@jshookmcp/jshook 0.2.9 → 0.3.1

package/dist/PEAnalyzer-D1lzJ_VG.mjs

@@ -1,385 +0,0 @@
-import { t as logger } from "./logger-Dh_xb7_2.mjs";
-import { a as GetModuleFileNameEx, b as openProcessForMemory, d as ReadProcessMemory, i as GetModuleBaseName, n as EnumProcessModules, s as GetModuleInformation, t as CloseHandle } from "./Win32API-CePkipZY.mjs";
-import { promises } from "node:fs";
-//#region src/native/PEAnalyzer.types.ts
-/** PE section characteristic flags */
-const IMAGE_SCN = {
-	CNT_CODE: 32,
-	CNT_INITIALIZED_DATA: 64,
-	CNT_UNINITIALIZED_DATA: 128,
-	MEM_EXECUTE: 536870912,
-	MEM_READ: 1073741824,
-	MEM_WRITE: 2147483648
-};
-/** Data directory indices */
-const IMAGE_DIRECTORY_ENTRY = {
-	EXPORT: 0,
-	IMPORT: 1,
-	RESOURCE: 2,
-	EXCEPTION: 3,
-	IAT: 12,
-	DELAY_IMPORT: 13
-};
-//#endregion
-//#region src/native/PEAnalyzer.ts
-/**
-* PE Analyzer Engine.
-*
-* Parses PE headers from process memory using ReadProcessMemory.
-* Provides import/export table resolution, inline hook detection,
-* and section anomaly analysis.
-*
-* @module PEAnalyzer
-*/
-const MZ_MAGIC = 23117;
-const PE_SIGNATURE = 17744;
-const PE32PLUS_MAGIC = 523;
-const SECTION_HEADER_SIZE = 40;
-const IMPORT_DESCRIPTOR_SIZE = 20;
-const COMPARE_BYTES = 16;
-var PEAnalyzer = class {
-	/**
-	* Parse PE headers from a module's base address in process memory.
-	*/
-	async parseHeaders(pid, moduleBase) {
-		const base = BigInt(moduleBase);
-		const hProcess = openProcessForMemory(pid);
-		try {
-			const dosData = ReadProcessMemory(hProcess, base, 64);
-			const e_magic = dosData.readUInt16LE(0);
-			if (e_magic !== MZ_MAGIC) throw new Error(`Invalid DOS header: expected 0x5A4D, got 0x${e_magic.toString(16)}`);
-			const e_lfanew = dosData.readUInt32LE(60);
-			const ntData = ReadProcessMemory(hProcess, base + BigInt(e_lfanew), 264);
-			const ntSignature = ntData.readUInt32LE(0);
-			if (ntSignature !== PE_SIGNATURE) throw new Error(`Invalid PE signature: expected 0x4550, got 0x${ntSignature.toString(16)}`);
-			const machine = ntData.readUInt16LE(4);
-			const numberOfSections = ntData.readUInt16LE(6);
-			const timeDateStamp = ntData.readUInt32LE(8);
-			const characteristics = ntData.readUInt16LE(22);
-			const magic = ntData.readUInt16LE(24);
-			const isPE32Plus = magic === PE32PLUS_MAGIC;
-			let imageBase;
-			let entryPoint;
-			let sizeOfImage;
-			let numberOfRvaAndSizes;
-			if (isPE32Plus) {
-				entryPoint = ntData.readUInt32LE(40);
-				imageBase = ntData.readBigUInt64LE(48);
-				sizeOfImage = ntData.readUInt32LE(80);
-				numberOfRvaAndSizes = ntData.readUInt32LE(132);
-			} else {
-				entryPoint = ntData.readUInt32LE(40);
-				imageBase = BigInt(ntData.readUInt32LE(52));
-				sizeOfImage = ntData.readUInt32LE(80);
-				numberOfRvaAndSizes = ntData.readUInt32LE(116);
-			}
-			return {
-				dosHeader: {
-					e_magic,
-					e_lfanew
-				},
-				ntSignature,
-				fileHeader: {
-					machine,
-					numberOfSections,
-					timeDateStamp,
-					characteristics
-				},
-				optionalHeader: {
-					magic,
-					imageBase: `0x${imageBase.toString(16)}`,
-					entryPoint: `0x${entryPoint.toString(16)}`,
-					sizeOfImage,
-					numberOfRvaAndSizes
-				}
-			};
-		} finally {
-			CloseHandle(hProcess);
-		}
-	}
-	/**
-	* List all PE sections with permissions.
-	*/
-	async listSections(pid, moduleBase) {
-		const base = BigInt(moduleBase);
-		const hProcess = openProcessForMemory(pid);
-		try {
-			const headers = await this._readCoreHeaders(hProcess, base);
-			const sections = [];
-			for (let i = 0; i < headers.numSections; i++) {
-				const off = headers.firstSectionOffset + i * SECTION_HEADER_SIZE;
-				const secData = ReadProcessMemory(hProcess, base + BigInt(off), SECTION_HEADER_SIZE);
-				const nameEnd = secData.indexOf(0);
-				const name = secData.subarray(0, nameEnd > 0 && nameEnd <= 8 ? nameEnd : 8).toString("ascii");
-				const virtualSize = secData.readUInt32LE(8);
-				const virtualAddress = secData.readUInt32LE(12);
-				const rawSize = secData.readUInt32LE(16);
-				const chars = secData.readUInt32LE(36);
-				sections.push({
-					name,
-					virtualAddress: `0x${virtualAddress.toString(16)}`,
-					virtualSize,
-					rawSize,
-					characteristics: chars,
-					isExecutable: (chars & IMAGE_SCN.MEM_EXECUTE) !== 0,
-					isWritable: (chars & IMAGE_SCN.MEM_WRITE) !== 0,
-					isReadable: (chars & IMAGE_SCN.MEM_READ) !== 0
-				});
-			}
-			return sections;
-		} finally {
-			CloseHandle(hProcess);
-		}
-	}
-	/**
-	* Parse import table.
-	*/
-	async parseImports(pid, moduleBase) {
-		const base = BigInt(moduleBase);
-		const hProcess = openProcessForMemory(pid);
-		try {
-			const headers = await this._readCoreHeaders(hProcess, base);
-			const importRva = headers.dataDirectories[IMAGE_DIRECTORY_ENTRY.IMPORT];
-			if (!importRva || importRva.rva === 0) return [];
-			const imports = [];
-			let descOffset = importRva.rva;
-			for (let i = 0; i < 500; i++) {
-				const desc = ReadProcessMemory(hProcess, base + BigInt(descOffset), IMPORT_DESCRIPTOR_SIZE);
-				const nameRva = desc.readUInt32LE(12);
-				if (nameRva === 0) break;
-				const nameData = ReadProcessMemory(hProcess, base + BigInt(nameRva), 256);
-				const nullIdx = nameData.indexOf(0);
-				const dllName = nameData.subarray(0, nullIdx > 0 ? nullIdx : 256).toString("ascii");
-				const originalFirstThunkRva = desc.readUInt32LE(0) || desc.readUInt32LE(16);
-				const functions = this._readThunkArray(hProcess, base, originalFirstThunkRva, headers.isPE32Plus);
-				imports.push({
-					dllName,
-					functions
-				});
-				descOffset += IMPORT_DESCRIPTOR_SIZE;
-			}
-			return imports;
-		} finally {
-			CloseHandle(hProcess);
-		}
-	}
-	/**
-	* Parse export table.
-	*/
-	async parseExports(pid, moduleBase) {
-		const base = BigInt(moduleBase);
-		const hProcess = openProcessForMemory(pid);
-		try {
-			const exportDir = (await this._readCoreHeaders(hProcess, base)).dataDirectories[IMAGE_DIRECTORY_ENTRY.EXPORT];
-			if (!exportDir || exportDir.rva === 0) return [];
-			const expData = ReadProcessMemory(hProcess, base + BigInt(exportDir.rva), 40);
-			const numberOfNames = expData.readUInt32LE(24);
-			const addressOfFunctionsRva = expData.readUInt32LE(28);
-			const addressOfNamesRva = expData.readUInt32LE(32);
-			const addressOfNameOrdinalsRva = expData.readUInt32LE(36);
-			const ordinalBase = expData.readUInt32LE(16);
-			const exports = [];
-			const namesBuf = ReadProcessMemory(hProcess, base + BigInt(addressOfNamesRva), numberOfNames * 4);
-			const ordsBuf = ReadProcessMemory(hProcess, base + BigInt(addressOfNameOrdinalsRva), numberOfNames * 2);
-			for (let i = 0; i < Math.min(numberOfNames, 2e3); i++) {
-				const nameRva = namesBuf.readUInt32LE(i * 4);
-				const ordIndex = ordsBuf.readUInt16LE(i * 2);
-				const nameBuf = ReadProcessMemory(hProcess, base + BigInt(nameRva), 256);
-				const nullIdx = nameBuf.indexOf(0);
-				const name = nameBuf.subarray(0, nullIdx > 0 ? nullIdx : 256).toString("ascii");
-				const funcRva = ReadProcessMemory(hProcess, base + BigInt(addressOfFunctionsRva + ordIndex * 4), 4).readUInt32LE(0);
-				let forwardedTo = null;
-				if (funcRva >= exportDir.rva && funcRva < exportDir.rva + exportDir.size) {
-					const fwdBuf = ReadProcessMemory(hProcess, base + BigInt(funcRva), 256);
-					const fwdEnd = fwdBuf.indexOf(0);
-					forwardedTo = fwdBuf.subarray(0, fwdEnd > 0 ? fwdEnd : 256).toString("ascii");
-				}
-				exports.push({
-					name,
-					ordinal: ordinalBase + ordIndex,
-					rva: `0x${funcRva.toString(16)}`,
-					forwardedTo
-				});
-			}
-			return exports;
-		} finally {
-			CloseHandle(hProcess);
-		}
-	}
-	/**
-	* Detect inline hooks by comparing first bytes of exported functions (disk vs memory).
-	*/
-	async detectInlineHooks(pid, moduleName) {
-		const hProcess = openProcessForMemory(pid);
-		const detections = [];
-		try {
-			const modules = this._enumerateModulesInternal(hProcess);
-			const targets = moduleName ? modules.filter((m) => m.name.toLowerCase().includes(moduleName.toLowerCase())) : modules;
-			for (const mod of targets) try {
-				const diskData = await promises.readFile(mod.path);
-				const exports = await this.parseExports(pid, mod.base);
-				for (const exp of exports) {
-					const funcRva = parseInt(exp.rva, 16);
-					if (funcRva === 0 || exp.forwardedTo) continue;
-					const memBytes = ReadProcessMemory(hProcess, BigInt(mod.base) + BigInt(funcRva), COMPARE_BYTES);
-					const diskOffset = this._rvaToFileOffset(diskData, funcRva);
-					if (diskOffset < 0 || diskOffset + COMPARE_BYTES > diskData.length) continue;
-					const diskBytes = diskData.subarray(diskOffset, diskOffset + COMPARE_BYTES);
-					if (!memBytes.equals(diskBytes)) {
-						const hookType = this._classifyHook(memBytes);
-						const jumpTarget = this._decodeJumpTarget(memBytes, BigInt(mod.base) + BigInt(funcRva));
-						detections.push({
-							address: `0x${(BigInt(mod.base) + BigInt(funcRva)).toString(16)}`,
-							moduleName: mod.name,
-							functionName: exp.name,
-							originalBytes: Array.from(diskBytes),
-							currentBytes: Array.from(memBytes),
-							hookType,
-							jumpTarget
-						});
-					}
-				}
-			} catch (e) {
-				logger.debug(`Hook check skipped for ${mod.name}: ${e}`);
-			}
-		} finally {
-			CloseHandle(hProcess);
-		}
-		return detections;
-	}
-	/**
-	* Analyze sections for anomalies (RWX, writable code, etc.).
-	*/
-	async analyzeSections(pid, moduleBase) {
-		const sections = await this.listSections(pid, moduleBase);
-		const anomalies = [];
-		for (const sec of sections) if (sec.isReadable && sec.isWritable && sec.isExecutable) anomalies.push({
-			sectionName: sec.name,
-			anomalyType: "rwx",
-			severity: "high",
-			details: `Section ${sec.name} has Read+Write+Execute permissions — unusual and potentially malicious`
-		});
-		else if (sec.isWritable && sec.isExecutable) anomalies.push({
-			sectionName: sec.name,
-			anomalyType: "writable_code",
-			severity: "high",
-			details: `Section ${sec.name} is writable and executable — code may be self-modifying or packed`
-		});
-		else if (sec.isExecutable && !sec.name.startsWith(".text") && !sec.name.startsWith(".code") && (sec.characteristics & IMAGE_SCN.CNT_INITIALIZED_DATA) !== 0) anomalies.push({
-			sectionName: sec.name,
-			anomalyType: "executable_data",
-			severity: "medium",
-			details: `Data section ${sec.name} has execute permission`
-		});
-		return anomalies;
-	}
-	async _readCoreHeaders(hProcess, base) {
-		const e_lfanew = ReadProcessMemory(hProcess, base, 64).readUInt32LE(60);
-		const ntData = ReadProcessMemory(hProcess, base + BigInt(e_lfanew), 264);
-		const numSections = ntData.readUInt16LE(6);
-		const sizeOfOptionalHeader = ntData.readUInt16LE(20);
-		const isPE32Plus = ntData.readUInt16LE(24) === PE32PLUS_MAGIC;
-		const numberOfRvaAndSizes = isPE32Plus ? ntData.readUInt32LE(132) : ntData.readUInt32LE(116);
-		const dataDirectoriesOffset = isPE32Plus ? 136 : 120;
-		const dataDirectories = [];
-		for (let i = 0; i < Math.min(numberOfRvaAndSizes, 16); i++) {
-			const off = dataDirectoriesOffset + i * 8;
-			if (off + 8 <= ntData.length) dataDirectories.push({
-				rva: ntData.readUInt32LE(off),
-				size: ntData.readUInt32LE(off + 4)
-			});
-		}
-		return {
-			numSections,
-			isPE32Plus,
-			firstSectionOffset: e_lfanew + 4 + 20 + sizeOfOptionalHeader,
-			dataDirectories
-		};
-	}
-	_readThunkArray(hProcess, base, thunkRva, isPE32Plus) {
-		const thunkSize = isPE32Plus ? 8 : 4;
-		const functions = [];
-		const IMAGE_ORDINAL_FLAG = isPE32Plus ? 9223372036854775808n : 2147483648n;
-		for (let i = 0; i < 2e3; i++) {
-			const thunkData = ReadProcessMemory(hProcess, base + BigInt(thunkRva + i * thunkSize), thunkSize);
-			const thunkValue = isPE32Plus ? thunkData.readBigUInt64LE(0) : BigInt(thunkData.readUInt32LE(0));
-			if (thunkValue === 0n) break;
-			if ((thunkValue & IMAGE_ORDINAL_FLAG) !== 0n) functions.push({
-				name: `Ordinal#${Number(thunkValue & 65535n)}`,
-				ordinal: Number(thunkValue & 65535n),
-				hint: 0,
-				thunkRva: `0x${(thunkRva + i * thunkSize).toString(16)}`
-			});
-			else {
-				const hintNameRva = Number(thunkValue);
-				const hintNameData = ReadProcessMemory(hProcess, base + BigInt(hintNameRva), 258);
-				const hint = hintNameData.readUInt16LE(0);
-				const nullIdx = hintNameData.indexOf(0, 2);
-				const name = hintNameData.subarray(2, nullIdx > 2 ? nullIdx : 258).toString("ascii");
-				functions.push({
-					name,
-					ordinal: 0,
-					hint,
-					thunkRva: `0x${(thunkRva + i * thunkSize).toString(16)}`
-				});
-			}
-		}
-		return functions;
-	}
-	_enumerateModulesInternal(hProcess) {
-		const modules = [];
-		try {
-			const { modules: modHandles, count } = EnumProcessModules(hProcess);
-			for (let i = 0; i < count; i++) {
-				const hMod = modHandles[i];
-				const name = GetModuleBaseName(hProcess, hMod);
-				const info = GetModuleInformation(hProcess, hMod);
-				const modulePath = GetModuleFileNameEx(hProcess, hMod) ?? name;
-				if (info.success) modules.push({
-					name,
-					base: `0x${info.info.lpBaseOfDll.toString(16)}`,
-					path: modulePath,
-					size: info.info.SizeOfImage
-				});
-			}
-		} catch (e) {
-			logger.debug(`Module enumeration failed: ${e}`);
-		}
-		return modules;
-	}
-	_rvaToFileOffset(peData, rva) {
-		const e_lfanew = peData.readUInt32LE(60);
-		const numSections = peData.readUInt16LE(e_lfanew + 6);
-		const sizeOfOptionalHeader = peData.readUInt16LE(e_lfanew + 20);
-		const secStart = e_lfanew + 24 + sizeOfOptionalHeader;
-		for (let i = 0; i < numSections; i++) {
-			const off = secStart + i * 40;
-			if (off + 40 > peData.length) break;
-			const virtualAddr = peData.readUInt32LE(off + 12);
-			const virtualSize = peData.readUInt32LE(off + 8);
-			const rawOffset = peData.readUInt32LE(off + 20);
-			if (rva >= virtualAddr && rva < virtualAddr + virtualSize) return rawOffset + (rva - virtualAddr);
-		}
-		return -1;
-	}
-	_classifyHook(memBytes) {
-		if (memBytes[0] === 233) return "jmp_rel32";
-		if (memBytes[0] === 255 && memBytes[1] === 37) return "jmp_abs64";
-		if (memBytes[0] === 104 && memBytes[5] === 195) return "push_ret";
-		return "unknown";
-	}
-	_decodeJumpTarget(memBytes, funcAddr) {
-		if (memBytes[0] === 233) {
-			const rel32 = memBytes.readInt32LE(1);
-			return `0x${(funcAddr + 5n + BigInt(rel32)).toString(16)}`;
-		}
-		if (memBytes[0] === 255 && memBytes[1] === 37) {
-			if (memBytes.length >= 14) return `0x${memBytes.readBigUInt64LE(6).toString(16)}`;
-		}
-		if (memBytes[0] === 104) return `0x${memBytes.readUInt32LE(1).toString(16)}`;
-		return "0x0";
-	}
-};
-const peAnalyzer = new PEAnalyzer();
-//#endregion
-export { PEAnalyzer, peAnalyzer };