@jshookmcp/jshook 0.2.7 → 0.2.9

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (157) hide show
  1. package/README.md +36 -5
  2. package/README.zh.md +36 -5
  3. package/dist/{AntiCheatDetector-S8VRj-dD.mjs → AntiCheatDetector-BNk-EoBt.mjs} +3 -3
  4. package/dist/{CodeInjector-4Z3ngPoX.mjs → CodeInjector-Cq8q01kp.mjs} +5 -5
  5. package/dist/ConsoleMonitor-CPVQW1Y-.mjs +2201 -0
  6. package/dist/{DarwinAPI-B8hg_yhz.mjs → DarwinAPI-BNPxu0RH.mjs} +1 -1
  7. package/dist/DetailedDataManager-BQQcxh64.mjs +217 -0
  8. package/dist/EventBus-DgPmwpeu.mjs +141 -0
  9. package/dist/EvidenceGraphBridge-SFesNera.mjs +153 -0
  10. package/dist/{ExtensionManager-CZ6IveoV.mjs → ExtensionManager-CWYgw0YW.mjs} +13 -6
  11. package/dist/{FingerprintManager-BVxFJL2-.mjs → FingerprintManager-gzWtkKuf.mjs} +1 -1
  12. package/dist/{HardwareBreakpoint-DK1yjWkV.mjs → HardwareBreakpoint-B9gZCdFP.mjs} +3 -3
  13. package/dist/{HeapAnalyzer-CEbo10xU.mjs → HeapAnalyzer-BLDH0dCv.mjs} +4 -4
  14. package/dist/HookGeneratorBuilders.core.generators.storage-CtcdK78Q.mjs +639 -0
  15. package/dist/InstrumentationSession-CvPC7Jwy.mjs +244 -0
  16. package/dist/{MemoryController-DdtnBdD4.mjs → MemoryController-CbVdCIJF.mjs} +3 -3
  17. package/dist/{MemoryScanSession-RMixN3bX.mjs → MemoryScanSession-BsDZbLYm.mjs} +81 -78
  18. package/dist/{MemoryScanner-QjK4ld0B.mjs → MemoryScanner-Bcpml6II.mjs} +44 -18
  19. package/dist/{NativeMemoryManager.impl-CB6gJ0NM.mjs → NativeMemoryManager.impl-dZtA1ZGn.mjs} +14 -53
  20. package/dist/{NativeMemoryManager.utils-BML4q1ry.mjs → NativeMemoryManager.utils-B-FjA2mJ.mjs} +1 -1
  21. package/dist/{PEAnalyzer-CK0xe0Fs.mjs → PEAnalyzer-D1lzJ_VG.mjs} +2 -2
  22. package/dist/PageController-Bqm2kZ_X.mjs +417 -0
  23. package/dist/{PointerChainEngine-Cd73qu5b.mjs → PointerChainEngine-BOhyVsjx.mjs} +4 -4
  24. package/dist/PrerequisiteError-Dl33Svkz.mjs +20 -0
  25. package/dist/ResponseBuilder-D3iFYx2N.mjs +143 -0
  26. package/dist/ReverseEvidenceGraph-Dlsk94LC.mjs +269 -0
  27. package/dist/ScriptManager-aHHq0X7U.mjs +3000 -0
  28. package/dist/{Speedhack-CeF0XmEz.mjs → Speedhack-CqdIFlQl.mjs} +2 -2
  29. package/dist/{StructureAnalyzer-D4GkMduU.mjs → StructureAnalyzer-DhFaPvRO.mjs} +3 -3
  30. package/dist/ToolCatalog-C0JGZoOm.mjs +582 -0
  31. package/dist/ToolError-jh9whhMd.mjs +15 -0
  32. package/dist/ToolProbe-oC7aPrkv.mjs +45 -0
  33. package/dist/ToolRegistry-BjaF4oNz.mjs +131 -0
  34. package/dist/ToolRouter.policy-BWV67ZK-.mjs +304 -0
  35. package/dist/TraceRecorder-DgxyVbdQ.mjs +519 -0
  36. package/dist/{Win32API-Bc0QnQsN.mjs → Win32API-CePkipZY.mjs} +1 -1
  37. package/dist/{Win32Debug-DUHt9XUn.mjs → Win32Debug-BvKs-gxc.mjs} +2 -2
  38. package/dist/WorkflowEngine-CuvkZtWu.mjs +598 -0
  39. package/dist/analysis-CL9uACt9.mjs +463 -0
  40. package/dist/antidebug-CqDTB_uk.mjs +1081 -0
  41. package/dist/artifactRetention-CFEprwPw.mjs +591 -0
  42. package/dist/artifacts-Bk2-_uPq.mjs +59 -0
  43. package/dist/betterSqlite3-0pqusHHH.mjs +74 -0
  44. package/dist/binary-instrument-CXfpx6fT.mjs +979 -0
  45. package/dist/bind-helpers-xFfRF-qm.mjs +22 -0
  46. package/dist/boringssl-inspector-BH2D3VKc.mjs +180 -0
  47. package/dist/browser-BpOr5PEx.mjs +4082 -0
  48. package/dist/concurrency-Bt0yv1kJ.mjs +41 -0
  49. package/dist/{constants-CCvsN80K.mjs → constants-B0OANIBL.mjs} +88 -46
  50. package/dist/coordination-qUbyF8KU.mjs +259 -0
  51. package/dist/debugger-gnKxRSN0.mjs +1271 -0
  52. package/dist/definitions-6M-eejaT.mjs +53 -0
  53. package/dist/definitions-B18eyf0B.mjs +18 -0
  54. package/dist/definitions-B3QdlrHv.mjs +34 -0
  55. package/dist/definitions-B4rAvHNZ.mjs +63 -0
  56. package/dist/definitions-BB_4jnmy.mjs +37 -0
  57. package/dist/definitions-BMfYXoNC.mjs +43 -0
  58. package/dist/definitions-Beid2EB3.mjs +27 -0
  59. package/dist/definitions-C1UvM5Iy.mjs +126 -0
  60. package/dist/definitions-CXEI7QC72.mjs +216 -0
  61. package/dist/definitions-C_4r7Fo-2.mjs +14 -0
  62. package/dist/definitions-CkFDALoa.mjs +26 -0
  63. package/dist/definitions-Cke7zEb8.mjs +94 -0
  64. package/dist/definitions-ClJLzsJQ.mjs +25 -0
  65. package/dist/definitions-Cq-zroAU.mjs +28 -0
  66. package/dist/definitions-Cy3Sl6gV.mjs +34 -0
  67. package/dist/definitions-D3VsGcvz.mjs +47 -0
  68. package/dist/definitions-DVGfrn7y.mjs +96 -0
  69. package/dist/definitions-LKpC3-nL.mjs +9 -0
  70. package/dist/definitions-bAhHQJq9.mjs +359 -0
  71. package/dist/encoding-Bvz5jLRv.mjs +1065 -0
  72. package/dist/evidence-graph-bridge-C_fv9PuC.mjs +135 -0
  73. package/dist/{factory-CibqTNC8.mjs → factory-DxlGh9Xf.mjs} +37 -52
  74. package/dist/graphql-DYWzJ29s.mjs +1026 -0
  75. package/dist/handlers-9sAbfIg-.mjs +2552 -0
  76. package/dist/handlers-Bl8zkwz1.mjs +2716 -0
  77. package/dist/handlers-C67ktuRN.mjs +710 -0
  78. package/dist/handlers-C87g8oCe.mjs +276 -0
  79. package/dist/handlers-CTsDAO6p.mjs +681 -0
  80. package/dist/handlers-Cgyg6c0U.mjs +645 -0
  81. package/dist/handlers-D6j6yka7.mjs +2124 -0
  82. package/dist/handlers-DdFzXLvF.mjs +446 -0
  83. package/dist/handlers-DeLOCd5m.mjs +799 -0
  84. package/dist/handlers-DlCJN4Td.mjs +757 -0
  85. package/dist/handlers-DxGIq15_2.mjs +917 -0
  86. package/dist/handlers-U6L4xhuF.mjs +585 -0
  87. package/dist/handlers-tB9Mp9ZK.mjs +84 -0
  88. package/dist/handlers-tiy7EIBp.mjs +572 -0
  89. package/dist/handlers.impl-DS0d9fUw.mjs +761 -0
  90. package/dist/hooks-CzCWByww.mjs +898 -0
  91. package/dist/index.mjs +384 -155
  92. package/dist/{logger-BmWzC2lM.mjs → logger-Dh_xb7_2.mjs} +14 -6
  93. package/dist/maintenance-P7ePRXQC.mjs +830 -0
  94. package/dist/manifest-2ToTpjv8.mjs +106 -0
  95. package/dist/manifest-3g71z6Bg.mjs +79 -0
  96. package/dist/manifest-82baTv4U.mjs +45 -0
  97. package/dist/manifest-B3QVVeBS.mjs +82 -0
  98. package/dist/manifest-BB2J8IMJ.mjs +149 -0
  99. package/dist/manifest-BKbgbSiY.mjs +60 -0
  100. package/dist/manifest-Bcf-TJzH.mjs +848 -0
  101. package/dist/manifest-BmtZzQiQ2.mjs +45 -0
  102. package/dist/manifest-Bnd7kqEY.mjs +55 -0
  103. package/dist/manifest-BqQX6OQC2.mjs +65 -0
  104. package/dist/manifest-BqrQ4Tpj.mjs +81 -0
  105. package/dist/manifest-Br4RPFt5.mjs +370 -0
  106. package/dist/manifest-C5qDjysN.mjs +107 -0
  107. package/dist/manifest-C9RT5nk32.mjs +34 -0
  108. package/dist/manifest-CAhOuvSl.mjs +204 -0
  109. package/dist/manifest-CBYWCUBJ.mjs +51 -0
  110. package/dist/manifest-CFADCRa1.mjs +37 -0
  111. package/dist/manifest-CQVhavRF.mjs +114 -0
  112. package/dist/manifest-CT7zZBV1.mjs +48 -0
  113. package/dist/manifest-CV12bcrF.mjs +121 -0
  114. package/dist/manifest-CXsRWjjI.mjs +224 -0
  115. package/dist/manifest-CZLUCfG02.mjs +95 -0
  116. package/dist/manifest-D6phHKFd.mjs +131 -0
  117. package/dist/manifest-DCyjf4n2.mjs +294 -0
  118. package/dist/manifest-DHsnKgP6.mjs +60 -0
  119. package/dist/manifest-Df_dliIe.mjs +55 -0
  120. package/dist/manifest-Dh8WBmEW.mjs +129 -0
  121. package/dist/manifest-DhKRAT8_.mjs +92 -0
  122. package/dist/manifest-DlpTj4ic2.mjs +193 -0
  123. package/dist/manifest-DrbmZcFl2.mjs +253 -0
  124. package/dist/manifest-DuwHjUa5.mjs +70 -0
  125. package/dist/manifest-DzwvxPJX.mjs +38 -0
  126. package/dist/manifest-NXctwWQq.mjs +68 -0
  127. package/dist/manifest-Sc_0JQ13.mjs +418 -0
  128. package/dist/manifest-gZ4s_UtG.mjs +96 -0
  129. package/dist/manifest-qSleDqdO.mjs +1023 -0
  130. package/dist/modules-C184v-S9.mjs +11365 -0
  131. package/dist/mojo-ipc-B_H61Afw.mjs +525 -0
  132. package/dist/network-671Cw6hV.mjs +3346 -0
  133. package/dist/{artifacts-BbdOMET5.mjs → outputPaths-B1uGmrWZ.mjs} +219 -212
  134. package/dist/parse-args-BlRjqlkL.mjs +39 -0
  135. package/dist/platform-WmNn8Sxb.mjs +2070 -0
  136. package/dist/process-QcbIy5Zq.mjs +1401 -0
  137. package/dist/proxy-DqNs0bAd.mjs +170 -0
  138. package/dist/registry-D-6e18lB.mjs +34 -0
  139. package/dist/response-BQVP-xUn.mjs +28 -0
  140. package/dist/server/plugin-api.mjs +2 -2
  141. package/dist/shared-state-board-DV-dpHFJ.mjs +586 -0
  142. package/dist/sourcemap-Dq8ez8vS.mjs +650 -0
  143. package/dist/ssrf-policy-ZaUfvhq7.mjs +166 -0
  144. package/dist/streaming-BUQ0VJsg.mjs +725 -0
  145. package/dist/tool-builder-DCbIC5Eo.mjs +186 -0
  146. package/dist/transform-CiYJfNX0.mjs +1007 -0
  147. package/dist/types-Bx92KJfT.mjs +4 -0
  148. package/dist/wasm-DQTnHDs4.mjs +531 -0
  149. package/dist/workflow-f3xJOcjx.mjs +725 -0
  150. package/package.json +48 -78
  151. package/dist/ExtensionManager-DqUSOamB.mjs +0 -2
  152. package/dist/ToolCatalog-CnwmMIw3.mjs +0 -61483
  153. package/dist/{CacheAdapters-CzFNpD9a.mjs → CacheAdapters-CDe5WPSV.mjs} +0 -0
  154. package/dist/{StealthVerifier-BzBCFiwx.mjs → StealthVerifier-Bo4T3bz8.mjs} +0 -0
  155. package/dist/{VersionDetector-CNXcvD46.mjs → VersionDetector-CwVLVdDM.mjs} +0 -0
  156. package/dist/{formatAddress-ChCSIRWT.mjs → formatAddress-DVkj9kpI.mjs} +0 -0
  157. package/dist/{types-BBjOqye-.mjs → types-CPhOReNX.mjs} +1 -1
@@ -0,0 +1,418 @@
1
+ import { t as createProgressDebouncer } from "./EventBus-DgPmwpeu.mjs";
2
+ import { t as tool } from "./tool-builder-DCbIC5Eo.mjs";
3
+ //#region src/server/domains/memory/definitions.ts
4
+ const ScanValueTypeOptions = [
5
+ "byte",
6
+ "int8",
7
+ "int16",
8
+ "uint16",
9
+ "int32",
10
+ "uint32",
11
+ "int64",
12
+ "uint64",
13
+ "float",
14
+ "double",
15
+ "string",
16
+ "hex",
17
+ "pointer"
18
+ ];
19
+ const ScanCompareModeOptions = [
20
+ "exact",
21
+ "unknown_initial",
22
+ "changed",
23
+ "unchanged",
24
+ "increased",
25
+ "decreased",
26
+ "greater_than",
27
+ "less_than",
28
+ "between",
29
+ "not_equal"
30
+ ];
31
+ const memoryScanToolDefinitions = [
32
+ tool("memory_first_scan", (t) => t.desc("Start a new memory scan session.").string("value", "Value to search for (as string, e.g. \"100\", \"3.14\", \"48 65 6C 6C 6F\")").enum("valueType", [...ScanValueTypeOptions], "Data type of the value").number("alignment", "Alignment in bytes (0=unaligned, 4=4-byte aligned). Default: natural alignment for the type.").number("maxResults", "Maximum results to return (default: 1,000,000)").prop("regionFilter", {
33
+ type: "object",
34
+ properties: {
35
+ writable: {
36
+ type: "boolean",
37
+ description: "Only scan writable regions"
38
+ },
39
+ executable: {
40
+ type: "boolean",
41
+ description: "Only scan executable regions"
42
+ },
43
+ moduleOnly: {
44
+ type: "boolean",
45
+ description: "Only scan module-backed regions"
46
+ }
47
+ },
48
+ description: "Filter which memory regions to scan"
49
+ }).requiredOpenWorld("pid", "value", "valueType")),
50
+ tool("memory_next_scan", (t) => t.desc("Narrow an existing scan session.").enum("mode", [...ScanCompareModeOptions], "Comparison mode").string("value", "Target value for exact/greater_than/less_than/between/not_equal modes").string("value2", "Upper bound value for \"between\" mode").requiredOpenWorld("sessionId", "mode")),
51
+ tool("memory_unknown_scan", (t) => t.desc("Start an unknown initial value scan.").enum("valueType", [...ScanValueTypeOptions], "Data type to capture").number("alignment", "Alignment in bytes (default: natural for type)").number("maxResults", "Maximum addresses to capture (default: 5,000,000)").prop("regionFilter", {
52
+ type: "object",
53
+ properties: {
54
+ writable: { type: "boolean" },
55
+ executable: { type: "boolean" },
56
+ moduleOnly: { type: "boolean" }
57
+ }
58
+ }).requiredOpenWorld("pid", "valueType")),
59
+ tool("memory_pointer_scan", (t) => t.desc("Find pointers to a target address.").string("targetAddress", "Target address to find pointers to (hex, e.g. \"0x7FF612340000\")").number("maxResults", "Maximum results (default: 10,000)").boolean("moduleOnly", "Only scan module-backed regions").required("pid", "targetAddress").query().openWorld()),
60
+ tool("memory_group_scan", (t) => t.desc("Search for multiple values at known offsets simultaneously.").array("pattern", {
61
+ type: "object",
62
+ properties: {
63
+ offset: {
64
+ type: "number",
65
+ description: "Byte offset from base"
66
+ },
67
+ value: {
68
+ type: "string",
69
+ description: "Expected value at offset"
70
+ },
71
+ type: {
72
+ type: "string",
73
+ enum: [...ScanValueTypeOptions],
74
+ description: "Value type at offset"
75
+ }
76
+ },
77
+ required: [
78
+ "offset",
79
+ "value",
80
+ "type"
81
+ ]
82
+ }, "Array of {offset, value, type} patterns").number("alignment", "Alignment for base address (default: 4)").number("maxResults", "Maximum results (default: 1,000,000)").required("pid", "pattern").query()),
83
+ tool("memory_scan_session", (t) => t.desc(`Manage scan sessions. Actions: list (all sessions), delete (by sessionId), export (as JSON).`).enum("action", [
84
+ "list",
85
+ "delete",
86
+ "export"
87
+ ], "Session management action").string("sessionId", "Scan session ID (required for delete/export)").required("action")),
88
+ tool("memory_pointer_chain", (t) => t.desc(`Multi-level pointer chain operations.
89
+
90
+ Actions:
91
+ - scan: Find pointer chains to a target address
92
+ - validate: Validate chains by re-dereferencing
93
+ - resolve: Resolve a single chain to its current target
94
+ - export: Export chains as JSON`).enum("action", [
95
+ "scan",
96
+ "validate",
97
+ "resolve",
98
+ "export"
99
+ ], "Chain operation").number("pid", "Target process ID").string("targetAddress", "Target address hex (action=scan)").number("maxDepth", "Max chain depth 1-6 (action=scan, default: 4)").number("maxOffset", "Max offset per level in bytes (action=scan, default: 4096)").boolean("staticOnly", "Only module-relative chains (action=scan, default: false)").array("modules", { type: "string" }, "Only scan specific modules (action=scan)").number("maxResults", "Max chains to return (action=scan, default: 1000)").string("chains", "JSON PointerChain[] (action=validate/export)").string("chain", "JSON single PointerChain (action=resolve)").required("action")),
100
+ tool("memory_structure_analyze", (t) => t.desc("Analyze memory at an address to infer data structure layout.").string("address", "Base address of the structure (hex)").number("size", "Size to analyze in bytes (default: 256)").array("otherInstances", { type: "string" }, "Additional instance addresses for cross-comparison").boolean("parseRtti", "Whether to attempt RTTI parsing (default: true)").required("pid", "address").query()),
101
+ tool("memory_vtable_parse", (t) => t.desc("Parse a vtable to enumerate virtual function pointers and resolve them to module+offset. Also attempts RTTI parsing for class name and inheritance hierarchy.").number("pid", "Target process ID").string("vtableAddress", "Address of the vtable (hex)").required("pid", "vtableAddress").query()),
102
+ tool("memory_structure_export_c", (t) => t.desc("Export an inferred structure as a C-style struct definition with offset comments and type annotations.").string("structure", "JSON string of InferredStruct to export").string("name", "Struct name (defaults to RTTI class name or \"UnknownStruct\")").required("structure").query()),
103
+ tool("memory_structure_compare", (t) => t.desc("Compare two structure instances to identify which fields differ (dynamic values like health/position) vs which are constant (vtable, type flags). Useful for finding important fields.").number("pid", "Target process ID").string("address1", "First instance address (hex)").string("address2", "Second instance address (hex)").number("size", "Size to compare in bytes (default: 256)").required("pid", "address1", "address2").query()),
104
+ tool("memory_breakpoint", (t) => t.desc(`Hardware breakpoint operations using x64 debug registers (DR0-DR3). Max 4 concurrent.
105
+
106
+ Actions:
107
+ - set: Set a breakpoint (requires pid, address, access)
108
+ - remove: Remove by breakpointId
109
+ - list: List all active breakpoints
110
+ - trace: Set temporary breakpoint, collect N hits, then auto-remove`).enum("action", [
111
+ "set",
112
+ "remove",
113
+ "list",
114
+ "trace"
115
+ ], "Breakpoint operation").number("pid", "Target process ID (action=set/trace)").string("address", "Address hex (action=set/trace)").enum("access", [
116
+ "read",
117
+ "write",
118
+ "readwrite",
119
+ "execute"
120
+ ], "Access type (action=set/trace)").number("size", "Watch size in bytes (action=set, default: 4)").string("breakpointId", "Breakpoint ID (action=remove)").number("maxHits", "Max hits to collect (action=trace, default: 50)").number("timeoutMs", "Timeout ms (action=trace, default: 10000)").required("action").destructive()),
121
+ tool("memory_patch_bytes", (t) => t.desc("Write bytes to target process at address. Saves original bytes for undo. Use for runtime code patching.").number("pid", "Target process ID").string("address", "Address to patch (hex)").array("bytes", { type: "number" }, "Byte values to write (e.g. [0x90, 0x90])").required("pid", "address", "bytes").destructive().openWorld()),
122
+ tool("memory_patch_nop", (t) => t.desc("NOP out instructions at address (replace with 0x90). Useful for disabling checks or jumps.").number("pid", "Target process ID").string("address", "Address to NOP (hex)").number("count", "Number of bytes to NOP").required("pid", "address", "count").destructive()),
123
+ tool("memory_patch_undo", (t) => t.desc("Undo a previous patch by restoring the original bytes.").string("patchId", "Patch ID to undo").required("patchId").destructive()),
124
+ tool("memory_code_caves", (t) => t.desc("Find code caves (runs of 0x00 or 0xCC) in executable sections of loaded modules. Returns largest caves first.").number("pid", "Target process ID").number("minSize", "Minimum cave size in bytes (default: 16)").required("pid").query()),
125
+ tool("memory_write_value", (t) => t.desc("Write a typed value to a memory address. Supports undo via memory_write_undo.").number("pid", "Target process ID").string("address", "Address to write to (hex)").string("value", "Value to write (as string)").enum("valueType", [...ScanValueTypeOptions], "Data type of the value").required("pid", "address", "value", "valueType").destructive()),
126
+ tool("memory_freeze", (t) => t.desc(`Freeze or unfreeze a memory address. Freeze continuously writes a value to prevent changes; unfreeze stops it.`).enum("action", ["freeze", "unfreeze"], "Freeze operation").number("pid", "Target process ID (action=freeze)").string("address", "Address to freeze hex (action=freeze)").string("value", "Value to maintain (action=freeze)").enum("valueType", [...ScanValueTypeOptions], "Data type (action=freeze)").number("intervalMs", "Write interval ms (action=freeze, default: 100)").string("freezeId", "Freeze ID to remove (action=unfreeze)").required("action").destructive()),
127
+ tool("memory_dump", (t) => t.desc("Dump memory region as hex with ASCII column. Outputs a formatted hex dump similar to xxd.").number("pid", "Target process ID").string("address", "Start address (hex)").number("size", "Size to dump in bytes (default: 256)").required("pid", "address").query()),
128
+ tool("memory_speedhack", (t) => t.desc(`Speedhack: hook time APIs to scale process time. Speed 2.0 = 2x faster, 0.5 = half speed.
129
+
130
+ Actions:
131
+ - apply: Hook and apply speed multiplier (requires pid, speed)
132
+ - set: Adjust speed on active hack (requires pid, speed)`).enum("action", ["apply", "set"], "Speedhack action").number("pid", "Target process ID").number("speed", "Speed multiplier").required("action", "pid", "speed").destructive()),
133
+ tool("memory_write_history", (t) => t.desc("Undo or redo the last memory write operation.").enum("action", ["undo", "redo"], "History action").required("action").destructive().openWorld()),
134
+ tool("memory_heap_enumerate", (t) => t.desc("Enumerate all heaps and heap blocks in a process via Toolhelp32 snapshot. Returns heap list with block counts, sizes, and overall statistics.").number("pid", "Target process ID").number("maxBlocks", "Maximum blocks to enumerate per heap (default: 10000)").required("pid").query()),
135
+ tool("memory_heap_stats", (t) => t.desc("Get detailed heap statistics with size distribution buckets (0-64B, 64B-1KB, 1-64KB, 64KB-1MB, >1MB), fragmentation ratio, and aggregate metrics.").number("pid", "Target process ID").required("pid").query()),
136
+ tool("memory_heap_anomalies", (t) => t.desc("Detect heap anomalies: heap spray patterns (many same-size blocks), possible use-after-free (non-zero free blocks), and suspicious block sizes (0 or >100MB).").number("pid", "Target process ID").required("pid").query()),
137
+ tool("memory_pe_headers", (t) => t.desc("Parse PE headers (DOS, NT, File, Optional) from a module base address in process memory. Returns machine type, entry point, image base, section count, and data directory info.").number("pid", "Target process ID").string("moduleBase", "Module base address (hex, e.g. \"0x7ff612340000\")").required("pid", "moduleBase").query()),
138
+ tool("memory_pe_imports_exports", (t) => t.desc("Parse import and/or export tables from a PE module in process memory. Returns DLL names, function names, ordinals, hints, and forwarded exports.").number("pid", "Target process ID").string("moduleBase", "Module base address (hex)").enum("table", [
139
+ "imports",
140
+ "exports",
141
+ "both"
142
+ ], "Which table to parse", { default: "both" }).required("pid", "moduleBase").query()),
143
+ tool("memory_inline_hook_detect", (t) => t.desc("Detect inline hooks by comparing the first 16 bytes of each exported function on disk vs in memory. Identifies JMP rel32, JMP abs64, PUSH+RET hooks and decodes jump targets.").number("pid", "Target process ID").string("moduleName", "Module name filter (optional — scans all modules if omitted)").required("pid").query()),
144
+ tool("memory_anticheat_detect", (t) => t.desc("Scan process imports for anti-debug/anti-cheat mechanisms: IsDebuggerPresent, NtQueryInformationProcess, timing checks (QPC, GetTickCount), thread hiding, heap flag checks, and DR register inspection. Each detection includes a bypass suggestion.").number("pid", "Target process ID").required("pid").query()),
145
+ tool("memory_guard_pages", (t) => t.desc("Find all memory regions with PAGE_GUARD protection in a process. Guard pages are often used as anti-tampering mechanisms or stack overflow detection.").number("pid", "Target process ID").required("pid").query()),
146
+ tool("memory_integrity_check", (t) => t.desc("Check executable memory regions against their corresponding on-disk PE files (.text sections) to detect modifications like inline hooks or code patches.").number("pid", "Target process ID").required("pid").query())
147
+ ];
148
+ //#endregion
149
+ //#region src/server/domains/memory/manifest.ts
150
+ const DOMAIN = "memory";
151
+ const DEP_KEY = "memoryScanHandlers";
152
+ const IS_WIN32 = (process.env.JSHOOK_REGISTRY_PLATFORM === "win32" || process.env.JSHOOK_REGISTRY_PLATFORM === "linux" || process.env.JSHOOK_REGISTRY_PLATFORM === "darwin" ? process.env.JSHOOK_REGISTRY_PLATFORM : process.platform) === "win32";
153
+ let globalContext = null;
154
+ async function ensure(ctx) {
155
+ const { MemoryScanHandlers } = await import("./handlers.impl-DS0d9fUw.mjs");
156
+ globalContext = ctx;
157
+ const ctxAny = ctx;
158
+ if (ctxAny[DEP_KEY]) return ctxAny[DEP_KEY];
159
+ const [memoryScanner, scanSessionManager, pointerChainEngine, structureAnalyzer, codeInjector, memoryController] = await Promise.all([
160
+ import("./MemoryScanner-Bcpml6II.mjs"),
161
+ import("./MemoryScanSession-BsDZbLYm.mjs"),
162
+ import("./PointerChainEngine-BOhyVsjx.mjs"),
163
+ import("./StructureAnalyzer-DhFaPvRO.mjs"),
164
+ import("./CodeInjector-Cq8q01kp.mjs"),
165
+ import("./MemoryController-CbVdCIJF.mjs")
166
+ ]);
167
+ if (IS_WIN32) {
168
+ const [hardwareBreakpointEngine, speedhack, heapAnalyzer, peAnalyzer, antiCheatDetector] = await Promise.all([
169
+ import("./HardwareBreakpoint-B9gZCdFP.mjs"),
170
+ import("./Speedhack-CqdIFlQl.mjs"),
171
+ import("./HeapAnalyzer-BLDH0dCv.mjs"),
172
+ import("./PEAnalyzer-D1lzJ_VG.mjs"),
173
+ import("./AntiCheatDetector-BNk-EoBt.mjs")
174
+ ]);
175
+ ctxAny[DEP_KEY] = new MemoryScanHandlers(memoryScanner.memoryScanner, scanSessionManager.scanSessionManager, pointerChainEngine.pointerChainEngine, structureAnalyzer.structureAnalyzer, hardwareBreakpointEngine.hardwareBreakpointEngine, codeInjector.codeInjector, memoryController.memoryController, speedhack.speedhack, heapAnalyzer.heapAnalyzer, peAnalyzer.peAnalyzer, antiCheatDetector.antiCheatDetector, ctx.eventBus);
176
+ } else ctxAny[DEP_KEY] = new MemoryScanHandlers(memoryScanner.memoryScanner, scanSessionManager.scanSessionManager, pointerChainEngine.pointerChainEngine, structureAnalyzer.structureAnalyzer, null, codeInjector.codeInjector, memoryController.memoryController, null, null, null, null, ctx.eventBus);
177
+ return ctxAny[DEP_KEY];
178
+ }
179
+ function bindByKey(invoke) {
180
+ return (deps) => {
181
+ const handler = deps[DEP_KEY];
182
+ return (args) => {
183
+ const _meta = args._meta;
184
+ let onProgress;
185
+ if (_meta?.progressToken !== void 0 && globalContext) onProgress = createProgressDebouncer(globalContext.eventBus, _meta.progressToken);
186
+ return invoke(handler, {
187
+ ...args,
188
+ onProgress
189
+ });
190
+ };
191
+ };
192
+ }
193
+ function toolByName(name) {
194
+ const tool = memoryScanToolDefinitions.find((t) => t.name === name);
195
+ if (!tool) throw new Error(`Memory tool not found: ${name}`);
196
+ return tool;
197
+ }
198
+ const WIN32_ONLY_TOOLS = new Set([
199
+ "memory_heap_enumerate",
200
+ "memory_heap_stats",
201
+ "memory_heap_anomalies",
202
+ "memory_pe_headers",
203
+ "memory_pe_imports_exports",
204
+ "memory_inline_hook_detect",
205
+ "memory_anticheat_detect",
206
+ "memory_guard_pages",
207
+ "memory_integrity_check",
208
+ "memory_breakpoint",
209
+ "memory_speedhack"
210
+ ]);
211
+ const allRegistrations = [
212
+ {
213
+ tool: toolByName("memory_first_scan"),
214
+ domain: DOMAIN,
215
+ bind: bindByKey((h, a) => h.handleFirstScan(a))
216
+ },
217
+ {
218
+ tool: toolByName("memory_next_scan"),
219
+ domain: DOMAIN,
220
+ bind: bindByKey((h, a) => h.handleNextScan(a))
221
+ },
222
+ {
223
+ tool: toolByName("memory_unknown_scan"),
224
+ domain: DOMAIN,
225
+ bind: bindByKey((h, a) => h.handleUnknownScan(a))
226
+ },
227
+ {
228
+ tool: toolByName("memory_pointer_scan"),
229
+ domain: DOMAIN,
230
+ bind: bindByKey((h, a) => h.handlePointerScan(a))
231
+ },
232
+ {
233
+ tool: toolByName("memory_group_scan"),
234
+ domain: DOMAIN,
235
+ bind: bindByKey((h, a) => h.handleGroupScan(a))
236
+ },
237
+ {
238
+ tool: toolByName("memory_scan_session"),
239
+ domain: DOMAIN,
240
+ bind: bindByKey((h, a) => h.handleScanSessionDispatch(a))
241
+ },
242
+ {
243
+ tool: toolByName("memory_pointer_chain"),
244
+ domain: DOMAIN,
245
+ bind: bindByKey((h, a) => h.handlePointerChainDispatch(a))
246
+ },
247
+ {
248
+ tool: toolByName("memory_structure_analyze"),
249
+ domain: DOMAIN,
250
+ bind: bindByKey((h, a) => h.handleStructureAnalyze(a))
251
+ },
252
+ {
253
+ tool: toolByName("memory_vtable_parse"),
254
+ domain: DOMAIN,
255
+ bind: bindByKey((h, a) => h.handleVtableParse(a))
256
+ },
257
+ {
258
+ tool: toolByName("memory_structure_export_c"),
259
+ domain: DOMAIN,
260
+ bind: bindByKey((h, a) => h.handleStructureExportC(a))
261
+ },
262
+ {
263
+ tool: toolByName("memory_structure_compare"),
264
+ domain: DOMAIN,
265
+ bind: bindByKey((h, a) => h.handleStructureCompare(a))
266
+ },
267
+ {
268
+ tool: toolByName("memory_breakpoint"),
269
+ domain: DOMAIN,
270
+ bind: bindByKey((h, a) => h.handleBreakpointDispatch(a))
271
+ },
272
+ {
273
+ tool: toolByName("memory_patch_bytes"),
274
+ domain: DOMAIN,
275
+ bind: bindByKey((h, a) => h.handlePatchBytes(a))
276
+ },
277
+ {
278
+ tool: toolByName("memory_patch_nop"),
279
+ domain: DOMAIN,
280
+ bind: bindByKey((h, a) => h.handlePatchNop(a))
281
+ },
282
+ {
283
+ tool: toolByName("memory_patch_undo"),
284
+ domain: DOMAIN,
285
+ bind: bindByKey((h, a) => h.handlePatchUndo(a))
286
+ },
287
+ {
288
+ tool: toolByName("memory_code_caves"),
289
+ domain: DOMAIN,
290
+ bind: bindByKey((h, a) => h.handleCodeCaves(a))
291
+ },
292
+ {
293
+ tool: toolByName("memory_write_value"),
294
+ domain: DOMAIN,
295
+ bind: bindByKey((h, a) => h.handleWriteValue(a))
296
+ },
297
+ {
298
+ tool: toolByName("memory_freeze"),
299
+ domain: DOMAIN,
300
+ bind: bindByKey((h, a) => h.handleFreezeDispatch(a))
301
+ },
302
+ {
303
+ tool: toolByName("memory_dump"),
304
+ domain: DOMAIN,
305
+ bind: bindByKey((h, a) => h.handleDump(a))
306
+ },
307
+ {
308
+ tool: toolByName("memory_speedhack"),
309
+ domain: DOMAIN,
310
+ bind: bindByKey((h, a) => h.handleSpeedhackDispatch(a))
311
+ },
312
+ {
313
+ tool: toolByName("memory_write_history"),
314
+ domain: DOMAIN,
315
+ bind: bindByKey((h, a) => h.handleWriteHistoryDispatch(a))
316
+ },
317
+ {
318
+ tool: toolByName("memory_heap_enumerate"),
319
+ domain: DOMAIN,
320
+ bind: bindByKey((h, a) => h.handleHeapEnumerate(a))
321
+ },
322
+ {
323
+ tool: toolByName("memory_heap_stats"),
324
+ domain: DOMAIN,
325
+ bind: bindByKey((h, a) => h.handleHeapStats(a))
326
+ },
327
+ {
328
+ tool: toolByName("memory_heap_anomalies"),
329
+ domain: DOMAIN,
330
+ bind: bindByKey((h, a) => h.handleHeapAnomalies(a))
331
+ },
332
+ {
333
+ tool: toolByName("memory_pe_headers"),
334
+ domain: DOMAIN,
335
+ bind: bindByKey((h, a) => h.handlePEHeaders(a))
336
+ },
337
+ {
338
+ tool: toolByName("memory_pe_imports_exports"),
339
+ domain: DOMAIN,
340
+ bind: bindByKey((h, a) => h.handlePEImportsExports(a))
341
+ },
342
+ {
343
+ tool: toolByName("memory_inline_hook_detect"),
344
+ domain: DOMAIN,
345
+ bind: bindByKey((h, a) => h.handleInlineHookDetect(a))
346
+ },
347
+ {
348
+ tool: toolByName("memory_anticheat_detect"),
349
+ domain: DOMAIN,
350
+ bind: bindByKey((h, a) => h.handleAntiCheatDetect(a))
351
+ },
352
+ {
353
+ tool: toolByName("memory_guard_pages"),
354
+ domain: DOMAIN,
355
+ bind: bindByKey((h, a) => h.handleGuardPages(a))
356
+ },
357
+ {
358
+ tool: toolByName("memory_integrity_check"),
359
+ domain: DOMAIN,
360
+ bind: bindByKey((h, a) => h.handleIntegrityCheck(a))
361
+ }
362
+ ];
363
+ const manifest = {
364
+ kind: "domain-manifest",
365
+ version: 1,
366
+ domain: DOMAIN,
367
+ depKey: DEP_KEY,
368
+ profiles: ["full"],
369
+ ensure,
370
+ registrations: IS_WIN32 ? allRegistrations : allRegistrations.filter((r) => !WIN32_ONLY_TOOLS.has(r.tool.name)),
371
+ workflowRule: {
372
+ patterns: [
373
+ /memory\s*scan/i,
374
+ /cheat\s*engine/i,
375
+ /find\s*(value|address|variable|struct)/i,
376
+ /scan\s*(for|memory)/i,
377
+ /pointer\s*(chain|scan)/i,
378
+ /struct(ure)?\s*(analy|infer|dissect)/i,
379
+ /vtable|rtti/i,
380
+ /breakpoint|watchpoint|hardware\s*bp/i,
381
+ /patch\s*(byte|nop|code)/i,
382
+ /code\s*cave/i,
383
+ /freeze|unfreeze/i,
384
+ /speedhack|time\s*(hack|scale)/i,
385
+ /memory\s*(dump|hex)/i,
386
+ /undo|redo/i,
387
+ /heap|堆\s*(分析|枚举|异常)/i,
388
+ /PE\s*(header|import|export)|inline.*hook/i,
389
+ /anti.?cheat|anti.?debug|反作弊|反调试/i,
390
+ /guard\s*page|integrity\s*check|代码完整性/i,
391
+ /内存\s*(扫描|搜索|分析|结构|断点|注入|冻结|加速|堆|模块|反作弊)/i
392
+ ],
393
+ priority: 90,
394
+ tools: [
395
+ "memory_first_scan",
396
+ "memory_next_scan",
397
+ "memory_unknown_scan",
398
+ "memory_pointer_chain",
399
+ "memory_structure_analyze",
400
+ "memory_vtable_parse",
401
+ "memory_scan_session",
402
+ ...IS_WIN32 ? ["memory_breakpoint", "memory_speedhack"] : [],
403
+ "memory_patch_bytes",
404
+ "memory_freeze",
405
+ "memory_dump",
406
+ ...IS_WIN32 ? [
407
+ "memory_speedhack",
408
+ "memory_heap_enumerate",
409
+ "memory_pe_headers",
410
+ "memory_anticheat_detect"
411
+ ] : [],
412
+ "memory_write_history"
413
+ ],
414
+ hint: IS_WIN32 ? "Memory domain: scan → narrow → pointer chain → structure | breakpoint trace → patch/NOP → freeze | speedhack | heap analysis | PE introspection | anti-cheat detection" : "Memory domain: scan → narrow → pointer chain → structure | patch/NOP → freeze | dump"
415
+ }
416
+ };
417
+ //#endregion
418
+ export { manifest as default };
@@ -0,0 +1,96 @@
1
+ import { n as toolLookup } from "./registry-D-6e18lB.mjs";
2
+ import { t as bindByDepKey } from "./bind-helpers-xFfRF-qm.mjs";
3
+ import { t as tool } from "./tool-builder-DCbIC5Eo.mjs";
4
+ //#region src/server/domains/extension-registry/definitions.ts
5
+ const extensionRegistryTools = [
6
+ tool("extension_list_installed", (t) => t.desc("List installed extensions from the local extension registry").query()),
7
+ tool("extension_execute_in_context", (t) => t.desc("Load an extension and execute a named exported context function").string("pluginId", "Plugin identifier").string("contextName", "Exported function or context name").prop("args", {
8
+ type: "object",
9
+ description: "Arguments passed to the target context",
10
+ additionalProperties: true
11
+ }).requiredOpenWorld("pluginId", "contextName")),
12
+ tool("extension_reload", (t) => t.desc("Reload an installed extension by unloading and loading it again").string("pluginId", "Plugin identifier").requiredOpenWorld("pluginId")),
13
+ tool("extension_uninstall", (t) => t.desc("Uninstall an extension from the local extension registry").string("pluginId", "Plugin identifier").required("pluginId").destructive()),
14
+ tool("webhook", (t) => t.desc("Manage webhook endpoints for external callbacks. Actions: create, list, delete, commands.").enum("action", [
15
+ "create",
16
+ "list",
17
+ "delete",
18
+ "commands"
19
+ ], "Webhook operation").string("name", "Human-readable webhook name (action=create)").string("path", "URL path for the webhook endpoint (action=create)").string("secret", "Optional HMAC secret for webhook authentication (action=create)").string("url", "Optional external callback URL for webhook forwarding (action=create)").array("events", { type: "string" }, "List of events to subscribe to (action=create)").string("endpointId", "Webhook endpoint identifier (action=delete, commands)").string("status", "Filter commands by status: pending, processing, completed, failed (action=commands)").prop("command", {
20
+ type: "object",
21
+ description: "Command to enqueue (action=commands, if provided adds to queue instead of listing)",
22
+ additionalProperties: true
23
+ }).required("action"))
24
+ ];
25
+ //#endregion
26
+ //#region src/server/domains/extension-registry/manifest.ts
27
+ const DOMAIN = "extension-registry";
28
+ const DEP_KEY = "extensionRegistryHandlers";
29
+ const t = toolLookup(extensionRegistryTools);
30
+ const b = (invoke) => bindByDepKey(DEP_KEY, invoke);
31
+ async function ensure(ctx) {
32
+ const { ExtensionRegistryHandlers } = await import("./handlers-DeLOCd5m.mjs");
33
+ const existing = ctx.getDomainInstance(DEP_KEY);
34
+ if (existing) return existing;
35
+ const handlers = new ExtensionRegistryHandlers();
36
+ ctx.setDomainInstance(DEP_KEY, handlers);
37
+ handlers.startWebhookServer().catch(() => void 0);
38
+ return handlers;
39
+ }
40
+ const manifest = {
41
+ kind: "domain-manifest",
42
+ version: 1,
43
+ domain: DOMAIN,
44
+ depKey: DEP_KEY,
45
+ profiles: ["full"],
46
+ ensure,
47
+ registrations: [
48
+ {
49
+ tool: t("extension_list_installed"),
50
+ domain: DOMAIN,
51
+ bind: b((handlers) => handlers.handleListInstalled())
52
+ },
53
+ {
54
+ tool: t("extension_execute_in_context"),
55
+ domain: DOMAIN,
56
+ bind: b((handlers, args) => handlers.handleExecuteInContext(args))
57
+ },
58
+ {
59
+ tool: t("extension_reload"),
60
+ domain: DOMAIN,
61
+ bind: b((handlers, args) => handlers.handleReload(args))
62
+ },
63
+ {
64
+ tool: t("extension_uninstall"),
65
+ domain: DOMAIN,
66
+ bind: b((handlers, args) => handlers.handleUninstall(args))
67
+ },
68
+ {
69
+ tool: t("webhook"),
70
+ domain: DOMAIN,
71
+ bind: b((handlers, args) => handlers.handleWebhookDispatch(args))
72
+ }
73
+ ],
74
+ workflowRule: {
75
+ patterns: [/\b(extension|plugin|addon|webhook|c2|bluetooth|ble|hid|serial|esp32|registry)\b/i, /(install|uninstall|reload).*(extension|plugin)/i],
76
+ priority: 70,
77
+ tools: [
78
+ "install_extension",
79
+ "extension_list_installed",
80
+ "webhook"
81
+ ],
82
+ hint: "Plugin + webhook C2 + BLE HID + serial flashing pipeline."
83
+ },
84
+ prerequisites: { webhook: [{
85
+ condition: "Webhook listen port must be free",
86
+ fix: "Pick an unused port via the `port` argument or stop the conflicting service"
87
+ }] },
88
+ toolDependencies: [{
89
+ from: "webhook",
90
+ to: "extension_list_installed",
91
+ relation: "suggests",
92
+ weight: .5
93
+ }]
94
+ };
95
+ //#endregion
96
+ export { manifest as default };