@jshookmcp/jshook 0.2.9 → 0.3.1

package/dist/Win32API-CePkipZY.mjs

@@ -1,340 +0,0 @@
-import { t as __exportAll } from "./chunk-CjcI7cDX.mjs";
-import { t as logger } from "./logger-Dh_xb7_2.mjs";
-import koffi from "koffi";
-//#region src/native/Win32API.ts
-/**
-* Win32 API Bindings using koffi FFI
-* Direct native calls to Windows kernel32.dll, ntdll.dll, psapi.dll
-*
-* This replaces PowerShell-based P/Invoke with direct FFI calls,
-* providing 10-100x performance improvement for memory operations.
-*
-* Note: We use inline types in function signatures to avoid
-* "Duplicate type name" errors in test environments where modules
-* may be loaded multiple times.
-*
-* @module Win32API
-*/
-var Win32API_exports = /* @__PURE__ */ __exportAll({
-	CloseHandle: () => CloseHandle,
-	CreateRemoteThread: () => CreateRemoteThread,
-	EnumProcessModules: () => EnumProcessModules,
-	GetLastError: () => GetLastError,
-	GetModuleBaseName: () => GetModuleBaseName,
-	GetModuleFileNameEx: () => GetModuleFileNameEx,
-	GetModuleHandle: () => GetModuleHandle,
-	GetModuleInformation: () => GetModuleInformation,
-	GetProcAddress: () => GetProcAddress,
-	MEM: () => MEM,
-	NtQueryInformationProcess: () => NtQueryInformationProcess,
-	OpenProcess: () => OpenProcess,
-	PAGE: () => PAGE,
-	PROCESS_ACCESS: () => PROCESS_ACCESS,
-	ReadProcessMemory: () => ReadProcessMemory,
-	VirtualAllocEx: () => VirtualAllocEx,
-	VirtualFreeEx: () => VirtualFreeEx,
-	VirtualProtectEx: () => VirtualProtectEx,
-	VirtualQueryEx: () => VirtualQueryEx,
-	WriteProcessMemory: () => WriteProcessMemory,
-	isKoffiAvailable: () => isKoffiAvailable,
-	isWindows: () => isWindows,
-	openProcessForMemory: () => openProcessForMemory
-});
-const PROCESS_ACCESS = {
-	TERMINATE: 1,
-	CREATE_THREAD: 2,
-	SET_SESSIONID: 4,
-	VM_OPERATION: 8,
-	VM_READ: 16,
-	VM_WRITE: 32,
-	DUP_HANDLE: 64,
-	CREATE_PROCESS: 128,
-	SET_QUOTA: 256,
-	SET_INFORMATION: 512,
-	QUERY_INFORMATION: 1024,
-	SUSPEND_RESUME: 2048,
-	QUERY_LIMITED_INFORMATION: 4096,
-	ALL_ACCESS: 2035711
-};
-const MEM = {
-	COMMIT: 4096,
-	RESERVE: 8192,
-	DECOMMIT: 16384,
-	RELEASE: 32768,
-	FREE: 65536,
-	PRIVATE: 131072,
-	MAPPED: 262144,
-	RESET: 524288,
-	TOP_DOWN: 1048576,
-	WRITE_WATCH: 2097152,
-	PHYSICAL: 4194304,
-	LARGE_PAGES: 536870912
-};
-const PAGE = {
-	NOACCESS: 1,
-	READONLY: 2,
-	READWRITE: 4,
-	WRITECOPY: 8,
-	EXECUTE: 16,
-	EXECUTE_READ: 32,
-	EXECUTE_READWRITE: 64,
-	EXECUTE_WRITECOPY: 128,
-	GUARD: 256,
-	NOCACHE: 512,
-	WRITECOMBINE: 1024
-};
-let kernel32 = null;
-let ntdll = null;
-let psapi = null;
-let koffiAvailable = null;
-/**
-* Check if koffi is available
-*/
-function isKoffiAvailable() {
-	if (koffiAvailable !== null) return koffiAvailable;
-	try {
-		koffi.load("kernel32.dll").unload();
-		koffiAvailable = true;
-		return true;
-	} catch {
-		/* istanbul ignore next */
-		koffiAvailable = false;
-		/* istanbul ignore next */
-		return false;
-	}
-}
-/**
-* Check if running on Windows
-*/
-function isWindows() {
-	return process.platform === "win32";
-}
-/**
-* Get or load kernel32.dll
-*/
-function getKernel32() {
-	if (!kernel32) {
-		kernel32 = koffi.load("kernel32.dll");
-		logger.debug("Loaded kernel32.dll via koffi");
-	}
-	return kernel32;
-}
-/**
-* Get or load ntdll.dll
-*/
-function getNtdll() {
-	if (!ntdll) {
-		ntdll = koffi.load("ntdll.dll");
-		logger.debug("Loaded ntdll.dll via koffi");
-	}
-	return ntdll;
-}
-/**
-* Get or load psapi.dll
-*/
-function getPsapi() {
-	if (!psapi) {
-		psapi = koffi.load("psapi.dll");
-		logger.debug("Loaded psapi.dll via koffi");
-	}
-	return psapi;
-}
-/**
-* Open a process handle
-*/
-function OpenProcess(dwDesiredAccess, bInheritHandle, dwProcessId) {
-	return getKernel32().func("void * OpenProcess(uint32, int, uint32)")(dwDesiredAccess, bInheritHandle ? 1 : 0, dwProcessId);
-}
-/**
-* Close a handle
-*/
-function CloseHandle(hObject) {
-	return getKernel32().func("int CloseHandle(void *)")(hObject) !== 0;
-}
-/**
-* Read process memory - returns buffer directly
-*/
-function ReadProcessMemory(hProcess, lpBaseAddress, size) {
-	const fn = getKernel32().func("int ReadProcessMemory(void *, void *, _Out_ uint8_t[len], size_t len, _Out_ size_t *bytesRead)");
-	const buffer = Buffer.alloc(size);
-	const bytesReadBuf = Buffer.alloc(8);
-	if (fn(hProcess, lpBaseAddress, buffer, BigInt(size), bytesReadBuf) === 0) {
-		const error = GetLastError();
-		throw new Error(`ReadProcessMemory failed. Error: 0x${error.toString(16)}`);
-	}
-	return buffer;
-}
-/**
-* Write process memory
-*/
-function WriteProcessMemory(hProcess, lpBaseAddress, data) {
-	const fn = getKernel32().func("int WriteProcessMemory(void *, void *, uint8_t[len], size_t len, _Out_ size_t *bytesWritten)");
-	const bytesWrittenBuf = Buffer.alloc(8);
-	if (fn(hProcess, lpBaseAddress, data, BigInt(data.length), bytesWrittenBuf) === 0) {
-		const error = GetLastError();
-		throw new Error(`WriteProcessMemory failed. Error: 0x${error.toString(16)}`);
-	}
-	return Number(bytesWrittenBuf.readBigUInt64LE());
-}
-/**
-* Query memory region information
-* Uses Buffer parsing to avoid koffi struct registration issues
-*/
-function VirtualQueryEx(hProcess, lpAddress) {
-	const fn = getKernel32().func("size_t VirtualQueryEx(void *, void *, _Out_ uint8_t[48], size_t)");
-	const structSize = 48;
-	const buffer = Buffer.alloc(structSize);
-	const result = fn(hProcess, lpAddress, buffer, BigInt(structSize));
-	if (Number(result) !== structSize) return {
-		success: false,
-		info: {}
-	};
-	return {
-		success: true,
-		info: {
-			BaseAddress: buffer.readBigUInt64LE(0),
-			AllocationBase: buffer.readBigUInt64LE(8),
-			AllocationProtect: buffer.readUInt32LE(16),
-			RegionSize: buffer.readBigUInt64LE(24),
-			State: buffer.readUInt32LE(32),
-			Protect: buffer.readUInt32LE(36),
-			Type: buffer.readUInt32LE(40)
-		}
-	};
-}
-/**
-* Change memory protection
-*/
-function VirtualProtectEx(hProcess, lpAddress, dwSize, flNewProtect) {
-	const fn = getKernel32().func("int VirtualProtectEx(void *, void *, size_t, uint32, _Out_ uint32 *)");
-	const oldProtectBuf = Buffer.alloc(4);
-	return {
-		success: fn(hProcess, lpAddress, BigInt(dwSize), flNewProtect, oldProtectBuf) !== 0,
-		oldProtect: oldProtectBuf.readUInt32LE(0)
-	};
-}
-/**
-* Allocate memory in another process
-*/
-function VirtualAllocEx(hProcess, lpAddress, dwSize, flAllocationType, flProtect) {
-	return getKernel32().func("void * VirtualAllocEx(void *, void *, size_t, uint32, uint32)")(hProcess, lpAddress, BigInt(dwSize), flAllocationType, flProtect);
-}
-/**
-* Free memory in another process
-*/
-function VirtualFreeEx(hProcess, lpAddress, dwSize, dwFreeType) {
-	return getKernel32().func("int VirtualFreeEx(void *, void *, size_t, uint32)")(hProcess, lpAddress, BigInt(dwSize), dwFreeType) !== 0;
-}
-/**
-* Create a remote thread in another process
-*/
-function CreateRemoteThread(hProcess, lpStartAddress, lpParameter) {
-	const fn = getKernel32().func("void * CreateRemoteThread(void *, void *, size_t, void *, void *, uint32, _Out_ uint32 *)");
-	const threadIdBuf = Buffer.alloc(4);
-	return {
-		handle: fn(hProcess, null, 0n, lpStartAddress, lpParameter, 0, threadIdBuf),
-		threadId: threadIdBuf.readUInt32LE(0)
-	};
-}
-/**
-* Get module handle by name
-*/
-function GetModuleHandle(lpModuleName) {
-	return getKernel32().func("void * GetModuleHandleA(char *)")(lpModuleName);
-}
-/**
-* Get function address from module
-*/
-function GetProcAddress(hModule, lpProcName) {
-	return getKernel32().func("void * GetProcAddress(void *, char *)")(hModule, lpProcName);
-}
-/**
-* Get last error code
-*/
-function GetLastError() {
-	return getKernel32().func("uint32 GetLastError()")();
-}
-/**
-* NtQueryInformationProcess for anti-debug detection
-*/
-function NtQueryInformationProcess(hProcess, processInformationClass) {
-	const fn = getNtdll().func("int32 NtQueryInformationProcess(void *, uint32, _Out_ void *, uint32, void *)");
-	const debugPortBuf = Buffer.alloc(8);
-	return {
-		status: fn(hProcess, processInformationClass, debugPortBuf, 8, null),
-		debugPort: Number(debugPortBuf.readBigUInt64LE())
-	};
-}
-/**
-* Enumerate process modules
-*/
-function EnumProcessModules(hProcess, maxModules = 1024) {
-	const fn = getPsapi().func("int EnumProcessModules(void *, _Out_ void *[], uint32, _Out_ uint32 *)");
-	const moduleBuf = Buffer.alloc(maxModules * 8);
-	const neededBuf = Buffer.alloc(4);
-	const result = fn(hProcess, moduleBuf, maxModules * 8, neededBuf);
-	const needed = neededBuf.readUInt32LE(0);
-	const count = Math.floor(needed / 8);
-	const modules = [];
-	for (let i = 0; i < count; i++) modules.push(moduleBuf.readBigUInt64LE(i * 8));
-	return {
-		success: result !== 0,
-		modules,
-		count
-	};
-}
-/**
-* Get module base name
-*/
-function GetModuleBaseName(hProcess, hModule, maxSize = 260) {
-	const fn = getPsapi().func("uint32 GetModuleBaseNameA(void *, void *, _Out_ char[], uint32)");
-	const buffer = Buffer.alloc(maxSize);
-	fn(hProcess, hModule, buffer, maxSize);
-	let len = 0;
-	while (len < maxSize && buffer[len] !== 0) len++;
-	return buffer.toString("utf8", 0, len);
-}
-/**
-* Get full module path from a remote process.
-* Returns null when the API is unavailable or the module path cannot be resolved.
-*/
-function GetModuleFileNameEx(hProcess, hModule, maxSize = 32768) {
-	const fn = getPsapi().func("uint32 GetModuleFileNameExA(void *, void *, _Out_ char[], uint32)");
-	const buffer = Buffer.alloc(maxSize);
-	const result = fn(hProcess, hModule, buffer, maxSize);
-	if (typeof result !== "number" || result <= 0) return null;
-	let len = 0;
-	while (len < maxSize && buffer[len] !== 0) len++;
-	return len > 0 ? buffer.toString("utf8", 0, len) : null;
-}
-/**
-* Get module information
-* Uses Buffer parsing to avoid koffi struct registration issues
-*/
-function GetModuleInformation(hProcess, hModule) {
-	const fn = getPsapi().func("int GetModuleInformation(void *, void *, _Out_ uint8_t[24], uint32)");
-	const buffer = Buffer.alloc(24);
-	const result = fn(hProcess, hModule, buffer, 24);
-	const info = {
-		lpBaseOfDll: buffer.readBigUInt64LE(0),
-		SizeOfImage: buffer.readUInt32LE(8),
-		EntryPoint: buffer.readBigUInt64LE(16)
-	};
-	return {
-		success: result !== 0,
-		info
-	};
-}
-/**
-* Open a process with standard memory access rights
-*/
-function openProcessForMemory(pid, writeAccess = false) {
-	const handle = OpenProcess(writeAccess ? PROCESS_ACCESS.VM_READ | PROCESS_ACCESS.VM_WRITE | PROCESS_ACCESS.VM_OPERATION | PROCESS_ACCESS.QUERY_INFORMATION : PROCESS_ACCESS.VM_READ | PROCESS_ACCESS.QUERY_INFORMATION, false, pid);
-	if (handle === 0n) {
-		const error = GetLastError();
-		throw new Error(`Failed to open process ${pid}. Error: 0x${error.toString(16)}. Run as Administrator.`);
-	}
-	return handle;
-}
-//#endregion
-export { WriteProcessMemory as _, GetModuleFileNameEx as a, openProcessForMemory as b, GetProcAddress as c, ReadProcessMemory as d, VirtualAllocEx as f, Win32API_exports as g, VirtualQueryEx as h, GetModuleBaseName as i, MEM as l, VirtualProtectEx as m, EnumProcessModules as n, GetModuleHandle as o, VirtualFreeEx as p, GetLastError as r, GetModuleInformation as s, CloseHandle as t, PAGE as u, isKoffiAvailable as v, isWindows as y };

package/dist/Win32Debug-BvKs-gxc.mjs

@@ -1,274 +0,0 @@
-import { t as logger } from "./logger-Dh_xb7_2.mjs";
-import { r as GetLastError, t as CloseHandle } from "./Win32API-CePkipZY.mjs";
-import koffi from "koffi";
-//#region src/native/Win32Debug.ts
-/**
-* Win32 Debug API Bindings using koffi FFI.
-*
-* Thread management, debug registers, debug events, and instruction cache.
-* These extend Win32API.ts with debug-specific functionality needed for
-* hardware breakpoints and code injection.
-*
-* @module Win32Debug
-*/
-const THREAD_ACCESS = {
-	TERMINATE: 1,
-	SUSPEND_RESUME: 2,
-	GET_CONTEXT: 8,
-	SET_CONTEXT: 16,
-	SET_INFORMATION: 32,
-	QUERY_INFORMATION: 64,
-	SET_THREAD_TOKEN: 128,
-	IMPERSONATE: 256,
-	DIRECT_IMPERSONATION: 512,
-	ALL_ACCESS: 2032639
-};
-/** CONTEXT flags for GetThreadContext / SetThreadContext */
-const CONTEXT_FLAGS = {
-	AMD64: 1048576,
-	CONTROL: 1048577,
-	INTEGER: 1048578,
-	SEGMENTS: 1048580,
-	FLOATING_POINT: 1048584,
-	DEBUG_REGISTERS: 1048592,
-	FULL: 1048587,
-	ALL: 1048607
-};
-/** Debug event codes */
-const DEBUG_EVENT_CODE = {
-	EXCEPTION_DEBUG_EVENT: 1,
-	CREATE_THREAD_DEBUG_EVENT: 2,
-	CREATE_PROCESS_DEBUG_EVENT: 3,
-	EXIT_THREAD_DEBUG_EVENT: 4,
-	EXIT_PROCESS_DEBUG_EVENT: 5,
-	LOAD_DLL_DEBUG_EVENT: 6,
-	UNLOAD_DLL_DEBUG_EVENT: 7,
-	OUTPUT_DEBUG_STRING_EVENT: 8,
-	RIP_EVENT: 9
-};
-/** Exception codes */
-const EXCEPTION_CODE = {
-	SINGLE_STEP: 2147483652,
-	BREAKPOINT: 2147483651,
-	ACCESS_VIOLATION: 3221225477
-};
-/** Continue status for ContinueDebugEvent */
-const DBG = {
-	CONTINUE: 65538,
-	EXCEPTION_NOT_HANDLED: 2147549185,
-	REPLY_LATER: 1073807361
-};
-/** TH32CS flags for CreateToolhelp32Snapshot */
-const TH32CS = {
-	SNAPHEAPLIST: 1,
-	SNAPTHREAD: 4,
-	SNAPMODULE: 8
-};
-const CONTEXT_SIZE = 1232;
-/** Parse x64 CONTEXT from raw buffer */
-function parseContext(buf) {
-	return {
-		contextFlags: buf.readUInt32LE(48),
-		eflags: buf.readUInt32LE(68),
-		dr0: buf.readBigUInt64LE(72),
-		dr1: buf.readBigUInt64LE(80),
-		dr2: buf.readBigUInt64LE(88),
-		dr3: buf.readBigUInt64LE(96),
-		dr6: buf.readBigUInt64LE(104),
-		dr7: buf.readBigUInt64LE(112),
-		rax: buf.readBigUInt64LE(120),
-		rcx: buf.readBigUInt64LE(128),
-		rdx: buf.readBigUInt64LE(136),
-		rbx: buf.readBigUInt64LE(144),
-		rsp: buf.readBigUInt64LE(152),
-		rbp: buf.readBigUInt64LE(160),
-		rsi: buf.readBigUInt64LE(168),
-		rdi: buf.readBigUInt64LE(176),
-		r8: buf.readBigUInt64LE(184),
-		r9: buf.readBigUInt64LE(192),
-		r10: buf.readBigUInt64LE(200),
-		r11: buf.readBigUInt64LE(208),
-		r12: buf.readBigUInt64LE(216),
-		r13: buf.readBigUInt64LE(224),
-		r14: buf.readBigUInt64LE(232),
-		r15: buf.readBigUInt64LE(240),
-		rip: buf.readBigUInt64LE(248)
-	};
-}
-/** Write x64 CONTEXT fields into a raw buffer */
-function writeContext(buf, ctx) {
-	if (ctx.contextFlags !== void 0) buf.writeUInt32LE(ctx.contextFlags, 48);
-	if (ctx.eflags !== void 0) buf.writeUInt32LE(ctx.eflags, 68);
-	if (ctx.dr0 !== void 0) buf.writeBigUInt64LE(ctx.dr0, 72);
-	if (ctx.dr1 !== void 0) buf.writeBigUInt64LE(ctx.dr1, 80);
-	if (ctx.dr2 !== void 0) buf.writeBigUInt64LE(ctx.dr2, 88);
-	if (ctx.dr3 !== void 0) buf.writeBigUInt64LE(ctx.dr3, 96);
-	if (ctx.dr6 !== void 0) buf.writeBigUInt64LE(ctx.dr6, 104);
-	if (ctx.dr7 !== void 0) buf.writeBigUInt64LE(ctx.dr7, 112);
-	if (ctx.rip !== void 0) buf.writeBigUInt64LE(ctx.rip, 248);
-}
-let kernel32Debug = null;
-function getKernel32() {
-	if (!kernel32Debug) {
-		kernel32Debug = koffi.load("kernel32.dll");
-		logger.debug("Loaded kernel32.dll for debug APIs");
-	}
-	return kernel32Debug;
-}
-/** Open a thread handle */
-function OpenThread(dwDesiredAccess, bInheritHandle, dwThreadId) {
-	return getKernel32().func("void * OpenThread(uint32, int, uint32)")(dwDesiredAccess, bInheritHandle ? 1 : 0, dwThreadId);
-}
-/** Suspend a thread, returns previous suspend count */
-function SuspendThread(hThread) {
-	const result = getKernel32().func("uint32 SuspendThread(void *)")(hThread);
-	if (result === 4294967295) throw new Error(`SuspendThread failed. Error: 0x${GetLastError().toString(16)}`);
-	return result;
-}
-/** Resume a thread, returns previous suspend count */
-function ResumeThread(hThread) {
-	const result = getKernel32().func("uint32 ResumeThread(void *)")(hThread);
-	if (result === 4294967295) throw new Error(`ResumeThread failed. Error: 0x${GetLastError().toString(16)}`);
-	return result;
-}
-/** Get thread context (CPU registers including debug registers) */
-function GetThreadContext(hThread, contextFlags) {
-	const fn = getKernel32().func("int GetThreadContext(void *, _Inout_ uint8_t[1232])");
-	const buf = Buffer.alloc(CONTEXT_SIZE);
-	buf.writeUInt32LE(contextFlags, 48);
-	if (fn(hThread, buf) === 0) throw new Error(`GetThreadContext failed. Error: 0x${GetLastError().toString(16)}`);
-	return buf;
-}
-/** Set thread context (CPU registers including debug registers) */
-function SetThreadContext(hThread, contextBuf) {
-	if (getKernel32().func("int SetThreadContext(void *, uint8_t[1232])")(hThread, contextBuf) === 0) throw new Error(`SetThreadContext failed. Error: 0x${GetLastError().toString(16)}`);
-}
-/** Attach as debugger to a process */
-function DebugActiveProcess(dwProcessId) {
-	if (getKernel32().func("int DebugActiveProcess(uint32)")(dwProcessId) === 0) throw new Error(`DebugActiveProcess failed for pid ${dwProcessId}. Error: 0x${GetLastError().toString(16)}`);
-}
-/** Detach debugger from process */
-function DebugActiveProcessStop(dwProcessId) {
-	if (getKernel32().func("int DebugActiveProcessStop(uint32)")(dwProcessId) === 0) throw new Error(`DebugActiveProcessStop failed. Error: 0x${GetLastError().toString(16)}`);
-}
-/** Don't kill the process when debugger detaches */
-function DebugSetProcessKillOnExit(killOnExit) {
-	getKernel32().func("int DebugSetProcessKillOnExit(int)")(killOnExit ? 1 : 0);
-}
-function WaitForDebugEvent(timeoutMs) {
-	const fn = getKernel32().func("int WaitForDebugEvent(_Out_ uint8_t[176], uint32)");
-	const buf = Buffer.alloc(176);
-	if (fn(buf, timeoutMs) === 0) return null;
-	const info = {
-		debugEventCode: buf.readUInt32LE(0),
-		processId: buf.readUInt32LE(4),
-		threadId: buf.readUInt32LE(8)
-	};
-	if (info.debugEventCode === DEBUG_EVENT_CODE.EXCEPTION_DEBUG_EVENT) {
-		info.exceptionCode = buf.readUInt32LE(16);
-		info.exceptionAddress = buf.readBigUInt64LE(32);
-		info.firstChance = buf.readUInt32LE(20) === 0;
-	}
-	return info;
-}
-/** Continue after handling a debug event */
-function ContinueDebugEvent(dwProcessId, dwThreadId, dwContinueStatus) {
-	if (getKernel32().func("int ContinueDebugEvent(uint32, uint32, uint32)")(dwProcessId, dwThreadId, dwContinueStatus) === 0) throw new Error(`ContinueDebugEvent failed. Error: 0x${GetLastError().toString(16)}`);
-}
-/** Flush instruction cache after writing code */
-function FlushInstructionCache(hProcess, lpBaseAddress, dwSize) {
-	getKernel32().func("int FlushInstructionCache(void *, void *, size_t)")(hProcess, lpBaseAddress, BigInt(dwSize));
-}
-/**
-* Enumerate all thread IDs of a process using CreateToolhelp32Snapshot.
-*
-* THREADENTRY32 layout (28 bytes):
-*   +0x00: dwSize (uint32)
-*   +0x04: cntUsage (uint32)
-*   +0x08: th32ThreadID (uint32)
-*   +0x0C: th32OwnerProcessID (uint32)
-*   +0x10: tpBasePri (int32)
-*   +0x14: tpDeltaPri (int32)
-*   +0x18: dwFlags (uint32)
-*/
-function EnumerateProcessThreads(pid) {
-	const fnSnapshot = getKernel32().func("void * CreateToolhelp32Snapshot(uint32, uint32)");
-	const fnFirst = getKernel32().func("int Thread32First(void *, _Inout_ uint8_t[28])");
-	const fnNext = getKernel32().func("int Thread32Next(void *, _Inout_ uint8_t[28])");
-	const snapshot = fnSnapshot(TH32CS.SNAPTHREAD, 0);
-	if (snapshot === 0n || snapshot === BigInt("0xFFFFFFFFFFFFFFFF")) throw new Error(`CreateToolhelp32Snapshot failed. Error: 0x${GetLastError().toString(16)}`);
-	const threads = [];
-	const entry = Buffer.alloc(28);
-	entry.writeUInt32LE(28, 0);
-	try {
-		if (fnFirst(snapshot, entry) !== 0) do {
-			if (entry.readUInt32LE(12) === pid) threads.push(entry.readUInt32LE(8));
-			entry.writeUInt32LE(28, 0);
-		} while (fnNext(snapshot, entry) !== 0);
-		CloseHandle(snapshot);
-	} catch (e) {
-		console.error("[EnumerateProcessThreads] cleanup error:", e);
-	}
-	return threads;
-}
-/** Open a thread with debug-appropriate access rights */
-function openThreadForDebug(threadId) {
-	const handle = OpenThread(THREAD_ACCESS.SUSPEND_RESUME | THREAD_ACCESS.GET_CONTEXT | THREAD_ACCESS.SET_CONTEXT | THREAD_ACCESS.QUERY_INFORMATION, false, threadId);
-	if (handle === 0n) throw new Error(`Failed to open thread ${threadId}. Error: 0x${GetLastError().toString(16)}`);
-	return handle;
-}
-/**
-* Encode DR7 breakpoint configuration.
-*
-* DR7 layout (x64):
-* Bits 0-7: Local/Global enable for DR0-DR3 (L0, G0, L1, G1, ...)
-* Bits 16-17: DR0 condition (00=exec, 01=write, 11=readwrite)
-* Bits 18-19: DR0 size (00=1byte, 01=2byte, 11=4byte, 10=8byte)
-* Bits 20-21: DR1 condition
-* Bits 22-23: DR1 size
-* Bits 24-25: DR2 condition
-* Bits 26-27: DR2 size
-* Bits 28-29: DR3 condition
-* Bits 30-31: DR3 size
-*/
-function encodeDR7(entries) {
-	let dr7 = 0n;
-	for (const entry of entries) {
-		if (!entry.enabled) continue;
-		const { drIndex, access, size } = entry;
-		dr7 |= 1n << BigInt(drIndex * 2);
-		let condition = 0;
-		switch (access) {
-			case "execute":
-				condition = 0;
-				break;
-			case "write":
-				condition = 1;
-				break;
-			case "readwrite":
-			case "read":
-				condition = 3;
-				break;
-		}
-		dr7 |= BigInt(condition) << BigInt(16 + drIndex * 4);
-		let sizeCode = 0;
-		switch (size) {
-			case 1:
-				sizeCode = 0;
-				break;
-			case 2:
-				sizeCode = 1;
-				break;
-			case 4:
-				sizeCode = 3;
-				break;
-			case 8:
-				sizeCode = 2;
-				break;
-		}
-		dr7 |= BigInt(sizeCode) << BigInt(18 + drIndex * 4);
-	}
-	return dr7;
-}
-//#endregion
-export { openThreadForDebug as _, DebugActiveProcessStop as a, EnumerateProcessThreads as c, ResumeThread as d, SetThreadContext as f, encodeDR7 as g, WaitForDebugEvent as h, DebugActiveProcess as i, FlushInstructionCache as l, TH32CS as m, ContinueDebugEvent as n, DebugSetProcessKillOnExit as o, SuspendThread as p, DBG as r, EXCEPTION_CODE as s, CONTEXT_FLAGS as t, GetThreadContext as u, parseContext as v, writeContext as y };