEnd().match(PROC_MAPS_LINE_RE);
+		if (!match) continue;
+		const perms = match[3];
+		regions.push({
+			start: BigInt(`0x${match[1]}`),
+			end: BigInt(`0x${match[2]}`),
+			permissions: {
+				read: perms[0] === "r",
+				write: perms[1] === "w",
+				exec: perms[2] === "x",
+				private: perms[3] === "p"
+			},
+			offset: BigInt(`0x${match[4]}`),
+			dev: match[5],
+			inode: parseInt(match[6], 10),
+			pathname: match[7]?.trim() ?? ""
+		});
+	}
+	return regions;
+}
+function formatLinuxProtection(perms) {
+	return `${perms.read ? "r" : "-"}${perms.write ? "w" : "-"}${perms.exec ? "x" : "-"}`;
+}
+//#endregion
+//#region src/native/platform/linux/LinuxMemoryProvider.impl.ts
+function isLinuxRuntime() {
+	return process.platform === "linux";
+}
+function toProtection(perms) {
+	let protection = MemoryProtection.NoAccess;
+	if (perms.includes("r")) protection |= MemoryProtection.Read;
+	if (perms.includes("w")) protection |= MemoryProtection.Write;
+	if (perms.includes("x")) protection |= MemoryProtection.Execute;
+	return protection;
+}
+function toRegionInfo(region) {
+	const protection = toProtection(region.perms);
+	return {
+		baseAddress: region.start,
+		size: Number(region.end - region.start),
+		protection,
+		state: "committed",
+		type: region.path ? "mapped" : "private",
+		isReadable: (protection & MemoryProtection.Read) !== 0,
+		isWritable: (protection & MemoryProtection.Write) !== 0,
+		isExecutable: (protection & MemoryProtection.Execute) !== 0
+	};
+}
+function normalizePattern(pattern) {
+	if (Buffer.isBuffer(pattern)) return pattern;
+	if (pattern.startsWith("0x") && pattern.length % 2 === 0) return Buffer.from(pattern.slice(2), "hex");
+	return Buffer.from(pattern, "utf8");
+}
+var LinuxMemoryProviderImpl = class {
+	platform = "linux";
+	constructor(pid = process.pid) {
+		this.pid = pid;
+	}
+	isAvailable() {
+		return isLinuxRuntime();
+	}
+	async read(address, size) {
+		const handle = this.openProcess(this.pid, false);
+		return this.readMemory(handle, address, size).data;
+	}
+	async write(address, data) {
+		const handle = this.openProcess(this.pid, true);
+		return this.writeMemory(handle, address, data).bytesWritten === data.length;
+	}
+	async scan(pattern) {
+		const patternBuffer = normalizePattern(pattern);
+		const handle = this.openProcess(this.pid, false);
+		const regions = await this.queryRegions();
+		const matches = [];
+		for (const region of regions) {
+			if (!region.perms.includes("r")) continue;
+			const size = Number(region.end - region.start);
+			if (size <= 0) continue;
+			try {
+				const buffer = this.readMemory(handle, region.start, size).data;
+				let offset = buffer.indexOf(patternBuffer);
+				while (offset >= 0) {
+					matches.push(region.start + BigInt(offset));
+					offset = buffer.indexOf(patternBuffer, offset + 1);
+				}
+			} catch {
+				continue;
+			}
+		}
+		return matches;
+	}
+	async queryRegions() {
+		const mapsPath = `/proc/${this.pid}/maps`;
+		return parseProcMaps(await fs.promises.readFile(mapsPath, "utf8")).map((region) => ({
+			start: region.start,
+			end: region.end,
+			perms: `${region.permissions.read ? "r" : "-"}${region.permissions.write ? "w" : "-"}${region.permissions.exec ? "x" : "-"}${region.permissions.private ? "p" : "s"}`,
+			path: region.pathname || void 0
+		}));
+	}
+	async checkAvailability() {
+		if (!this.isAvailable()) return {
+			available: false,
+			platform: "linux",
+			reason: "Not running on Linux"
+		};
+		return {
+			available: true,
+			platform: "linux"
+		};
+	}
+	openProcess(pid, writeAccess) {
+		return {
+			pid,
+			writeAccess
+		};
+	}
+	closeProcess(_handle) {}
+	readMemory(handle, address, size) {
+		const memPath = `/proc/${handle.pid}/mem`;
+		const fileDescriptor = fs.openSync(memPath, handle.writeAccess ? "r+" : "r");
+		const buffer = Buffer.alloc(size);
+		try {
+			const bytesRead = fs.readSync(fileDescriptor, buffer, 0, size, Number(address));
+			return {
+				data: buffer.subarray(0, bytesRead),
+				bytesRead
+			};
+		} finally {
+			fs.closeSync(fileDescriptor);
+		}
+	}
+	writeMemory(handle, address, data) {
+		const memPath = `/proc/${handle.pid}/mem`;
+		const fileDescriptor = fs.openSync(memPath, "r+");
+		try {
+			return { bytesWritten: fs.writeSync(fileDescriptor, data, 0, data.length, Number(address)) };
+		} finally {
+			fs.closeSync(fileDescriptor);
+		}
+	}
+	queryRegion(handle, address) {
+		const mapsPath = `/proc/${handle.pid}/maps`;
+		const parsed = parseProcMaps(fs.readFileSync(mapsPath, "utf8"));
+		for (const region of parsed) if (address >= region.start && address < region.end) return toRegionInfo({
+			start: region.start,
+			end: region.end,
+			perms: `${region.permissions.read ? "r" : "-"}${region.permissions.write ? "w" : "-"}${region.permissions.exec ? "x" : "-"}${region.permissions.private ? "p" : "s"}`,
+			path: region.pathname || void 0
+		});
+		return null;
+	}
+	changeProtection(_handle, _address, _size, _newProtection) {
+		throw new Error("Linux memory protection changes are not supported by LinuxMemoryProviderImpl");
+	}
+	allocateMemory(_handle, _size, _protection) {
+		throw new Error("Linux remote memory allocation is not supported by LinuxMemoryProviderImpl");
+	}
+	freeMemory(_handle, _address, _size) {
+		throw new Error("Linux remote memory free is not supported by LinuxMemoryProviderImpl");
+	}
+	enumerateModules(handle) {
+		const mapsPath = `/proc/${handle.pid}/maps`;
+		const parsed = parseProcMaps(fs.readFileSync(mapsPath, "utf8"));
+		const modules = /* @__PURE__ */ new Map();
+		for (const region of parsed) {
+			if (!region.pathname || region.pathname.startsWith("[")) continue;
+			const existing = modules.get(region.pathname);
+			if (existing) {
+				const newSize = Number(region.end - existing.baseAddress);
+				modules.set(region.pathname, {
+					...existing,
+					size: newSize > existing.size ? newSize : existing.size
+				});
+				continue;
+			}
+			modules.set(region.pathname, {
+				name: region.pathname.split("/").pop() ?? region.pathname,
+				baseAddress: region.start,
+				size: Number(region.end - region.start)
+			});
+		}
+		return [...modules.values()];
+	}
+};
+var LinuxMemoryProvider = class extends LinuxMemoryProviderImpl {};
+//#endregion
+//#region src/native/platform/factory.ts
+/**
+* Platform factory — auto-selects the correct PlatformMemoryAPI implementation
+* based on the current operating system.
+*
+* Uses createRequire for lazy-loading platform providers in ESM context.
+* This prevents loading Win32 DLLs on macOS and vice versa.
+*
+* Usage:
+*   const provider = createPlatformProvider();
+*   const handle = provider.openProcess(pid, false);
+*
+* @module platform/factory
+*/
+var factory_exports = /* @__PURE__ */ __exportAll({ createPlatformProvider: () => createPlatformProvider });
+let cachedProvider = null;
+/**
+* Create and cache the platform-appropriate memory provider.
+* Returns Win32MemoryProvider on Windows, DarwinMemoryProvider on macOS,
+* and LinuxMemoryProvider on Linux.
+* Throws on unsupported platforms.
+*/
+function createPlatformProvider() {
+	if (cachedProvider) return cachedProvider;
+	switch (process.platform) {
+		case "win32":
+			cachedProvider = new Win32MemoryProvider();
+			break;
+		case "darwin":
+			cachedProvider = new DarwinMemoryProvider();
+			break;
+		case "linux":
+			cachedProvider = new LinuxMemoryProvider();
+			break;
+		default: throw new Error(`Unsupported platform: ${process.platform}. Memory operations require Windows, macOS, or Linux.`);
+	}
+	if (!cachedProvider) throw new Error("Failed to create memory provider");
+	return cachedProvider;
+}
+//#endregion
+export { MemoryProtection as a, parseProcMaps as i, factory_exports as n, formatLinuxProtection as r, createPlatformProvider as t };

package/dist/formatAddress-ChCSIRWT.mjs

@@ -0,0 +1,17 @@
+//#region src/native/formatAddress.ts
+/**
+* Address formatting utilities — single source of truth for
+* bigint ↔ hex-string address conversion.
+*
+* @module formatAddress
+*/
+/** Format a bigint address to its canonical hex representation: `0xABCD1234`. */
+function formatAddress(addr) {
+	return `0x${addr.toString(16).toUpperCase()}`;
+}
+/** Parse a hex address string (with or without `0x` prefix) to bigint. */
+function parseAddress(addr) {
+	return BigInt(addr.startsWith("0x") || addr.startsWith("0X") ? addr : `0x${addr}`);
+}
+//#endregion
+export { parseAddress as n, formatAddress as t };

package/dist/index.d.mts

@@ -0,0 +1,4 @@
+//#region src/index.d.ts
+declare function main(): Promise<void>;
+//#endregion
+export { main };