@jshookmcp/jshook 0.2.6 → 0.2.8

package/dist/src/modules/trace/TraceRecorder.js

@@ -1,256 +0,0 @@
-import { randomUUID } from 'node:crypto';
-import { TraceDB } from '../trace/TraceDB.js';
-import { resolveArtifactPath } from '../../utils/artifacts.js';
-const CDP_EVENTS_BY_DOMAIN = {
-    Debugger: ['Debugger.paused', 'Debugger.resumed', 'Debugger.scriptParsed'],
-    Runtime: ['Runtime.consoleAPICalled', 'Runtime.exceptionThrown'],
-    Network: ['Network.requestWillBeSent', 'Network.responseReceived', 'Network.loadingFinished'],
-    Page: ['Page.navigatedWithinDocument', 'Page.loadEventFired'],
-};
-const DEFAULT_CDP_DOMAINS = ['Debugger', 'Runtime', 'Network', 'Page'];
-export class TraceRecorder {
-    db = null;
-    state = 'idle';
-    session = null;
-    eventBusUnsub = null;
-    cdpListeners = new Map();
-    cdpSession = null;
-    eventCount = 0;
-    memoryDeltaCount = 0;
-    heapSnapshotCount = 0;
-    async start(eventBus, cdpSession, options) {
-        if (this.state === 'recording') {
-            throw new Error('Recording already in progress');
-        }
-        const sessionId = randomUUID();
-        const { absolutePath } = await resolveArtifactPath({
-            category: 'traces',
-            toolName: 'trace_recorder',
-            target: sessionId.slice(0, 8),
-            ext: 'db',
-        });
-        this.db = new TraceDB({ dbPath: absolutePath });
-        this.eventCount = 0;
-        this.memoryDeltaCount = 0;
-        this.heapSnapshotCount = 0;
-        const startedAt = Date.now();
-        this.db.setMetadata('sessionId', sessionId);
-        this.db.setMetadata('platform', process.platform);
-        this.db.setMetadata('startedAt', String(startedAt));
-        this.db.setMetadata('nodeVersion', process.version);
-        this.eventBusUnsub = eventBus.onAny((wrapped) => {
-            if (this.state !== 'recording' || !this.db)
-                return;
-            try {
-                this.db.insertEvent({
-                    timestamp: Date.now(),
-                    category: this.mapEventCategory(String(wrapped.event)),
-                    eventType: String(wrapped.event),
-                    data: JSON.stringify(wrapped.payload ?? {}),
-                    scriptId: null,
-                    lineNumber: null,
-                });
-                this.eventCount++;
-            }
-            catch {
-            }
-        });
-        this.cdpSession = cdpSession;
-        if (cdpSession) {
-            const domains = options?.cdpDomains ?? DEFAULT_CDP_DOMAINS;
-            for (const domain of domains) {
-                const events = CDP_EVENTS_BY_DOMAIN[domain];
-                if (!events)
-                    continue;
-                for (const eventName of events) {
-                    const handler = (params) => {
-                        if (this.state !== 'recording' || !this.db)
-                            return;
-                        try {
-                            let scriptId = null;
-                            let lineNumber = null;
-                            if (typeof params === 'object' && params !== null) {
-                                const p = params;
-                                if ('scriptId' in p)
-                                    scriptId = String(p['scriptId']);
-                                if ('lineNumber' in p)
-                                    lineNumber = Number(p['lineNumber']) || null;
-                                if (eventName === 'Debugger.paused' && Array.isArray(p['callFrames'])) {
-                                    const frame = p['callFrames'][0];
-                                    if (frame) {
-                                        const loc = frame['location'];
-                                        if (loc) {
-                                            scriptId = String(loc['scriptId'] ?? scriptId);
-                                            lineNumber = Number(loc['lineNumber'] ?? lineNumber) || null;
-                                        }
-                                    }
-                                }
-                            }
-                            this.db.insertEvent({
-                                timestamp: Date.now(),
-                                category: domain.toLowerCase(),
-                                eventType: eventName,
-                                data: JSON.stringify(params ?? {}),
-                                scriptId,
-                                lineNumber,
-                            });
-                            this.eventCount++;
-                        }
-                        catch {
-                        }
-                    };
-                    cdpSession.on(eventName, handler);
-                    this.cdpListeners.set(eventName, handler);
-                }
-            }
-        }
-        this.session = {
-            sessionId,
-            dbPath: absolutePath,
-            startedAt,
-            eventCount: 0,
-            memoryDeltaCount: 0,
-            heapSnapshotCount: 0,
-        };
-        this.state = 'recording';
-        return { ...this.session };
-    }
-    recordMemoryDelta(delta) {
-        if (this.state !== 'recording' || !this.db)
-            return;
-        try {
-            this.db.insertMemoryDelta(delta);
-            this.memoryDeltaCount++;
-        }
-        catch {
-        }
-    }
-    async captureHeapSnapshot(cdpSession) {
-        if (this.state !== 'recording' || !this.db) {
-            throw new Error('Cannot capture heap snapshot: not recording');
-        }
-        const chunks = [];
-        const chunkHandler = (params) => {
-            if (typeof params === 'object' && params !== null) {
-                const chunk = params['chunk'];
-                if (typeof chunk === 'string')
-                    chunks.push(chunk);
-            }
-        };
-        try {
-            await cdpSession.send('HeapProfiler.enable');
-            cdpSession.on('HeapProfiler.addHeapSnapshotChunk', chunkHandler);
-            await cdpSession.send('HeapProfiler.takeHeapSnapshot', {
-                reportProgress: false,
-            });
-            cdpSession.off('HeapProfiler.addHeapSnapshotChunk', chunkHandler);
-            const snapshotStr = chunks.join('');
-            const snapshotBuffer = Buffer.from(snapshotStr, 'utf-8');
-            const summary = this.extractHeapSummary(snapshotStr);
-            this.db.insertHeapSnapshot({
-                timestamp: Date.now(),
-                snapshotData: snapshotBuffer,
-                summary: JSON.stringify(summary),
-            });
-            this.heapSnapshotCount++;
-        }
-        finally {
-            await cdpSession.send('HeapProfiler.disable').catch(() => { });
-        }
-    }
-    stop() {
-        if (this.state !== 'recording') {
-            throw new Error('Cannot stop: not currently recording');
-        }
-        if (this.eventBusUnsub) {
-            this.eventBusUnsub();
-            this.eventBusUnsub = null;
-        }
-        if (this.cdpSession) {
-            for (const [event, handler] of this.cdpListeners) {
-                this.cdpSession.off(event, handler);
-            }
-            this.cdpListeners.clear();
-            this.cdpSession = null;
-        }
-        if (this.db) {
-            const stoppedAt = Date.now();
-            this.db.setMetadata('stoppedAt', String(stoppedAt));
-            this.db.setMetadata('eventCount', String(this.eventCount));
-            this.db.setMetadata('memoryDeltaCount', String(this.memoryDeltaCount));
-            this.db.setMetadata('heapSnapshotCount', String(this.heapSnapshotCount));
-            this.db.close();
-            if (this.session) {
-                this.session.stoppedAt = stoppedAt;
-                this.session.eventCount = this.eventCount;
-                this.session.memoryDeltaCount = this.memoryDeltaCount;
-                this.session.heapSnapshotCount = this.heapSnapshotCount;
-            }
-        }
-        this.state = 'stopped';
-        const finalSession = this.session ? { ...this.session } : this.createEmptySession();
-        this.db = null;
-        return finalSession;
-    }
-    getState() {
-        return this.state;
-    }
-    getSession() {
-        return this.session ? { ...this.session } : null;
-    }
-    getDB() {
-        return this.db;
-    }
-    mapEventCategory(event) {
-        const colonIdx = event.indexOf(':');
-        return colonIdx > 0 ? event.substring(0, colonIdx) : 'other';
-    }
-    extractHeapSummary(snapshotStr) {
-        try {
-            const snapshot = JSON.parse(snapshotStr);
-            const snapshotInfo = snapshot['snapshot'];
-            if (!snapshotInfo) {
-                return { totalSize: 0, nodeCount: 0, objectCounts: {} };
-            }
-            const meta = snapshotInfo['meta'];
-            const nodeCount = snapshotInfo['node_count'] ?? 0;
-            const nodeFields = meta?.['node_fields'];
-            const nodeTypes = meta?.['node_types'];
-            const nodes = snapshot['nodes'];
-            const objectCounts = {};
-            let totalSize = 0;
-            if (nodeFields && nodes && nodeTypes) {
-                const fieldCount = nodeFields.length;
-                const typeIndex = nodeFields.indexOf('type');
-                const nameIndex = nodeFields.indexOf('name');
-                const selfSizeIndex = nodeFields.indexOf('self_size');
-                const strings = snapshot['strings'] ?? [];
-                for (let i = 0; i < nodes.length; i += fieldCount) {
-                    const selfSize = selfSizeIndex >= 0 ? (nodes[i + selfSizeIndex] ?? 0) : 0;
-                    totalSize += selfSize;
-                    if (nameIndex >= 0) {
-                        const nameIdx = nodes[i + nameIndex] ?? 0;
-                        const name = strings[nameIdx] ?? `type_${nodes[i + (typeIndex >= 0 ? typeIndex : 0)]}`;
-                        if (name) {
-                            objectCounts[name] = (objectCounts[name] ?? 0) + 1;
-                        }
-                    }
-                }
-            }
-            return { totalSize, nodeCount, objectCounts };
-        }
-        catch {
-            return { totalSize: 0, nodeCount: 0, objectCounts: {} };
-        }
-    }
-    createEmptySession() {
-        return {
-            sessionId: '',
-            dbPath: '',
-            startedAt: 0,
-            eventCount: 0,
-            memoryDeltaCount: 0,
-            heapSnapshotCount: 0,
-        };
-    }
-}

package/dist/src/modules/trace/TraceRecorder.types.d.ts

@@ -1,15 +0,0 @@
-export interface TraceRecorderOptions {
-    cdpDomains?: string[];
-    eventCategories?: string[];
-    recordMemoryDeltas?: boolean;
-}
-export type RecordingState = 'idle' | 'recording' | 'stopped';
-export interface RecordingSession {
-    sessionId: string;
-    dbPath: string;
-    startedAt: number;
-    stoppedAt?: number;
-    eventCount: number;
-    memoryDeltaCount: number;
-    heapSnapshotCount: number;
-}

package/dist/src/modules/trace/TraceRecorder.types.js

@@ -1 +0,0 @@
-export {};

package/dist/src/native/AntiCheatDetector.d.ts

@@ -1,10 +0,0 @@
-import type { AntiCheatDetection, GuardPageInfo, IntegrityCheckInfo } from './AntiCheatDetector.types.js';
-export declare class AntiCheatDetector {
-    private peAnalyzer;
-    detect(pid: number): Promise<AntiCheatDetection[]>;
-    findGuardPages(pid: number): Promise<GuardPageInfo[]>;
-    checkIntegrity(pid: number, moduleName?: string): Promise<IntegrityCheckInfo[]>;
-    private _enumerateModules;
-    private _rvaToFileOffset;
-}
-export declare const antiCheatDetector: AntiCheatDetector;

package/dist/src/native/AntiCheatDetector.js

@@ -1,262 +0,0 @@
-import { createHash } from 'node:crypto';
-import { promises as fs } from 'node:fs';
-import { logger } from '../utils/logger.js';
-import { openProcessForMemory, CloseHandle, ReadProcessMemory, VirtualQueryEx, PAGE, EnumProcessModules, GetModuleBaseName, GetModuleFileNameEx, GetModuleInformation, } from './Win32API.js';
-import { PEAnalyzer } from './PEAnalyzer.js';
-const ANTI_DEBUG_IMPORTS = [
-    {
-        dll: 'kernel32.dll',
-        funcs: [
-            {
-                name: 'IsDebuggerPresent',
-                mechanism: 'anti_debug_api',
-                confidence: 'high',
-                bypass: 'Hook IsDebuggerPresent to return 0, or patch PEB.BeingDebugged field',
-            },
-            {
-                name: 'CheckRemoteDebuggerPresent',
-                mechanism: 'anti_debug_api',
-                confidence: 'high',
-                bypass: 'Hook CheckRemoteDebuggerPresent to set output to FALSE and return TRUE',
-            },
-            {
-                name: 'OutputDebugStringA',
-                mechanism: 'exception_based',
-                confidence: 'low',
-                bypass: 'May be used for anti-debug timing — monitor for exception handler abuse',
-            },
-            {
-                name: 'GetTickCount',
-                mechanism: 'timing_check',
-                confidence: 'low',
-                bypass: 'Hook GetTickCount to return consistent delta values',
-            },
-            {
-                name: 'GetTickCount64',
-                mechanism: 'timing_check',
-                confidence: 'low',
-                bypass: 'Hook GetTickCount64 to return consistent delta values',
-            },
-            {
-                name: 'QueryPerformanceCounter',
-                mechanism: 'timing_check',
-                confidence: 'medium',
-                bypass: 'Hook QPC to filter out debugging time deltas',
-            },
-        ],
-    },
-    {
-        dll: 'ntdll.dll',
-        funcs: [
-            {
-                name: 'NtQueryInformationProcess',
-                mechanism: 'ntquery_debug',
-                confidence: 'high',
-                bypass: 'Hook NtQueryInformationProcess: return 0 for ProcessDebugPort (7), ProcessDebugObjectHandle (30), ProcessDebugFlags (31)',
-            },
-            {
-                name: 'NtSetInformationThread',
-                mechanism: 'thread_hiding',
-                confidence: 'medium',
-                bypass: 'Hook NtSetInformationThread: intercept ThreadHideFromDebugger (0x11) calls',
-            },
-            {
-                name: 'NtClose',
-                mechanism: 'exception_based',
-                confidence: 'low',
-                bypass: 'NtClose with invalid handle detects debugger via exception — hook to suppress',
-            },
-            {
-                name: 'RtlGetNtGlobalFlags',
-                mechanism: 'heap_flags',
-                confidence: 'medium',
-                bypass: 'Clear NtGlobalFlag (FLG_HEAP_*) in PEB at offset 0xBC (x64)',
-            },
-        ],
-    },
-];
-const DR_CHECK_IMPORTS = ['GetThreadContext', 'SetThreadContext'];
-export class AntiCheatDetector {
-    peAnalyzer = new PEAnalyzer();
-    async detect(pid) {
-        const detections = [];
-        const hProcess = openProcessForMemory(pid);
-        try {
-            const modules = this._enumerateModules(hProcess);
-            for (const mod of modules) {
-                try {
-                    const imports = await this.peAnalyzer.parseImports(pid, mod.base);
-                    for (const imp of imports) {
-                        const dllLower = imp.dllName.toLowerCase();
-                        for (const knownDll of ANTI_DEBUG_IMPORTS) {
-                            if (dllLower.includes(knownDll.dll.toLowerCase().replace('.dll', ''))) {
-                                for (const func of knownDll.funcs) {
-                                    if (imp.functions.some((f) => f.name === func.name)) {
-                                        detections.push({
-                                            mechanism: func.mechanism,
-                                            confidence: func.confidence,
-                                            location: `import:${func.name}`,
-                                            moduleName: mod.name,
-                                            details: `${mod.name} imports ${func.name} from ${imp.dllName}`,
-                                            bypassSuggestion: func.bypass,
-                                        });
-                                    }
-                                }
-                            }
-                        }
-                        for (const func of imp.functions) {
-                            if (DR_CHECK_IMPORTS.includes(func.name)) {
-                                detections.push({
-                                    mechanism: 'hardware_breakpoint',
-                                    confidence: 'medium',
-                                    location: `import:${func.name}`,
-                                    moduleName: mod.name,
-                                    details: `${mod.name} imports ${func.name} — may check debug registers for hardware breakpoints`,
-                                    bypassSuggestion: 'Hook GetThreadContext to zero out DR0-DR3 and DR6/DR7 before returning',
-                                });
-                            }
-                        }
-                    }
-                }
-                catch (e) {
-                    logger.debug(`Import scan skipped for ${mod.name}: ${e}`);
-                }
-            }
-        }
-        finally {
-            CloseHandle(hProcess);
-        }
-        return detections;
-    }
-    async findGuardPages(pid) {
-        const guardPages = [];
-        const hProcess = openProcessForMemory(pid);
-        try {
-            const modules = this._enumerateModules(hProcess);
-            let address = 0n;
-            const maxAddress = 0x7fffffffffffn;
-            while (address < maxAddress) {
-                try {
-                    const result = VirtualQueryEx(hProcess, address);
-                    if (!result.success)
-                        break;
-                    const mbi = result.info;
-                    if ((mbi.Protect & PAGE.GUARD) !== 0) {
-                        let moduleName = null;
-                        for (const mod of modules) {
-                            const modBase = BigInt(mod.base);
-                            if (mbi.BaseAddress >= modBase && mbi.BaseAddress < modBase + BigInt(mod.size)) {
-                                moduleName = mod.name;
-                                break;
-                            }
-                        }
-                        guardPages.push({
-                            address: `0x${mbi.BaseAddress.toString(16)}`,
-                            size: Number(mbi.RegionSize),
-                            moduleName,
-                            nearbySymbol: null,
-                        });
-                    }
-                    address = mbi.BaseAddress + mbi.RegionSize;
-                    if (address <= mbi.BaseAddress)
-                        break;
-                }
-                catch {
-                    address += 0x1000n;
-                }
-            }
-        }
-        finally {
-            CloseHandle(hProcess);
-        }
-        return guardPages;
-    }
-    async checkIntegrity(pid, moduleName) {
-        const results = [];
-        const hProcess = openProcessForMemory(pid);
-        try {
-            const modules = this._enumerateModules(hProcess);
-            const targets = moduleName
-                ? modules.filter((m) => m.name.toLowerCase().includes(moduleName.toLowerCase()))
-                : modules;
-            for (const mod of targets) {
-                try {
-                    const diskData = await fs.readFile(mod.path);
-                    const sections = await this.peAnalyzer.listSections(pid, mod.base);
-                    for (const sec of sections) {
-                        if (!sec.isExecutable)
-                            continue;
-                        const secRva = parseInt(sec.virtualAddress, 16);
-                        const secSize = Math.min(sec.virtualSize, sec.rawSize);
-                        if (secSize <= 0)
-                            continue;
-                        const memBytes = ReadProcessMemory(hProcess, BigInt(mod.base) + BigInt(secRva), secSize);
-                        const diskOffset = this._rvaToFileOffset(diskData, secRva);
-                        if (diskOffset < 0 || diskOffset + secSize > diskData.length)
-                            continue;
-                        const diskBytes = diskData.subarray(diskOffset, diskOffset + secSize);
-                        const memoryHash = createHash('sha256').update(memBytes).digest('hex');
-                        const diskHash = createHash('sha256').update(diskBytes).digest('hex');
-                        results.push({
-                            sectionName: sec.name,
-                            moduleName: mod.name,
-                            diskHash,
-                            memoryHash,
-                            isModified: memoryHash !== diskHash,
-                        });
-                    }
-                }
-                catch (e) {
-                    logger.debug(`Integrity check skipped for ${mod.name}: ${e}`);
-                }
-            }
-        }
-        finally {
-            CloseHandle(hProcess);
-        }
-        return results;
-    }
-    _enumerateModules(hProcess) {
-        const modules = [];
-        try {
-            const { modules: modHandles, count } = EnumProcessModules(hProcess);
-            for (let i = 0; i < count; i++) {
-                const hMod = modHandles[i];
-                const name = GetModuleBaseName(hProcess, hMod);
-                const info = GetModuleInformation(hProcess, hMod);
-                const modulePath = GetModuleFileNameEx(hProcess, hMod) ?? name;
-                if (info.success) {
-                    modules.push({
-                        name,
-                        base: `0x${info.info.lpBaseOfDll.toString(16)}`,
-                        path: modulePath,
-                        size: info.info.SizeOfImage,
-                    });
-                }
-            }
-        }
-        catch (e) {
-            logger.debug(`Module enumeration failed: ${e}`);
-        }
-        return modules;
-    }
-    _rvaToFileOffset(peData, rva) {
-        const e_lfanew = peData.readUInt32LE(60);
-        const numSections = peData.readUInt16LE(e_lfanew + 6);
-        const sizeOfOptionalHeader = peData.readUInt16LE(e_lfanew + 20);
-        const secStart = e_lfanew + 24 + sizeOfOptionalHeader;
-        for (let i = 0; i < numSections; i++) {
-            const off = secStart + i * 40;
-            if (off + 40 > peData.length)
-                break;
-            const virtualAddr = peData.readUInt32LE(off + 12);
-            const virtualSize = peData.readUInt32LE(off + 8);
-            const rawOffset = peData.readUInt32LE(off + 20);
-            if (rva >= virtualAddr && rva < virtualAddr + virtualSize) {
-                return rawOffset + (rva - virtualAddr);
-            }
-        }
-        return -1;
-    }
-}
-export const antiCheatDetector = new AntiCheatDetector();

package/dist/src/native/AntiCheatDetector.types.d.ts

@@ -1,22 +0,0 @@
-export type AntiCheatMechanism = 'anti_debug_api' | 'ntquery_debug' | 'timing_check' | 'guard_page' | 'code_integrity_check' | 'import_integrity' | 'exception_based' | 'thread_hiding' | 'heap_flags' | 'hardware_breakpoint';
-export interface AntiCheatDetection {
-    mechanism: AntiCheatMechanism;
-    confidence: 'low' | 'medium' | 'high';
-    location: string;
-    moduleName: string;
-    details: string;
-    bypassSuggestion: string;
-}
-export interface GuardPageInfo {
-    address: string;
-    size: number;
-    moduleName: string | null;
-    nearbySymbol: string | null;
-}
-export interface IntegrityCheckInfo {
-    sectionName: string;
-    moduleName: string;
-    diskHash: string;
-    memoryHash: string;
-    isModified: boolean;
-}

package/dist/src/native/AntiCheatDetector.types.js

@@ -1 +0,0 @@
-export {};

package/dist/src/native/CodeInjector.d.ts

@@ -1,12 +0,0 @@
-import type { PatchOperation, CodeCave } from './CodeInjector.types.js';
-export declare class CodeInjector {
-    private patches;
-    patchBytes(pid: number, address: string, bytes: number[]): Promise<PatchOperation>;
-    unpatch(patchId: string): Promise<boolean>;
-    nopBytes(pid: number, address: string, count: number): Promise<PatchOperation>;
-    findCodeCaves(pid: number, minSize?: number): Promise<CodeCave[]>;
-    allocateRemote(pid: number, size: number): Promise<string>;
-    freeRemote(pid: number, address: string, _size: number): Promise<boolean>;
-    listPatches(): PatchOperation[];
-}
-export declare const codeInjector: CodeInjector;