@jshookmcp/jshook 0.2.9 → 0.3.1

package/README.md

@@ -1,27 +1,24 @@
 # @jshookmcp/jshook
 
 [![License: AGPLv3](https://img.shields.io/badge/License-AGPLv3-red.svg)](LICENSE)
-[![Node.js 20.19+ or 22.12+](https://img.shields.io/badge/node-20.19%2B%20%7C%2022.12%2B-brightgreen.svg)](https://nodejs.org/)
-[![TypeScript](https://img.shields.io/badge/TypeScript-5.x-3178C6.svg)](https://www.typescriptlang.org/)
+[![Node.js 22.12+](https://img.shields.io/badge/node-22.12%2B-brightgreen.svg)](https://nodejs.org/)
+[![TypeScript](https://img.shields.io/badge/TypeScript-strict-3178C6.svg)](https://www.typescriptlang.org/)
 [![MCP](https://img.shields.io/badge/MCP-current-8A2BE2.svg)](https://modelcontextprotocol.io/)
 [![pnpm](https://img.shields.io/badge/pnpm-10.x-F69220.svg)](https://pnpm.io/)
 
 English | [中文](./README.zh.md)
 
-An MCP (Model Context Protocol) server with a runtime-registry-driven catalog of built-in tools for AI-assisted JavaScript analysis and security analysis. It combines browser automation, Chrome DevTools Protocol debugging, network monitoring, intelligent JavaScript hooks, LLM-powered code analysis, process and memory inspection, WASM tooling, source-map reconstruction, AST transforms, and composite workflows in a single server.
+An MCP server that gives AI agents **402 tools across 36 domains** for JavaScript analysis and security research — browser automation, CDP debugging, network interception, JS hooks, LLM-powered code analysis, process/memory forensics, WASM reverse engineering, source-map reconstruction, AST transforms, and composite workflows in a single server.
 
-## Documentation / Quick Links
+## Quick Links
 
-- **[📖 Read the Documentation](https://vmoranv.github.io/jshookmcp/)**
-- **[🚀 Getting Started](https://vmoranv.github.io/jshookmcp/guide/getting-started.html)**
-- **[⚙️ Configuration](https://vmoranv.github.io/jshookmcp/guide/configuration.html)**
-- **[📚 Tool Reference](https://vmoranv.github.io/jshookmcp/reference/)**
+- **[📖 Documentation](https://vmoranv.github.io/jshookmcp/)** · **[🚀 Getting Started](https://vmoranv.github.io/jshookmcp/guide/getting-started.html)** · **[⚙️ Configuration](https://vmoranv.github.io/jshookmcp/guide/configuration.html)** · **[📚 Tool Reference](https://vmoranv.github.io/jshookmcp/reference/)**
 
 ## 🚀 Quick Start
 
-Use jshookmcp instantly with Claude Desktop or Cursor without installing anything globally.
+No global install needed — add to your MCP client config and you're ready:
 
-**Claude Desktop Configuration (`claude_desktop_config.json`)**:
+**Claude Desktop / Cursor (`claude_desktop_config.json`)**:
 
 ```json
 {
@@ -29,59 +26,39 @@ Use jshookmcp instantly with Claude Desktop or Cursor without installing anythin
     "jshook": {
       "command": "npx",
       "args": ["-y", "@jshookmcp/jshook@latest"],
-      "env": {
-        "JSHOOK_BASE_PROFILE": "search"
-      }
+      "env": { "JSHOOK_BASE_PROFILE": "search" }
     }
   }
 }
 ```
 
-*(Note for Windows users: If `npx` is not found, specify the absolute path to `npx.cmd`)*
+*(Windows: use `npx.cmd` absolute path if `npx` is not found)*
 
-## 🌟 Key Highlights
+## 🌟 Highlights
 
-- 🤖 **AI-Driven Analysis**: Leverage LLMs for intelligent JavaScript deobfuscation, cryptographic algorithm detection, and AST-level code comprehension.
-- ⚡ **Search-First Context Efficiency**: BM25-powered `search_tools` + dynamic boosts cut jshook's tool-schema init delta from ~40.0K+ tokens (`full`) to ~3.0K (`search`) (Claude server-side count; excludes Claude Code base prompt).
-- 🎯 **Progressive Capability Tiers**: Three built-in profiles (`search`/`workflow`/`full`), with `search` as the default base tier for on-demand capability scaling.
-- 🌐 **Full-Stack Automation**: Seamlessly orchestrate Chromium/Camoufox browsers, CDP debugging, and network interception as atomic actions.
-- 🛡️ **Advanced Anti-Debug**: Built-in evasion for debugger statements, timing checks, and strict headless bot fingerprinting techniques.
-- 🧩 **Dynamic Extensibility**: Hot-reload plugins and workflows from local directories without recompiling the core server.
-- 🔧 **Zero-Wiring Extensibility**: Auto-discovered domains via `manifest.ts`, lazy handler instantiation, and B-Skeleton contracts for plugins/workflows.
-- 🛠️ **Reverse Engineering Toolchain**: Integrated WASM disassembly, binary entropy analysis, in-memory scanning, and bridges for Burp Suite/Ghidra/IDA Pro.
+- 🤖 **AI-Driven Analysis** — LLM-powered deobfuscation, crypto detection, AST comprehension
+- ⚡ **Search-First Context Efficiency** — `search` profile ≈ 3K tokens vs `full` ≈ 40K+ tokens
+- 🎯 **Progressive Tiers** — `search` → `workflow` → `full`, activate on demand
+- 🌐 **Full-Stack Browser Automation** — Chromium/Camoufox + CDP + anti-detection + CAPTCHA handling
+- 📡 **Network Interception** — HTTP/2 frame building, MiTM capture, GraphQL, Burp Suite bridge
+- 🛠️ **Reverse Engineering Toolchain** — WASM disassembly, binary analysis, Frida, Ghidra/IDA bridges
+- 🧰 **Process & Memory Forensics** — Native FFI scanning, hardware breakpoints, PE introspection
+- 🧩 **Dynamic Extensibility** — Hot-reload plugins, declarative workflows, auto-discovered domains
 
-## 🛡️ Core Capabilities
+## Architecture
 
-JSHookMCP exposes **360+ atomic tools** across 36 domains, empowering AI orchestrators with unparalleled capabilities:
-
-- 🕸️ **Browser Automation & Reverse Engineering**: Zero-config Chromium/Camoufox injection, CDP (Chrome DevTools Protocol) orchestration, and iframe evaluation bypasses.
-- 📡 **Network Interception & Spoofing**: Deep HTTP/2 frame building, MiTM traffic capture, GraphQL introspection, and Burp Suite bridge.
-- 🧠 **AST & Semantic Analysis**: LLM-powered deobfuscation, WebAssembly (WASM) disassembly, Source Map reconstruction, and binary entropy visualization.
-- 🧰 **Process & Memory Forensics**: Native Frida instrumentation, memory scanning, pointer dereferencing, and strict Anti-Debug mitigation.
-- 🔌 **Dynamic Extensibility**: Hot-reloadable B-Skeleton plugins and declarative `WorkflowContract` pipelines.
-
-> **[View the complete 36-domain tool catalog ↗](https://vmoranv.github.io/jshookmcp/reference/)**
-
-## Architecture & Performance
-
-> [!TIP]
-> **Context Efficiency Benchmark**: Built-in tool-schema init delta (Claude server-side count): `search` ≈ 3.0K tokens vs `full` ≈ 40.0K+ tokens.
-
-- **Progressive Tool Discovery**: `search_tools` meta-tool (BM25 ranking) + `activate_tools` / `activate_domain` + profile-based tier upgrades (`boost_profile`)
-- **Search-tier behavior**: `search_tools` only searches and ranks results; it does not auto-run `activate_tools`, and it does not auto-run `boost_profile`. Preferred chain: `search_tools -> activate_tools / activate_domain -> boost_profile only when needed`
-- **Do not boost for one tool**: `activate_tools` can register exact tools across tiers from the current base tier; `boost_profile` is better when you expect to reuse a broad family of related tools repeatedly
-- **Lazy Domain Initialization**: Handler classes instantiated via Proxy on first invocation, not during startup
-- **Domain Self-Discovery**: Runtime manifest scanning (`domains/*/manifest.ts`) replaces hardcoded imports; add new domains by creating a single manifest file
-- **B-Skeleton Contracts**: Extensibility contracts for plugins (`PluginContract`), workflows (`WorkflowContract`), and observability (`InstrumentationContract`)
-- **MCP ToolAnnotations**: Every tool carries semantic annotations (`readOnlyHint`, `destructiveHint`, `idempotentHint`, `openWorldHint`) enabling AI orchestrators to reason about tool safety and side-effects before invocation
+- **Runtime Registry** — Domains auto-discovered via `manifest.ts`; add a domain by creating one file
+- **Lazy Initialization** — Handlers instantiated on first call, not at startup
+- **BM25 + Vector Search** — `search_tools` meta-tool with hybrid ranking and adaptive weights
+- **MCP ToolAnnotations** — Every tool carries `readOnlyHint` / `destructiveHint` / `idempotentHint` / `openWorldHint`
 
 ## Registry Snapshot
 
 The built-in surface below is generated from the runtime registry and checked in CI.
 
 <!-- metadata-sync:start -->
-- Package version: `0.2.9`
-- Built-in Tools: `364`
+- Package version: `0.3.1`
+- Built-in Tools: `402`
 - Domains: `adb-bridge`, `antidebug`, `binary-instrument`, `boringssl-inspector`, `browser`, `canvas`, `coordination`, `core`, `cross-domain`, `debugger`, `encoding`, `evidence`, `extension-registry`, `graphql`, `hooks`, `instrumentation`, `macro`, `maintenance`, `memory`, `mojo-ipc`, `network`, `platform`, `process`, `protocol-analysis`, `proxy`, `sandbox`, `shared-state-board`, `skia-capture`, `sourcemap`, `streaming`, `syscall-hook`, `trace`, `transform`, `v8-inspector`, `wasm`, `workflow`
 - Note: this snapshot is generated from the runtime registry; do not edit the counts by hand.
 <!-- metadata-sync:end -->
@@ -92,8 +69,6 @@ The built-in surface below is generated from the runtime registry and checked in
 
 <div align="center">
 
-## Star History
-
 <a href="https://www.star-history.com/?repos=vmoranv%2Fjshookmcp&type=date&legend=top-left">
  <picture>
    <source media="(prefers-color-scheme: dark)" srcset="https://api.star-history.com/image?repos=vmoranv/jshookmcp&type=date&legend=top-left" />

package/README.zh.md

@@ -1,27 +1,24 @@
 # @jshookmcp/jshook
 
 [![License: AGPLv3](https://img.shields.io/badge/License-AGPLv3-red.svg)](LICENSE)
-[![Node.js 20.19+ or 22.12+](https://img.shields.io/badge/node-20.19%2B%20%7C%2022.12%2B-brightgreen.svg)](https://nodejs.org/)
-[![TypeScript](https://img.shields.io/badge/TypeScript-5.x-3178C6.svg)](https://www.typescriptlang.org/)
+[![Node.js 22.12+](https://img.shields.io/badge/node-22.12%2B-brightgreen.svg)](https://nodejs.org/)
+[![TypeScript](https://img.shields.io/badge/TypeScript-strict-3178C6.svg)](https://www.typescriptlang.org/)
 [![MCP](https://img.shields.io/badge/MCP-current-8A2BE2.svg)](https://modelcontextprotocol.io/)
 [![pnpm](https://img.shields.io/badge/pnpm-10.x-F69220.svg)](https://pnpm.io/)
 
 [English](./README.md) | 中文
 
-面向 AI 辅助 JavaScript 分析与安全分析的 MCP（模型上下文协议）服务器，内置工具面来自运行时 registry，而不是手写清单。它将浏览器自动化、Chrome DevTools Protocol 调试、网络监控、JavaScript Hook、LLM 驱动代码分析、进程与内存检查、WASM 工具链、Source Map 重建、AST 变换与复合工作流整合到同一服务中。
+为 AI 赋予 **36 个技术域、402 个原子工具** 的 JavaScript 分析与安全研究 MCP 服务器——浏览器自动化、CDP 调试、网络拦截、JS Hook、LLM 代码分析、进程/内存取证、WASM 逆向、Source Map 重建、AST 变换与复合工作流，一应俱全。
 
-## 文档与快速导航
+## 快速导航
 
-- **[📖 阅读官方文档](https://vmoranv.github.io/jshookmcp/)**
-- **[🚀 快速开始](https://vmoranv.github.io/jshookmcp/guide/getting-started.html)**
-- **[⚙️ 配置指南](https://vmoranv.github.io/jshookmcp/guide/configuration.html)**
-- **[📚 API 与工具参考](https://vmoranv.github.io/jshookmcp/reference/)**
+- **[📖 官方文档](https://vmoranv.github.io/jshookmcp/)** · **[🚀 快速开始](https://vmoranv.github.io/jshookmcp/guide/getting-started.html)** · **[⚙️ 配置指南](https://vmoranv.github.io/jshookmcp/guide/configuration.html)** · **[📚 工具参考](https://vmoranv.github.io/jshookmcp/reference/)**
 
-## 🚀 快速接入 (Quick Start)
+## 🚀 快速接入
 
-无需全局安装任何环境，使用 `npx` 即可让 Claude Desktop 或 Cursor 瞬间获得强大的全双工安全分析能力。
+无需全局安装，添加到 MCP 客户端配置即可使用：
 
-**Claude Desktop 配置 (`claude_desktop_config.json`)**:
+**Claude Desktop / Cursor (`claude_desktop_config.json`)**：
 
 ```json
 {
@@ -29,59 +26,39 @@
     "jshook": {
       "command": "npx",
       "args": ["-y", "@jshookmcp/jshook@latest"],
-      "env": {
-        "JSHOOK_BASE_PROFILE": "search"
-      }
+      "env": { "JSHOOK_BASE_PROFILE": "search" }
     }
   }
 }
 ```
 
-*(Windows 用户注意: 若报错找不到 npx，请指定为绝对路径 `npx.cmd`)*
+*(Windows 用户：若找不到 `npx`，请使用 `npx.cmd` 绝对路径)*
 
 ## 🌟 核心亮点
 
-- 🤖 **AI 智能分析**：结合大语言模型实现 JavaScript 语义级反混淆、加密算法识别与深度 AST 结构理解。
-- ⚡ **搜索优先的上下文效率**：BM25 驱动的 `search_tools` 配合动态加权，可将 jshook 内置配置档位中的“工具 schema 增量初始化上下文”从 `full` 档约 ~40.0K+ tokens 降至 `search` 档约 ~3.0K（Claude 服务端计数；不含 Claude Code 基线提示词）。
-- 🎯 **渐进式能力分层**：内置三档配置（`search`/`workflow`/`full`），默认从 `search` 基座档启动，按需升级能力范围。
-- 🌐 **全链路自动化**：将浏览器环境（Chromium/Camoufox）、CDP 底层调试与网络拦截无缝整合为原子操作。
-- 🛡️ **高级反反调试**：内置强大的指纹伪装与检测绕过补丁，轻松应对各类反爬与调试器对抗保护。
-- 🧩 **动态热插拔扩展**：支持从本地目录动态加载插件与高层工作流，无需重新编译主服务即可无限横向拓展能力。
-- 🔧 **零胶水扩展性**：通过 `manifest.ts` 自动发现域、懒加载处理器实例化、B-Skeleton 契约驱动的插件/工作流架构。
-- 🛠️ **全能逆向工具链**：集成 WASM 反编译、二进制漏洞/熵分析、实时内存扫描，并原生提供 Burp Suite 与 Ghidra/IDA Pro 桥接。
+- 🤖 **AI 智能分析** — LLM 驱动的 JS 反混淆、加密识别、AST 深度理解
+- ⚡ **搜索优先** — `search` 档 ≈ 3K tokens vs `full` 档 ≈ 40K+ tokens，按需加载
+- 🎯 **渐进分层** — `search` → `workflow` → `full`，按需激活
+- 🌐 **全栈浏览器自动化** — Chromium/Camoufox + CDP + 反检测 + CAPTCHA 处理
+- 📡 **网络拦截** — HTTP/2 帧构造、MiTM 捕获、GraphQL、Burp Suite 桥接
+- 🛠️ **全能逆向工具链** — WASM 反编译、二进制分析、Frida、Ghidra/IDA 桥接
+- 🧰 **进程与内存取证** — 原生 FFI 扫描、硬件断点、PE 内省
+- 🧩 **动态热插拔** — 热重载插件、声明式工作流、自发现域
 
-## 🛡️ 核心能力矩阵
+## 架构
 
-JSHookMCP 跨 36 个技术域提供了 **360+ 个内置原子工具**，赋予 AI 前所未有的能力栈：
-
-- 🕸️ **浏览器自动化与逆向**：零配置注入 Chromium/Camoufox，接管 CDP (Chrome DevTools Protocol) 编排，支持 iframe 跨域突破。
-- 📡 **网络拦截与流量嗅探**：深度 HTTP/2 帧构造、中间人 (MiTM) 流量捕获、GraphQL 内省嗅探以及 Burp Suite 无缝桥接。
-- 🧠 **AST 与语义分析**：大模型驱动的代码反混淆、WebAssembly (WASM) 实时反编译、Source Map 重建以及二进制熵值可视化。
-- 🧰 **进程与内存剖析**：系统级 Frida hook 注入、内存地址扫描挖掘、指针解引用以及严苛的反反调试 (Anti-Debug) 对抗。
-- 🔌 **动态扩展性引擎**：支持热重载的 B-Skeleton 插件系统与声明式 `WorkflowContract` 业务流管线。
-
-> **[查看完整的 36 个能力域与工具参考 ↗](https://vmoranv.github.io/jshookmcp/reference/)**
-
-## 架构与性能
-
-> [!TIP]
-> **上下文效率基准 (Context Efficiency Benchmark)**：基于 Claude 服务端实测，“Schema 初始化 Context 增量” —— `search` 档 ≈ 3.0K tokens vs `full` 档 ≈ 40.0K+ tokens。
-
-- **渐进式工具发现**：`search_tools` 元工具（BM25 排序）+ `activate_tools` / `activate_domain` + 配置档位升级（`boost_profile`）
-- **search 档行为说明**：`search_tools` 只负责检索与排序，不会自动 `activate_tools`，也不会自动 `boost_profile`；推荐链路是 `search_tools -> activate_tools / activate_domain -> （确有需要时）boost_profile`
-- **单工具不必先升档**：`activate_tools` 可跨当前基座档精确启用单个工具；只有在你接下来会反复使用一整组相关能力时，`boost_profile` 才更合适
-- **域延迟初始化**：处理器类通过 Proxy 在首次调用时实例化，而非启动时预加载
-- **域自发现架构**：运行时扫描 `domains/*/manifest.ts` 替代硬编码导入；新增域只需创建一个 manifest 文件
-- **B-Skeleton 契约**：插件（`PluginContract`）、工作流（`WorkflowContract`）、可观测性（`InstrumentationContract`）的扩展性契约
-- **MCP ToolAnnotations**：每个工具均带有语义标注（`readOnlyHint`、`destructiveHint`、`idempotentHint`、`openWorldHint`），使 AI 协调器能在调用前推理工具安全性与副作用
+- **运行时注册表** — 域通过 `manifest.ts` 自发现；新增域只需创建一个文件
+- **延迟初始化** — Handler 在首次调用时实例化，而非启动时预加载
+- **BM25 + 向量搜索** — `search_tools` 混合排序 + 自适应权重
+- **MCP ToolAnnotations** — 每个工具携带 `readOnlyHint` / `destructiveHint` / `idempotentHint` / `openWorldHint`
 
 ## 注册表快照
 
 下面的内置能力快照由运行时 registry 动态生成，并在 CI 中校验。
 
 <!-- metadata-sync:start -->
-- 包版本：`0.2.9`
-- 内置工具数：`364`
+- 包版本：`0.3.1`
+- 内置工具数：`402`
 - 域列表：`adb-bridge`, `antidebug`, `binary-instrument`, `boringssl-inspector`, `browser`, `canvas`, `coordination`, `core`, `cross-domain`, `debugger`, `encoding`, `evidence`, `extension-registry`, `graphql`, `hooks`, `instrumentation`, `macro`, `maintenance`, `memory`, `mojo-ipc`, `network`, `platform`, `process`, `protocol-analysis`, `proxy`, `sandbox`, `shared-state-board`, `skia-capture`, `sourcemap`, `streaming`, `syscall-hook`, `trace`, `transform`, `v8-inspector`, `wasm`, `workflow`
 - 说明：以上数据由运行时 registry 动态生成，不要手改计数。
 <!-- metadata-sync:end -->

package/dist/AntiCheatDetector-CGVGNfy5.mjs

@@ -0,0 +1 @@
+import{t as e}from"./logger-sBC6IdRT.mjs";import{a as t,b as n,d as r,h as i,i as a,n as o,s,t as c,u as l}from"./Win32API-Bhi5xFBe.mjs";import{PEAnalyzer as u}from"./PEAnalyzer-DJyaJTQJ.mjs";import{createHash as d}from"node:crypto";import{promises as f}from"node:fs";const p=[{dll:`kernel32.dll`,funcs:[{name:`IsDebuggerPresent`,mechanism:`anti_debug_api`,confidence:`high`,bypass:`Hook IsDebuggerPresent to return 0, or patch PEB.BeingDebugged field`},{name:`CheckRemoteDebuggerPresent`,mechanism:`anti_debug_api`,confidence:`high`,bypass:`Hook CheckRemoteDebuggerPresent to set output to FALSE and return TRUE`},{name:`OutputDebugStringA`,mechanism:`exception_based`,confidence:`low`,bypass:`May be used for anti-debug timing — monitor for exception handler abuse`},{name:`GetTickCount`,mechanism:`timing_check`,confidence:`low`,bypass:`Hook GetTickCount to return consistent delta values`},{name:`GetTickCount64`,mechanism:`timing_check`,confidence:`low`,bypass:`Hook GetTickCount64 to return consistent delta values`},{name:`QueryPerformanceCounter`,mechanism:`timing_check`,confidence:`medium`,bypass:`Hook QPC to filter out debugging time deltas`}]},{dll:`ntdll.dll`,funcs:[{name:`NtQueryInformationProcess`,mechanism:`ntquery_debug`,confidence:`high`,bypass:`Hook NtQueryInformationProcess: return 0 for ProcessDebugPort (7), ProcessDebugObjectHandle (30), ProcessDebugFlags (31)`},{name:`NtSetInformationThread`,mechanism:`thread_hiding`,confidence:`medium`,bypass:`Hook NtSetInformationThread: intercept ThreadHideFromDebugger (0x11) calls`},{name:`NtClose`,mechanism:`exception_based`,confidence:`low`,bypass:`NtClose with invalid handle detects debugger via exception — hook to suppress`},{name:`RtlGetNtGlobalFlags`,mechanism:`heap_flags`,confidence:`medium`,bypass:`Clear NtGlobalFlag (FLG_HEAP_*) in PEB at offset 0xBC (x64)`}]}],m=[`GetThreadContext`,`SetThreadContext`],h={guardPageMaxRegions:2e4,guardPageTimeoutMs:2e3,integrityMaxModules:32,integrityMaxSections:128,integrityMaxBytes:16*1024*1024,integrityMaxSectionBytes:2*1024*1024,integrityTimeoutMs:3e3};var g=class{peAnalyzer=new u;options;constructor(e={}){this.options={...h,...e}}async detect(t){let r=[],i=n(t);try{let n=this.enumerateModules(i);for(let i of n)try{let e=await this.peAnalyzer.parseImports(t,i.base);for(let t of e){let e=t.dllName.toLowerCase();for(let n of p)if(e.includes(n.dll.toLowerCase().replace(`.dll`,``)))for(let e of n.funcs)t.functions.some(t=>t.name===e.name)&&r.push({mechanism:e.mechanism,confidence:e.confidence,location:`import:${e.name}`,moduleName:i.name,details:`${i.name} imports ${e.name} from ${t.dllName}`,bypassSuggestion:e.bypass});for(let e of t.functions)m.includes(e.name)&&r.push({mechanism:`hardware_breakpoint`,confidence:`medium`,location:`import:${e.name}`,moduleName:i.name,details:`${i.name} imports ${e.name} — may check debug registers for hardware breakpoints`,bypassSuggestion:`Hook GetThreadContext to zero out DR0-DR3 and DR6/DR7 before returning`})}}catch(t){e.debug(`Import scan skipped for ${i.name}: ${t}`)}}finally{c(i)}return r}async findGuardPages(e){return(await this.scanGuardPages(e)).guardPages}async scanGuardPages(e){let t=[],r=n(e),a=Date.now(),o={scannedRegions:0,queryFailures:0,durationMs:0,timedOut:!1,truncated:!1,maxRegions:this.options.guardPageMaxRegions,timeoutMs:this.options.guardPageTimeoutMs};try{let e=this.enumerateModules(r),n=0n;for(;n<140737488355327n;){if(this.isTimedOut(a,o.timeoutMs)){o.timedOut=!0,o.truncated=!0;break}if(o.scannedRegions>=o.maxRegions){o.truncated=!0;break}try{let a=i(r,n);if(!a.success)break;let s=a.info,c=s.BaseAddress+s.RegionSize;if(o.scannedRegions+=1,(s.Protect&l.GUARD)!==0){let n=null;for(let t of e){let e=BigInt(t.base);if(s.BaseAddress>=e&&s.BaseAddress<e+BigInt(t.size)){n=t.name;break}}t.push({address:`0x${s.BaseAddress.toString(16)}`,size:Number(s.RegionSize),moduleName:n,nearbySymbol:null})}if(s.RegionSize<=0n||c<=n||c<=s.BaseAddress){o.truncated=!0;break}n=c}catch{o.queryFailures+=1,n+=4096n}}}finally{o.durationMs=Date.now()-a,c(r)}return{guardPages:t,stats:o}}async checkIntegrity(e,t){return(await this.scanIntegrity(e,t)).sections}async scanIntegrity(t,i){let a=[],o=n(t),s=Date.now(),l={scannedModules:0,scannedSections:0,hashedBytes:0,skippedModules:0,skippedSections:0,durationMs:0,timedOut:!1,truncated:!1,maxModules:this.options.integrityMaxModules,maxSections:this.options.integrityMaxSections,maxBytes:this.options.integrityMaxBytes,timeoutMs:this.options.integrityTimeoutMs},u=!1;try{let n=this.enumerateModules(o),c=i?n.filter(e=>e.name.toLowerCase().includes(i.toLowerCase())):n;for(let n of c){if(this.shouldStopIntegrityScan(l,s)){this.isTimedOut(s,l.timeoutMs)&&(l.timedOut=!0),l.truncated=!0;break}l.scannedModules+=1;try{let e=await f.readFile(n.path),i=await this.peAnalyzer.listSections(t,n.base);for(let t of i){if(this.shouldStopIntegrityScan(l,s)){this.isTimedOut(s,l.timeoutMs)&&(l.timedOut=!0),l.truncated=!0,u=!0;break}if(!t.isExecutable)continue;let i=parseInt(t.virtualAddress,16),c=Math.min(t.virtualSize,t.rawSize);if(c<=0)continue;if(c>this.options.integrityMaxSectionBytes){l.skippedSections+=1;continue}if(l.hashedBytes+c>l.maxBytes){l.truncated=!0,u=!0;break}let f=r(o,BigInt(n.base)+BigInt(i),c),p=this.rvaToFileOffset(e,i);if(p<0||p+c>e.length)continue;let m=e.subarray(p,p+c),h=d(`sha256`).update(f).digest(`hex`),g=d(`sha256`).update(m).digest(`hex`);a.push({sectionName:t.name,moduleName:n.name,diskHash:g,memoryHash:h,isModified:h!==g}),l.scannedSections+=1,l.hashedBytes+=c}}catch(t){l.skippedModules+=1,e.debug(`Integrity check skipped for ${n.name}: ${t}`)}if(u)break}}finally{l.durationMs=Date.now()-s,c(o)}return{sections:a,stats:l}}enumerateModules(n){let r=[];try{let{modules:e,count:i}=o(n);for(let o=0;o<i;o++){let i=e[o],c=a(n,i),l=s(n,i),u=t(n,i)??c;l.success&&r.push({name:c,base:`0x${l.info.lpBaseOfDll.toString(16)}`,path:u,size:l.info.SizeOfImage})}}catch(t){e.debug(`Module enumeration failed: ${t}`)}return r}rvaToFileOffset(e,t){let n=e.readUInt32LE(60),r=e.readUInt16LE(n+6),i=e.readUInt16LE(n+20),a=n+24+i;for(let n=0;n<r;n++){let r=a+n*40;if(r+40>e.length)break;let i=e.readUInt32LE(r+12),o=e.readUInt32LE(r+8),s=e.readUInt32LE(r+20);if(t>=i&&t<i+o)return s+(t-i)}return-1}isTimedOut(e,t){return Date.now()-e>=t}shouldStopIntegrityScan(e,t){return this.isTimedOut(t,e.timeoutMs)||e.scannedModules>=e.maxModules||e.scannedSections>=e.maxSections||e.hashedBytes>=e.maxBytes}};const _=new g;export{g as AntiCheatDetector,_ as antiCheatDetector};

package/dist/CacheAdapters-CdAxBmVW.mjs

@@ -0,0 +1 @@
+var e=class{manager;name=`DetailedDataManager`;constructor(e){this.manager=e}getStats(){let e=this.manager.getStats();return{entries:e.cacheSize,size:this.estimateSize(e.cacheSize),hits:0,misses:0,ttl:e.defaultTTLSeconds*1e3,maxSize:e.maxCacheSize}}clear(){this.manager.clear()}estimateSize(e){return e*50*1024}},t=class{cache;name=`CodeCache`;constructor(e){this.cache=e}async getStats(){let e=await this.cache.getStats();return{entries:e.memoryEntries+e.diskEntries,size:e.totalSize,hits:0,misses:0}}async cleanup(){await this.cache.cleanup()}async clear(){await this.cache.clear()}},n=class{compressor;name=`CodeCompressor`;constructor(e){this.compressor=e}getStats(){let e=this.compressor.getStats(),t=this.compressor.getCacheSize(),n=e.cacheHits+e.cacheMisses,r=n>0?e.cacheHits/n:0;return{entries:t,size:this.estimateSize(t,e.totalCompressedSize),hits:e.cacheHits,misses:e.cacheMisses,hitRate:r}}clear(){this.compressor.clearCache()}estimateSize(e,t){return e===0?0:t/Math.max(1,e)*e}};function r(r,i,a){return[new e(r),new t(i),new n(a)]}export{r as createCacheAdapters};

package/dist/CodeInjector-BlgyqTOk.mjs

@@ -0,0 +1 @@
+import{A as e}from"./constants-Cp6hBrrx.mjs";import{t}from"./ToolError-DWU_z7gp.mjs";import{_ as n,b as r,d as i,f as a,h as o,l as s,m as c,p as l,t as u,u as d}from"./Win32API-Bhi5xFBe.mjs";import{l as f}from"./Win32Debug-CQteFL4F.mjs";import{n as p}from"./NativeMemoryManager.utils-DM4NC3FE.mjs";import{t as m}from"./NativeMemoryManager.impl-CI554XbY.mjs";import{randomUUID as h}from"node:crypto";var g=class{patches=new Map;async patchBytes(e,t,a){let o=BigInt(t.startsWith(`0x`)?t:`0x${t}`),s=Buffer.from(a),l=r(e,!0);try{let t=i(l,o,s.length),{success:r,oldProtect:u}=c(l,o,s.length,d.EXECUTE_READWRITE);n(l,o,s),f(l,o,s.length),r&&c(l,o,s.length,u);let p={id:h(),pid:e,address:`0x${o.toString(16).toUpperCase()}`,originalBytes:Array.from(t),patchBytes:a,isApplied:!0,timestamp:Date.now()};return this.patches.set(p.id,p),p}finally{u(l)}}async unpatch(e){let t=this.patches.get(e);if(!t?.isApplied)return!1;let i=BigInt(t.address),a=Buffer.from(t.originalBytes),o=r(t.pid,!0);try{let{oldProtect:e}=c(o,i,a.length,d.EXECUTE_READWRITE);return n(o,i,a),f(o,i,a.length),c(o,i,a.length,e),t.isApplied=!1,!0}finally{u(o)}}async nopBytes(e,t,n){let r=Array.from({length:n},()=>144);return this.patchBytes(e,t,r)}async findCodeCaves(t,n){let a=n??e,s=[],c=r(t,!1);try{let e=await m.enumerateModules(t);if(!e.success||!e.modules)return s;for(let t of e.modules){let e=BigInt(t.baseAddress.startsWith(`0x`)?t.baseAddress:`0x${t.baseAddress}`),n=e,r=e+BigInt(t.size);for(;n<r;){let{success:e,info:r}=o(c,n);if(!e||r.RegionSize===0n)break;let l=Number(r.RegionSize);if(p(r.Protect)&&l>0)try{let e=i(c,r.BaseAddress,Math.min(l,4*1024*1024)),n=-1;for(let i=0;i<e.length;i++){let o=e[i];if(o===0||o===204)n===-1&&(n=i);else if(n!==-1){let e=i-n;if(e>=a){let i=r.BaseAddress+BigInt(n);s.push({address:`0x${i.toString(16).toUpperCase()}`,size:e,module:t.name,section:`.text`})}n=-1}}if(n!==-1){let i=e.length-n;if(i>=a){let e=r.BaseAddress+BigInt(n);s.push({address:`0x${e.toString(16).toUpperCase()}`,size:i,module:t.name,section:`.text`})}}}catch{}n=r.BaseAddress+r.RegionSize}}}finally{u(c)}return s.toSorted((e,t)=>t.size-e.size)}async allocateRemote(e,n){let i=r(e,!0);try{let e=a(i,0n,n,s.COMMIT|s.RESERVE,d.EXECUTE_READWRITE);if(e===0n)throw new t(`RUNTIME`,`VirtualAllocEx failed`);return`0x${e.toString(16).toUpperCase()}`}finally{u(i)}}async freeRemote(e,t,n){let i=BigInt(t.startsWith(`0x`)?t:`0x${t}`),a=r(e,!0);try{return l(a,i,0,s.RELEASE)}finally{u(a)}}listPatches(){return Array.from(this.patches.values())}};const _=new g;export{g as CodeInjector,_ as codeInjector};