@jshookmcp/jshook 0.2.8 → 0.3.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (162) hide show
  1. package/README.md +36 -5
  2. package/README.zh.md +36 -5
  3. package/dist/{AntiCheatDetector-S8VRj-dD.mjs → AntiCheatDetector-CqGDXmfc.mjs} +160 -54
  4. package/dist/{CodeInjector-4Z3ngPoX.mjs → CodeInjector-BdjRfNx7.mjs} +5 -5
  5. package/dist/ConsoleMonitor-DykL3IAw.mjs +2269 -0
  6. package/dist/{DarwinAPI-B8hg_yhz.mjs → DarwinAPI-ETyy0xyo.mjs} +1 -1
  7. package/dist/DetailedDataManager-HT49OrvF.mjs +217 -0
  8. package/dist/EventBus-DFKvADm3.mjs +141 -0
  9. package/dist/EvidenceGraphBridge-318Oi0Lf.mjs +153 -0
  10. package/dist/{ExtensionManager-D5-bO9D8.mjs → ExtensionManager-BDMsY2Dz.mjs} +27 -13
  11. package/dist/{FingerprintManager-BVxFJL2-.mjs → FingerprintManager-BN4UQWnX.mjs} +1 -1
  12. package/dist/{HardwareBreakpoint-DK1yjWkV.mjs → HardwareBreakpoint-Cc2AFq1Y.mjs} +3 -3
  13. package/dist/{HeapAnalyzer-CEbo10xU.mjs → HeapAnalyzer-DruMgsgj.mjs} +21 -21
  14. package/dist/HookGeneratorBuilders.core.generators.storage-CTbB4Lcx.mjs +566 -0
  15. package/dist/InstrumentationSession-DLH0vd-z.mjs +244 -0
  16. package/dist/{MemoryController-DdtnBdD4.mjs → MemoryController-CMtviNW_.mjs} +3 -3
  17. package/dist/{MemoryScanSession-RMixN3bX.mjs → MemoryScanSession-ITgb_NMi.mjs} +81 -78
  18. package/dist/{MemoryScanner-QjK4ld0B.mjs → MemoryScanner-CiL7Z3ey.mjs} +50 -21
  19. package/dist/{NativeMemoryManager.impl-CB6gJ0NM.mjs → NativeMemoryManager.impl-D9Lkovvn.mjs} +20 -56
  20. package/dist/{NativeMemoryManager.utils-BML4q1ry.mjs → NativeMemoryManager.utils-BBlAixF5.mjs} +1 -1
  21. package/dist/{PEAnalyzer-CK0xe0Fs.mjs → PEAnalyzer-DMQ44gen.mjs} +16 -16
  22. package/dist/PageController-BPJNqqBN.mjs +431 -0
  23. package/dist/{PointerChainEngine-Cd73qu5b.mjs → PointerChainEngine-K7wN8Z-w.mjs} +10 -7
  24. package/dist/PrerequisiteError-TuyZIs6n.mjs +20 -0
  25. package/dist/ProcessRegistry-zGg12QbE.mjs +74 -0
  26. package/dist/ResponseBuilder-CJXWmWNw.mjs +143 -0
  27. package/dist/ReverseEvidenceGraph-C02-gXOh.mjs +269 -0
  28. package/dist/ScriptManager-ZuWD-0Jg.mjs +3003 -0
  29. package/dist/{Speedhack-CeF0XmEz.mjs → Speedhack-D-z0umeT.mjs} +2 -2
  30. package/dist/{StructureAnalyzer-D4GkMduU.mjs → StructureAnalyzer-Cav5AVSL.mjs} +9 -6
  31. package/dist/ToolCatalog-5OJdMiF0.mjs +582 -0
  32. package/dist/ToolError-jh9whhMd.mjs +15 -0
  33. package/dist/ToolProbe-DbCFGyrg.mjs +45 -0
  34. package/dist/ToolRegistry-B9krbTtI.mjs +180 -0
  35. package/dist/ToolRouter.policy-BGDAGyeH.mjs +344 -0
  36. package/dist/TraceRecorder-B41Z5XBj.mjs +1286 -0
  37. package/dist/{Win32API-Bc0QnQsN.mjs → Win32API-C2kjj0ze.mjs} +19 -13
  38. package/dist/{Win32Debug-DUHt9XUn.mjs → Win32Debug-CKrGOTpo.mjs} +3 -3
  39. package/dist/WorkflowEngine-DJ6M4opp.mjs +569 -0
  40. package/dist/analysis-BHeJW2Nb.mjs +1234 -0
  41. package/dist/antidebug-BRKeyt27.mjs +1081 -0
  42. package/dist/artifactRetention-CPXkUJXp.mjs +598 -0
  43. package/dist/artifacts-DkfosXH3.mjs +59 -0
  44. package/dist/authorization-schema-DRqyJMSk.mjs +31 -0
  45. package/dist/betterSqlite3-DLSBZodi.mjs +74 -0
  46. package/dist/binary-instrument--V3MAhJ4.mjs +971 -0
  47. package/dist/bind-helpers-ClV34xdn.mjs +42 -0
  48. package/dist/boringssl-inspector-Bo_LOLaS.mjs +180 -0
  49. package/dist/browser-Dx3_S2cG.mjs +4369 -0
  50. package/dist/capabilities-CcHlvWgK.mjs +33 -0
  51. package/dist/concurrency-Drev_Vz9.mjs +41 -0
  52. package/dist/{constants-CCvsN80K.mjs → constants-CDZLOoVv.mjs} +105 -48
  53. package/dist/coordination-DgItD9DL.mjs +259 -0
  54. package/dist/debugger-RS3RSAqs.mjs +1288 -0
  55. package/dist/definitions-BEoYofW5.mjs +47 -0
  56. package/dist/definitions-BRaefg3u.mjs +365 -0
  57. package/dist/definitions-BbkvZkiv.mjs +96 -0
  58. package/dist/definitions-BtWSHJ3o.mjs +17 -0
  59. package/dist/definitions-C1gCHO0i.mjs +43 -0
  60. package/dist/definitions-CDOg_b-l.mjs +138 -0
  61. package/dist/definitions-CVPD9hzZ.mjs +54 -0
  62. package/dist/definitions-Cea8Lgl7.mjs +94 -0
  63. package/dist/definitions-DAgIyjxM.mjs +10 -0
  64. package/dist/definitions-DJA27nsL.mjs +66 -0
  65. package/dist/definitions-DKPFU3LW.mjs +25 -0
  66. package/dist/definitions-DPRpZQ96.mjs +47 -0
  67. package/dist/definitions-DUE5gmdn.mjs +18 -0
  68. package/dist/definitions-DYVjOtxa.mjs +26 -0
  69. package/dist/definitions-DcYLVLCo.mjs +37 -0
  70. package/dist/definitions-Pp5LI2H4.mjs +27 -0
  71. package/dist/definitions-j9KdHVNR.mjs +14 -0
  72. package/dist/definitions-uzkjBwa7.mjs +258 -0
  73. package/dist/definitions-va-AnLuQ.mjs +28 -0
  74. package/dist/encoding-DJeqHmpd.mjs +1079 -0
  75. package/dist/evidence-graph-bridge-DcYizFk2.mjs +136 -0
  76. package/dist/{factory-CibqTNC8.mjs → factory-C90tBff6.mjs} +41 -56
  77. package/dist/flat-target-session-Dgax2Cy3.mjs +29 -0
  78. package/dist/graphql-CoHrhweh.mjs +1197 -0
  79. package/dist/handlers-4jmR0nMs.mjs +898 -0
  80. package/dist/handlers-BAHPxcch.mjs +789 -0
  81. package/dist/handlers-BOs9b907.mjs +2600 -0
  82. package/dist/handlers-BWXEy6ef.mjs +917 -0
  83. package/dist/handlers-Bndn6QvE.mjs +111 -0
  84. package/dist/handlers-BqC4bD4s.mjs +681 -0
  85. package/dist/handlers-BtYq60bM2.mjs +276 -0
  86. package/dist/handlers-BzgcB4iv.mjs +799 -0
  87. package/dist/handlers-CRyRWj2b.mjs +859 -0
  88. package/dist/handlers-CVv2H1uq.mjs +592 -0
  89. package/dist/handlers-Dl5a7JS4.mjs +572 -0
  90. package/dist/handlers-Dx2d7jt7.mjs +2537 -0
  91. package/dist/handlers-Dz9PYsCa.mjs +2805 -0
  92. package/dist/handlers-HujRKC3b.mjs +661 -0
  93. package/dist/handlers.impl-XWXkQfyi.mjs +807 -0
  94. package/dist/hooks-B1B8NRHL.mjs +898 -0
  95. package/dist/index.mjs +491 -259
  96. package/dist/{logger-BmWzC2lM.mjs → logger-Dh_xb7_2.mjs} +14 -6
  97. package/dist/maintenance-PRMkLVRW.mjs +835 -0
  98. package/dist/manifest-67Bok-Si.mjs +58 -0
  99. package/dist/manifest-6lNTMZAB2.mjs +87 -0
  100. package/dist/manifest-B2duEHiH.mjs +90 -0
  101. package/dist/manifest-B6EY9Vm8.mjs +57 -0
  102. package/dist/manifest-B6nKSbyY.mjs +95 -0
  103. package/dist/manifest-BL8AQNPF.mjs +106 -0
  104. package/dist/manifest-BSZvJJmV.mjs +47 -0
  105. package/dist/manifest-BU7qzUyX.mjs +418 -0
  106. package/dist/manifest-Bl62e8WK.mjs +49 -0
  107. package/dist/manifest-Bo5cXjdt.mjs +82 -0
  108. package/dist/manifest-BpS4gtUK.mjs +1347 -0
  109. package/dist/manifest-Bv65_e2W.mjs +101 -0
  110. package/dist/manifest-BytNIF4Z.mjs +117 -0
  111. package/dist/manifest-C-xtsjS3.mjs +81 -0
  112. package/dist/manifest-CDYl7OhA.mjs +66 -0
  113. package/dist/manifest-CRZ3xmkD.mjs +61 -0
  114. package/dist/manifest-CoW6u4Tp.mjs +132 -0
  115. package/dist/manifest-Cq5zN_8A.mjs +50 -0
  116. package/dist/manifest-D7YZM_2e.mjs +194 -0
  117. package/dist/manifest-DE_VrAeQ.mjs +314 -0
  118. package/dist/manifest-DGsXSCpT.mjs +39 -0
  119. package/dist/manifest-DJ2vfEuW.mjs +156 -0
  120. package/dist/manifest-DPXDYhEu.mjs +80 -0
  121. package/dist/manifest-Dd4fQb0a.mjs +322 -0
  122. package/dist/manifest-Deq6opGg.mjs +223 -0
  123. package/dist/manifest-DfJTafJK.mjs +37 -0
  124. package/dist/manifest-DgOdgN_j.mjs +50 -0
  125. package/dist/manifest-DlbMW4v4.mjs +47 -0
  126. package/dist/manifest-DmVfbH0w.mjs +374 -0
  127. package/dist/manifest-Dog6Ddjr.mjs +109 -0
  128. package/dist/manifest-DvgU5FWb.mjs +58 -0
  129. package/dist/manifest-HsfDBs7j.mjs +50 -0
  130. package/dist/manifest-I8oQHvCG.mjs +186 -0
  131. package/dist/manifest-NvH_a-av.mjs +786 -0
  132. package/dist/manifest-cEJU1v0Z.mjs +129 -0
  133. package/dist/manifest-wOl5XLB12.mjs +112 -0
  134. package/dist/modules-tZozf0LQ.mjs +10635 -0
  135. package/dist/mojo-ipc-DXNEXEqb.mjs +640 -0
  136. package/dist/network-CPVvwvFg.mjs +3852 -0
  137. package/dist/{artifacts-BbdOMET5.mjs → outputPaths-um7lCRY3.mjs} +219 -216
  138. package/dist/parse-args-B4cY5Vx5.mjs +39 -0
  139. package/dist/platform-CYeFoTWp.mjs +2161 -0
  140. package/dist/process-BTbgcVc6.mjs +1306 -0
  141. package/dist/proxy-r8YN6nP1.mjs +192 -0
  142. package/dist/registry-Bl8ZQW61.mjs +34 -0
  143. package/dist/response-CWhh2aLo.mjs +34 -0
  144. package/dist/server/plugin-api.mjs +2 -2
  145. package/dist/shared-state-board-BoZnSoj-.mjs +586 -0
  146. package/dist/sourcemap-BIDHUVXy.mjs +934 -0
  147. package/dist/ssrf-policy-Dsqd-DTX.mjs +166 -0
  148. package/dist/streaming-Dal6utPp.mjs +725 -0
  149. package/dist/tool-builder-BHJp32mV.mjs +186 -0
  150. package/dist/transform-DRVgGG90.mjs +1011 -0
  151. package/dist/types-Bx92KJfT.mjs +4 -0
  152. package/dist/wasm-BYx5UOeG.mjs +1044 -0
  153. package/dist/webcrack-Be0_FccV.mjs +747 -0
  154. package/dist/workflow-BpuKEtvn.mjs +725 -0
  155. package/package.json +82 -49
  156. package/dist/ExtensionManager-CPTJhHFg.mjs +0 -2
  157. package/dist/ToolCatalog-Bq4V2sbJ.mjs +0 -67201
  158. package/dist/{CacheAdapters-CzFNpD9a.mjs → CacheAdapters-jJFy20G-.mjs} +0 -0
  159. package/dist/{StealthVerifier-BzBCFiwx.mjs → StealthVerifier-BWmPgQsv.mjs} +0 -0
  160. package/dist/{VersionDetector-CNXcvD46.mjs → VersionDetector-K3V4vGsw.mjs} +0 -0
  161. package/dist/{formatAddress-ChCSIRWT.mjs → formatAddress-nnMvEohD.mjs} +0 -0
  162. package/dist/{types-BBjOqye-.mjs → types-DDBWs9UP.mjs} +1 -1
@@ -0,0 +1,418 @@
1
+ import { t as createProgressDebouncer } from "./EventBus-DFKvADm3.mjs";
2
+ import { t as tool } from "./tool-builder-BHJp32mV.mjs";
3
+ //#region src/server/domains/memory/definitions.ts
4
+ const ScanValueTypeOptions = [
5
+ "byte",
6
+ "int8",
7
+ "int16",
8
+ "uint16",
9
+ "int32",
10
+ "uint32",
11
+ "int64",
12
+ "uint64",
13
+ "float",
14
+ "double",
15
+ "string",
16
+ "hex",
17
+ "pointer"
18
+ ];
19
+ const ScanCompareModeOptions = [
20
+ "exact",
21
+ "unknown_initial",
22
+ "changed",
23
+ "unchanged",
24
+ "increased",
25
+ "decreased",
26
+ "greater_than",
27
+ "less_than",
28
+ "between",
29
+ "not_equal"
30
+ ];
31
+ const memoryScanToolDefinitions = [
32
+ tool("memory_first_scan", (t) => t.desc("Start a new memory scan session.").number("pid", "Target process ID").string("value", "Value to search for (as string, e.g. \"100\", \"3.14\", \"48 65 6C 6C 6F\")").enum("valueType", [...ScanValueTypeOptions], "Data type of the value").number("alignment", "Alignment in bytes (0=unaligned, 4=4-byte aligned). Default: natural alignment for the type.").number("maxResults", "Maximum results to return (default: 1,000,000)").prop("regionFilter", {
33
+ type: "object",
34
+ properties: {
35
+ writable: {
36
+ type: "boolean",
37
+ description: "Only scan writable regions"
38
+ },
39
+ executable: {
40
+ type: "boolean",
41
+ description: "Only scan executable regions"
42
+ },
43
+ moduleOnly: {
44
+ type: "boolean",
45
+ description: "Only scan module-backed regions"
46
+ }
47
+ },
48
+ description: "Filter which memory regions to scan"
49
+ }).requiredOpenWorld("pid", "value", "valueType")),
50
+ tool("memory_next_scan", (t) => t.desc("Narrow an existing scan session.").string("sessionId", "Scan session ID").enum("mode", [...ScanCompareModeOptions], "Comparison mode").string("value", "Target value for exact/greater_than/less_than/between/not_equal modes").string("value2", "Upper bound value for \"between\" mode").requiredOpenWorld("sessionId", "mode")),
51
+ tool("memory_unknown_scan", (t) => t.desc("Start an unknown initial value scan.").number("pid", "Target process ID").enum("valueType", [...ScanValueTypeOptions], "Data type to capture").number("alignment", "Alignment in bytes (default: natural for type)").number("maxResults", "Maximum addresses to capture (default: 5,000,000)").prop("regionFilter", {
52
+ type: "object",
53
+ properties: {
54
+ writable: { type: "boolean" },
55
+ executable: { type: "boolean" },
56
+ moduleOnly: { type: "boolean" }
57
+ }
58
+ }).requiredOpenWorld("pid", "valueType")),
59
+ tool("memory_pointer_scan", (t) => t.desc("Find pointers to a target address.").number("pid", "Target process ID").string("targetAddress", "Target address to find pointers to (hex, e.g. \"0x7FF612340000\")").number("maxResults", "Maximum results (default: 10,000)").boolean("moduleOnly", "Only scan module-backed regions").required("pid", "targetAddress").query().openWorld()),
60
+ tool("memory_group_scan", (t) => t.desc("Search for multiple values at known offsets simultaneously.").number("pid", "Target process ID").array("pattern", {
61
+ type: "object",
62
+ properties: {
63
+ offset: {
64
+ type: "number",
65
+ description: "Byte offset from base"
66
+ },
67
+ value: {
68
+ type: "string",
69
+ description: "Expected value at offset"
70
+ },
71
+ type: {
72
+ type: "string",
73
+ enum: [...ScanValueTypeOptions],
74
+ description: "Value type at offset"
75
+ }
76
+ },
77
+ required: [
78
+ "offset",
79
+ "value",
80
+ "type"
81
+ ]
82
+ }, "Array of {offset, value, type} patterns").number("alignment", "Alignment for base address (default: 4)").number("maxResults", "Maximum results (default: 1,000,000)").required("pid", "pattern").query()),
83
+ tool("memory_scan_session", (t) => t.desc(`Manage scan sessions. Actions: list (all sessions), delete (by sessionId), export (as JSON).`).enum("action", [
84
+ "list",
85
+ "delete",
86
+ "export"
87
+ ], "Session management action").string("sessionId", "Scan session ID (required for delete/export)").required("action")),
88
+ tool("memory_pointer_chain", (t) => t.desc(`Multi-level pointer chain operations.
89
+
90
+ Actions:
91
+ - scan: Find pointer chains to a target address
92
+ - validate: Validate chains by re-dereferencing
93
+ - resolve: Resolve a single chain to its current target
94
+ - export: Export chains as JSON`).enum("action", [
95
+ "scan",
96
+ "validate",
97
+ "resolve",
98
+ "export"
99
+ ], "Chain operation").number("pid", "Target process ID").string("targetAddress", "Target address hex (action=scan)").number("maxDepth", "Max chain depth 1-6 (action=scan, default: 4)").number("maxOffset", "Max offset per level in bytes (action=scan, default: 4096)").boolean("staticOnly", "Only module-relative chains (action=scan, default: false)").array("modules", { type: "string" }, "Only scan specific modules (action=scan)").number("maxResults", "Max chains to return (action=scan, default: 1000)").string("chains", "JSON PointerChain[] (action=validate/export)").string("chain", "JSON single PointerChain (action=resolve)").required("action")),
100
+ tool("memory_structure_analyze", (t) => t.desc("Analyze memory at an address to infer data structure layout.").number("pid", "Target process ID").string("address", "Base address of the structure (hex)").number("size", "Size to analyze in bytes (default: 256)").array("otherInstances", { type: "string" }, "Additional instance addresses for cross-comparison").boolean("parseRtti", "Whether to attempt RTTI parsing (default: true)").required("pid", "address").query()),
101
+ tool("memory_vtable_parse", (t) => t.desc("Parse a vtable to enumerate virtual function pointers and resolve them to module+offset. Also attempts RTTI parsing for class name and inheritance hierarchy.").number("pid", "Target process ID").string("vtableAddress", "Address of the vtable (hex)").required("pid", "vtableAddress").query()),
102
+ tool("memory_structure_export_c", (t) => t.desc("Export an inferred structure as a C-style struct definition with offset comments and type annotations.").string("structure", "JSON string of InferredStruct to export").string("name", "Struct name (defaults to RTTI class name or \"UnknownStruct\")").required("structure").query()),
103
+ tool("memory_structure_compare", (t) => t.desc("Compare two structure instances to identify which fields differ (dynamic values like health/position) vs which are constant (vtable, type flags). Useful for finding important fields.").number("pid", "Target process ID").string("address1", "First instance address (hex)").string("address2", "Second instance address (hex)").number("size", "Size to compare in bytes (default: 256)").required("pid", "address1", "address2").query()),
104
+ tool("memory_breakpoint", (t) => t.desc(`Hardware breakpoint operations using x64 debug registers (DR0-DR3). Max 4 concurrent.
105
+
106
+ Actions:
107
+ - set: Set a breakpoint (requires pid, address, access)
108
+ - remove: Remove by breakpointId
109
+ - list: List all active breakpoints
110
+ - trace: Set temporary breakpoint, collect N hits, then auto-remove`).enum("action", [
111
+ "set",
112
+ "remove",
113
+ "list",
114
+ "trace"
115
+ ], "Breakpoint operation").number("pid", "Target process ID (action=set/trace)").string("address", "Address hex (action=set/trace)").enum("access", [
116
+ "read",
117
+ "write",
118
+ "readwrite",
119
+ "execute"
120
+ ], "Access type (action=set/trace)").number("size", "Watch size in bytes (action=set, default: 4)").string("breakpointId", "Breakpoint ID (action=remove)").number("maxHits", "Max hits to collect (action=trace, default: 50)").number("timeoutMs", "Timeout ms (action=trace, default: 10000)").required("action").destructive()),
121
+ tool("memory_patch_bytes", (t) => t.desc("Write bytes to target process at address. Saves original bytes for undo. Use for runtime code patching.").number("pid", "Target process ID").string("address", "Address to patch (hex)").array("bytes", { type: "number" }, "Byte values to write (e.g. [0x90, 0x90])").required("pid", "address", "bytes").destructive().openWorld()),
122
+ tool("memory_patch_nop", (t) => t.desc("NOP out instructions at address (replace with 0x90). Useful for disabling checks or jumps.").number("pid", "Target process ID").string("address", "Address to NOP (hex)").number("count", "Number of bytes to NOP").required("pid", "address", "count").destructive()),
123
+ tool("memory_patch_undo", (t) => t.desc("Undo a previous patch by restoring the original bytes.").string("patchId", "Patch ID to undo").required("patchId").destructive()),
124
+ tool("memory_code_caves", (t) => t.desc("Find code caves (runs of 0x00 or 0xCC) in executable sections of loaded modules. Returns largest caves first.").number("pid", "Target process ID").number("minSize", "Minimum cave size in bytes (default: 16)").required("pid").query()),
125
+ tool("memory_write_value", (t) => t.desc("Write a typed value to a memory address. Supports undo/redo via memory_write_history(action=undo|redo).").number("pid", "Target process ID").string("address", "Address to write to (hex)").string("value", "Value to write (as string)").enum("valueType", [...ScanValueTypeOptions], "Data type of the value").required("pid", "address", "value", "valueType").destructive()),
126
+ tool("memory_freeze", (t) => t.desc(`Freeze or unfreeze a memory address. Freeze continuously writes a value to prevent changes; unfreeze stops it.`).enum("action", ["freeze", "unfreeze"], "Freeze operation").number("pid", "Target process ID (action=freeze)").string("address", "Address to freeze hex (action=freeze)").string("value", "Value to maintain (action=freeze)").enum("valueType", [...ScanValueTypeOptions], "Data type (action=freeze)").number("intervalMs", "Write interval ms (action=freeze, default: 100)").string("freezeId", "Freeze ID to remove (action=unfreeze)").required("action").destructive()),
127
+ tool("memory_dump", (t) => t.desc("Dump memory region as hex with ASCII column. Outputs a formatted hex dump similar to xxd.").number("pid", "Target process ID").string("address", "Start address (hex)").number("size", "Size to dump in bytes (default: 256)").required("pid", "address").query()),
128
+ tool("memory_speedhack", (t) => t.desc(`Speedhack: hook time APIs to scale process time. Speed 2.0 = 2x faster, 0.5 = half speed.
129
+
130
+ Actions:
131
+ - apply: Hook and apply speed multiplier (requires pid, speed)
132
+ - set: Adjust speed on active hack (requires pid, speed)`).enum("action", ["apply", "set"], "Speedhack action").number("pid", "Target process ID").number("speed", "Speed multiplier").required("action", "pid", "speed").destructive()),
133
+ tool("memory_write_history", (t) => t.desc("Undo or redo the last memory write operation.").enum("action", ["undo", "redo"], "History action").required("action").destructive().openWorld()),
134
+ tool("memory_heap_enumerate", (t) => t.desc("Enumerate all heaps and heap blocks in a process via Toolhelp32 snapshot. Returns heap list with block counts, sizes, and overall statistics.").number("pid", "Target process ID").number("maxBlocks", "Maximum blocks to enumerate per heap (default: 10000)").required("pid").query()),
135
+ tool("memory_heap_stats", (t) => t.desc("Get detailed heap statistics with size distribution buckets (0-64B, 64B-1KB, 1-64KB, 64KB-1MB, >1MB), fragmentation ratio, and aggregate metrics.").number("pid", "Target process ID").required("pid").query()),
136
+ tool("memory_heap_anomalies", (t) => t.desc("Detect heap anomalies: heap spray patterns (many same-size blocks), possible use-after-free (non-zero free blocks), and suspicious block sizes (0 or >100MB).").number("pid", "Target process ID").required("pid").query()),
137
+ tool("memory_pe_headers", (t) => t.desc("Parse PE headers (DOS, NT, File, Optional) from a module base address in process memory. Returns machine type, entry point, image base, section count, and data directory info.").number("pid", "Target process ID").string("moduleBase", "Module base address (hex, e.g. \"0x7ff612340000\")").required("pid", "moduleBase").query()),
138
+ tool("memory_pe_imports_exports", (t) => t.desc("Parse import and/or export tables from a PE module in process memory. Returns DLL names, function names, ordinals, hints, and forwarded exports.").number("pid", "Target process ID").string("moduleBase", "Module base address (hex)").enum("table", [
139
+ "imports",
140
+ "exports",
141
+ "both"
142
+ ], "Which table to parse", { default: "both" }).required("pid", "moduleBase").query()),
143
+ tool("memory_inline_hook_detect", (t) => t.desc("Detect inline hooks by comparing the first 16 bytes of each exported function on disk vs in memory. Identifies JMP rel32, JMP abs64, PUSH+RET hooks and decodes jump targets.").number("pid", "Target process ID").string("moduleName", "Module name filter (optional — scans all modules if omitted)").required("pid").query()),
144
+ tool("memory_anticheat_detect", (t) => t.desc("Scan process imports for anti-debug/anti-cheat mechanisms: IsDebuggerPresent, NtQueryInformationProcess, timing checks (QPC, GetTickCount), thread hiding, heap flag checks, and DR register inspection. Each detection includes a bypass suggestion.").number("pid", "Target process ID").required("pid").query()),
145
+ tool("memory_guard_pages", (t) => t.desc("Find all memory regions with PAGE_GUARD protection in a process. Guard pages are often used as anti-tampering mechanisms or stack overflow detection.").number("pid", "Target process ID").required("pid").query()),
146
+ tool("memory_integrity_check", (t) => t.desc("Check executable memory regions against their corresponding on-disk PE files (.text sections) to detect modifications like inline hooks or code patches.").number("pid", "Target process ID").required("pid").query())
147
+ ];
148
+ //#endregion
149
+ //#region src/server/domains/memory/manifest.ts
150
+ const DOMAIN = "memory";
151
+ const DEP_KEY = "memoryScanHandlers";
152
+ const IS_WIN32 = (process.env.JSHOOK_REGISTRY_PLATFORM === "win32" || process.env.JSHOOK_REGISTRY_PLATFORM === "linux" || process.env.JSHOOK_REGISTRY_PLATFORM === "darwin" ? process.env.JSHOOK_REGISTRY_PLATFORM : process.platform) === "win32";
153
+ let globalContext = null;
154
+ async function ensure(ctx) {
155
+ const { MemoryScanHandlers } = await import("./handlers.impl-XWXkQfyi.mjs");
156
+ globalContext = ctx;
157
+ const ctxAny = ctx;
158
+ if (ctxAny[DEP_KEY]) return ctxAny[DEP_KEY];
159
+ const [memoryScanner, scanSessionManager, pointerChainEngine, structureAnalyzer, codeInjector, memoryController] = await Promise.all([
160
+ import("./MemoryScanner-CiL7Z3ey.mjs"),
161
+ import("./MemoryScanSession-ITgb_NMi.mjs"),
162
+ import("./PointerChainEngine-K7wN8Z-w.mjs"),
163
+ import("./StructureAnalyzer-Cav5AVSL.mjs"),
164
+ import("./CodeInjector-BdjRfNx7.mjs"),
165
+ import("./MemoryController-CMtviNW_.mjs")
166
+ ]);
167
+ if (IS_WIN32) {
168
+ const [hardwareBreakpointEngine, speedhack, heapAnalyzer, peAnalyzer, antiCheatDetector] = await Promise.all([
169
+ import("./HardwareBreakpoint-Cc2AFq1Y.mjs"),
170
+ import("./Speedhack-D-z0umeT.mjs"),
171
+ import("./HeapAnalyzer-DruMgsgj.mjs"),
172
+ import("./PEAnalyzer-DMQ44gen.mjs"),
173
+ import("./AntiCheatDetector-CqGDXmfc.mjs")
174
+ ]);
175
+ ctxAny[DEP_KEY] = new MemoryScanHandlers(memoryScanner.memoryScanner, scanSessionManager.scanSessionManager, pointerChainEngine.pointerChainEngine, structureAnalyzer.structureAnalyzer, hardwareBreakpointEngine.hardwareBreakpointEngine, codeInjector.codeInjector, memoryController.memoryController, speedhack.speedhack, heapAnalyzer.heapAnalyzer, peAnalyzer.peAnalyzer, antiCheatDetector.antiCheatDetector, ctx.eventBus);
176
+ } else ctxAny[DEP_KEY] = new MemoryScanHandlers(memoryScanner.memoryScanner, scanSessionManager.scanSessionManager, pointerChainEngine.pointerChainEngine, structureAnalyzer.structureAnalyzer, null, codeInjector.codeInjector, memoryController.memoryController, null, null, null, null, ctx.eventBus);
177
+ return ctxAny[DEP_KEY];
178
+ }
179
+ function bindByKey(invoke) {
180
+ return (deps) => {
181
+ const handler = deps[DEP_KEY];
182
+ return (args) => {
183
+ const meta = args._meta;
184
+ let onProgress;
185
+ if (meta?.progressToken !== void 0 && globalContext) onProgress = createProgressDebouncer(globalContext.eventBus, meta.progressToken);
186
+ return invoke(handler, {
187
+ ...args,
188
+ onProgress
189
+ });
190
+ };
191
+ };
192
+ }
193
+ function toolByName(name) {
194
+ const tool = memoryScanToolDefinitions.find((t) => t.name === name);
195
+ if (!tool) throw new Error(`Memory tool not found: ${name}`);
196
+ return tool;
197
+ }
198
+ const WIN32_ONLY_TOOLS = new Set([
199
+ "memory_heap_enumerate",
200
+ "memory_heap_stats",
201
+ "memory_heap_anomalies",
202
+ "memory_pe_headers",
203
+ "memory_pe_imports_exports",
204
+ "memory_inline_hook_detect",
205
+ "memory_anticheat_detect",
206
+ "memory_guard_pages",
207
+ "memory_integrity_check",
208
+ "memory_breakpoint",
209
+ "memory_speedhack"
210
+ ]);
211
+ const allRegistrations = [
212
+ {
213
+ tool: toolByName("memory_first_scan"),
214
+ domain: DOMAIN,
215
+ bind: bindByKey((h, a) => h.handleFirstScan(a))
216
+ },
217
+ {
218
+ tool: toolByName("memory_next_scan"),
219
+ domain: DOMAIN,
220
+ bind: bindByKey((h, a) => h.handleNextScan(a))
221
+ },
222
+ {
223
+ tool: toolByName("memory_unknown_scan"),
224
+ domain: DOMAIN,
225
+ bind: bindByKey((h, a) => h.handleUnknownScan(a))
226
+ },
227
+ {
228
+ tool: toolByName("memory_pointer_scan"),
229
+ domain: DOMAIN,
230
+ bind: bindByKey((h, a) => h.handlePointerScan(a))
231
+ },
232
+ {
233
+ tool: toolByName("memory_group_scan"),
234
+ domain: DOMAIN,
235
+ bind: bindByKey((h, a) => h.handleGroupScan(a))
236
+ },
237
+ {
238
+ tool: toolByName("memory_scan_session"),
239
+ domain: DOMAIN,
240
+ bind: bindByKey((h, a) => h.handleScanSessionDispatch(a))
241
+ },
242
+ {
243
+ tool: toolByName("memory_pointer_chain"),
244
+ domain: DOMAIN,
245
+ bind: bindByKey((h, a) => h.handlePointerChainDispatch(a))
246
+ },
247
+ {
248
+ tool: toolByName("memory_structure_analyze"),
249
+ domain: DOMAIN,
250
+ bind: bindByKey((h, a) => h.handleStructureAnalyze(a))
251
+ },
252
+ {
253
+ tool: toolByName("memory_vtable_parse"),
254
+ domain: DOMAIN,
255
+ bind: bindByKey((h, a) => h.handleVtableParse(a))
256
+ },
257
+ {
258
+ tool: toolByName("memory_structure_export_c"),
259
+ domain: DOMAIN,
260
+ bind: bindByKey((h, a) => h.handleStructureExportC(a))
261
+ },
262
+ {
263
+ tool: toolByName("memory_structure_compare"),
264
+ domain: DOMAIN,
265
+ bind: bindByKey((h, a) => h.handleStructureCompare(a))
266
+ },
267
+ {
268
+ tool: toolByName("memory_breakpoint"),
269
+ domain: DOMAIN,
270
+ bind: bindByKey((h, a) => h.handleBreakpointDispatch(a))
271
+ },
272
+ {
273
+ tool: toolByName("memory_patch_bytes"),
274
+ domain: DOMAIN,
275
+ bind: bindByKey((h, a) => h.handlePatchBytes(a))
276
+ },
277
+ {
278
+ tool: toolByName("memory_patch_nop"),
279
+ domain: DOMAIN,
280
+ bind: bindByKey((h, a) => h.handlePatchNop(a))
281
+ },
282
+ {
283
+ tool: toolByName("memory_patch_undo"),
284
+ domain: DOMAIN,
285
+ bind: bindByKey((h, a) => h.handlePatchUndo(a))
286
+ },
287
+ {
288
+ tool: toolByName("memory_code_caves"),
289
+ domain: DOMAIN,
290
+ bind: bindByKey((h, a) => h.handleCodeCaves(a))
291
+ },
292
+ {
293
+ tool: toolByName("memory_write_value"),
294
+ domain: DOMAIN,
295
+ bind: bindByKey((h, a) => h.handleWriteValue(a))
296
+ },
297
+ {
298
+ tool: toolByName("memory_freeze"),
299
+ domain: DOMAIN,
300
+ bind: bindByKey((h, a) => h.handleFreezeDispatch(a))
301
+ },
302
+ {
303
+ tool: toolByName("memory_dump"),
304
+ domain: DOMAIN,
305
+ bind: bindByKey((h, a) => h.handleDump(a))
306
+ },
307
+ {
308
+ tool: toolByName("memory_speedhack"),
309
+ domain: DOMAIN,
310
+ bind: bindByKey((h, a) => h.handleSpeedhackDispatch(a))
311
+ },
312
+ {
313
+ tool: toolByName("memory_write_history"),
314
+ domain: DOMAIN,
315
+ bind: bindByKey((h, a) => h.handleWriteHistoryDispatch(a))
316
+ },
317
+ {
318
+ tool: toolByName("memory_heap_enumerate"),
319
+ domain: DOMAIN,
320
+ bind: bindByKey((h, a) => h.handleHeapEnumerate(a))
321
+ },
322
+ {
323
+ tool: toolByName("memory_heap_stats"),
324
+ domain: DOMAIN,
325
+ bind: bindByKey((h, a) => h.handleHeapStats(a))
326
+ },
327
+ {
328
+ tool: toolByName("memory_heap_anomalies"),
329
+ domain: DOMAIN,
330
+ bind: bindByKey((h, a) => h.handleHeapAnomalies(a))
331
+ },
332
+ {
333
+ tool: toolByName("memory_pe_headers"),
334
+ domain: DOMAIN,
335
+ bind: bindByKey((h, a) => h.handlePEHeaders(a))
336
+ },
337
+ {
338
+ tool: toolByName("memory_pe_imports_exports"),
339
+ domain: DOMAIN,
340
+ bind: bindByKey((h, a) => h.handlePEImportsExports(a))
341
+ },
342
+ {
343
+ tool: toolByName("memory_inline_hook_detect"),
344
+ domain: DOMAIN,
345
+ bind: bindByKey((h, a) => h.handleInlineHookDetect(a))
346
+ },
347
+ {
348
+ tool: toolByName("memory_anticheat_detect"),
349
+ domain: DOMAIN,
350
+ bind: bindByKey((h, a) => h.handleAntiCheatDetect(a))
351
+ },
352
+ {
353
+ tool: toolByName("memory_guard_pages"),
354
+ domain: DOMAIN,
355
+ bind: bindByKey((h, a) => h.handleGuardPages(a))
356
+ },
357
+ {
358
+ tool: toolByName("memory_integrity_check"),
359
+ domain: DOMAIN,
360
+ bind: bindByKey((h, a) => h.handleIntegrityCheck(a))
361
+ }
362
+ ];
363
+ const manifest = {
364
+ kind: "domain-manifest",
365
+ version: 1,
366
+ domain: DOMAIN,
367
+ depKey: DEP_KEY,
368
+ profiles: ["full"],
369
+ ensure,
370
+ registrations: IS_WIN32 ? allRegistrations : allRegistrations.filter((r) => !WIN32_ONLY_TOOLS.has(r.tool.name)),
371
+ workflowRule: {
372
+ patterns: [
373
+ /memory\s*scan/i,
374
+ /cheat\s*engine/i,
375
+ /find\s*(value|address|variable|struct)/i,
376
+ /scan\s*(for|memory)/i,
377
+ /pointer\s*(chain|scan)/i,
378
+ /struct(ure)?\s*(analy|infer|dissect)/i,
379
+ /vtable|rtti/i,
380
+ /breakpoint|watchpoint|hardware\s*bp/i,
381
+ /patch\s*(byte|nop|code)/i,
382
+ /code\s*cave/i,
383
+ /freeze|unfreeze/i,
384
+ /speedhack|time\s*(hack|scale)/i,
385
+ /memory\s*(dump|hex)/i,
386
+ /undo|redo/i,
387
+ /heap|堆\s*(分析|枚举|异常)/i,
388
+ /PE\s*(header|import|export)|inline.*hook/i,
389
+ /anti.?cheat|anti.?debug|反作弊|反调试/i,
390
+ /guard\s*page|integrity\s*check|代码完整性/i,
391
+ /内存\s*(扫描|搜索|分析|结构|断点|注入|冻结|加速|堆|模块|反作弊)/i
392
+ ],
393
+ priority: 90,
394
+ tools: [
395
+ "memory_first_scan",
396
+ "memory_next_scan",
397
+ "memory_unknown_scan",
398
+ "memory_pointer_chain",
399
+ "memory_structure_analyze",
400
+ "memory_vtable_parse",
401
+ "memory_scan_session",
402
+ ...IS_WIN32 ? ["memory_breakpoint", "memory_speedhack"] : [],
403
+ "memory_patch_bytes",
404
+ "memory_freeze",
405
+ "memory_dump",
406
+ ...IS_WIN32 ? [
407
+ "memory_speedhack",
408
+ "memory_heap_enumerate",
409
+ "memory_pe_headers",
410
+ "memory_anticheat_detect"
411
+ ] : [],
412
+ "memory_write_history"
413
+ ],
414
+ hint: IS_WIN32 ? "Memory domain: scan → narrow → pointer chain → structure | breakpoint trace → patch/NOP → freeze | speedhack | heap analysis | PE introspection | anti-cheat detection" : "Memory domain: scan → narrow → pointer chain → structure | patch/NOP → freeze | dump"
415
+ }
416
+ };
417
+ //#endregion
418
+ export { manifest as default };
@@ -0,0 +1,49 @@
1
+ import { n as toolLookup } from "./registry-Bl8ZQW61.mjs";
2
+ import { n as defineMethodRegistrations } from "./bind-helpers-ClV34xdn.mjs";
3
+ import { t as sharedStateBoardTools } from "./definitions-DYVjOtxa.mjs";
4
+ import { resolve } from "node:path";
5
+ //#region src/server/domains/shared-state-board/manifest.ts
6
+ const DOMAIN = "shared-state-board";
7
+ const DEP_KEY = "sharedStateBoardHandlers";
8
+ const registrations = defineMethodRegistrations({
9
+ domain: DOMAIN,
10
+ depKey: DEP_KEY,
11
+ lookup: toolLookup(sharedStateBoardTools),
12
+ entries: [
13
+ {
14
+ tool: "state_board",
15
+ method: "handleDispatch"
16
+ },
17
+ {
18
+ tool: "state_board_watch",
19
+ method: "handleWatchDispatch"
20
+ },
21
+ {
22
+ tool: "state_board_io",
23
+ method: "handleIODispatch"
24
+ }
25
+ ]
26
+ });
27
+ async function ensure(ctx) {
28
+ const { SharedStateBoardHandlers } = await import("./shared-state-board-BoZnSoj-.mjs");
29
+ if (!ctx.sharedStateBoardHandlers) ctx.sharedStateBoardHandlers = new SharedStateBoardHandlers();
30
+ const scheduler = ctx.getDomainInstance("snapshotScheduler");
31
+ const stateDir = ctx.getDomainInstance("snapshotStateDir");
32
+ ctx.sharedStateBoardHandlers.setPersistNotifier(scheduler ? () => scheduler.notifyDirty() : void 0);
33
+ if (scheduler && stateDir && !ctx.getDomainInstance("sharedStateBoardSnapshotRegistered")) {
34
+ scheduler.register(resolve(stateDir, "state-board", "current.json"), ctx.sharedStateBoardHandlers.getStore());
35
+ ctx.setDomainInstance("sharedStateBoardSnapshotRegistered", true);
36
+ }
37
+ return ctx.sharedStateBoardHandlers;
38
+ }
39
+ const manifest = {
40
+ kind: "domain-manifest",
41
+ version: 1,
42
+ domain: DOMAIN,
43
+ depKey: DEP_KEY,
44
+ profiles: ["workflow", "full"],
45
+ ensure,
46
+ registrations
47
+ };
48
+ //#endregion
49
+ export { manifest as default };
@@ -0,0 +1,82 @@
1
+ import { n as toolLookup } from "./registry-Bl8ZQW61.mjs";
2
+ import { n as defineMethodRegistrations } from "./bind-helpers-ClV34xdn.mjs";
3
+ import { t as wasmTools } from "./definitions-BEoYofW5.mjs";
4
+ //#region src/server/domains/wasm/manifest.ts
5
+ const DOMAIN = "wasm";
6
+ const DEP_KEY = "wasmHandlers";
7
+ const registrations = defineMethodRegistrations({
8
+ domain: DOMAIN,
9
+ depKey: DEP_KEY,
10
+ lookup: toolLookup(wasmTools),
11
+ entries: [
12
+ {
13
+ tool: "wasm_capabilities",
14
+ method: "handleWasmCapabilities"
15
+ },
16
+ {
17
+ tool: "wasm_dump",
18
+ method: "handleWasmDump"
19
+ },
20
+ {
21
+ tool: "wasm_disassemble",
22
+ method: "handleWasmDisassemble"
23
+ },
24
+ {
25
+ tool: "wasm_decompile",
26
+ method: "handleWasmDecompile"
27
+ },
28
+ {
29
+ tool: "wasm_inspect_sections",
30
+ method: "handleWasmInspectSections"
31
+ },
32
+ {
33
+ tool: "wasm_offline_run",
34
+ method: "handleWasmOfflineRun"
35
+ },
36
+ {
37
+ tool: "wasm_optimize",
38
+ method: "handleWasmOptimize"
39
+ },
40
+ {
41
+ tool: "wasm_vmp_trace",
42
+ method: "handleWasmVmpTrace"
43
+ },
44
+ {
45
+ tool: "wasm_memory_inspect",
46
+ method: "handleWasmMemoryInspect"
47
+ },
48
+ {
49
+ tool: "wasm_to_c",
50
+ method: "handleWasmToC"
51
+ },
52
+ {
53
+ tool: "wasm_detect_obfuscation",
54
+ method: "handleWasmDetectObfuscation"
55
+ },
56
+ {
57
+ tool: "wasm_instrument_trace",
58
+ method: "handleWasmInstrumentTrace"
59
+ }
60
+ ]
61
+ });
62
+ async function ensure(ctx) {
63
+ const { CodeCollector } = await import("./modules-tZozf0LQ.mjs").then((n) => n.t);
64
+ const { WasmToolHandlers } = await import("./wasm-BYx5UOeG.mjs");
65
+ if (!ctx.collector) {
66
+ ctx.collector = new CodeCollector(ctx.config.puppeteer);
67
+ ctx.registerCaches();
68
+ }
69
+ if (!ctx.wasmHandlers) ctx.wasmHandlers = new WasmToolHandlers(ctx.collector);
70
+ return ctx.wasmHandlers;
71
+ }
72
+ const manifest = {
73
+ kind: "domain-manifest",
74
+ version: 1,
75
+ domain: DOMAIN,
76
+ depKey: DEP_KEY,
77
+ profiles: ["full"],
78
+ ensure,
79
+ registrations
80
+ };
81
+ //#endregion
82
+ export { manifest as default };