@jshookmcp/jshook 0.3.0 → 0.3.1

package/dist/AntiCheatDetector-CqGDXmfc.mjs

@@ -1,350 +0,0 @@
-import { t as logger } from "./logger-Dh_xb7_2.mjs";
-import { a as GetModuleFileNameEx, b as openProcessForMemory, d as ReadProcessMemory, h as VirtualQueryEx, i as GetModuleBaseName, n as EnumProcessModules, s as GetModuleInformation, t as CloseHandle, u as PAGE } from "./Win32API-C2kjj0ze.mjs";
-import { PEAnalyzer } from "./PEAnalyzer-DMQ44gen.mjs";
-import { createHash } from "node:crypto";
-import { promises } from "node:fs";
-//#region src/native/AntiCheatDetector.ts
-/**
-* Anti-Cheat / Anti-Debug Detection Engine.
-*
-* Scans processes for anti-debug mechanisms, guard pages, and code integrity
-* checks by analyzing imports, memory regions, and section hashes.
-*
-* @module AntiCheatDetector
-*/
-const ANTI_DEBUG_IMPORTS = [{
-	dll: "kernel32.dll",
-	funcs: [
-		{
-			name: "IsDebuggerPresent",
-			mechanism: "anti_debug_api",
-			confidence: "high",
-			bypass: "Hook IsDebuggerPresent to return 0, or patch PEB.BeingDebugged field"
-		},
-		{
-			name: "CheckRemoteDebuggerPresent",
-			mechanism: "anti_debug_api",
-			confidence: "high",
-			bypass: "Hook CheckRemoteDebuggerPresent to set output to FALSE and return TRUE"
-		},
-		{
-			name: "OutputDebugStringA",
-			mechanism: "exception_based",
-			confidence: "low",
-			bypass: "May be used for anti-debug timing — monitor for exception handler abuse"
-		},
-		{
-			name: "GetTickCount",
-			mechanism: "timing_check",
-			confidence: "low",
-			bypass: "Hook GetTickCount to return consistent delta values"
-		},
-		{
-			name: "GetTickCount64",
-			mechanism: "timing_check",
-			confidence: "low",
-			bypass: "Hook GetTickCount64 to return consistent delta values"
-		},
-		{
-			name: "QueryPerformanceCounter",
-			mechanism: "timing_check",
-			confidence: "medium",
-			bypass: "Hook QPC to filter out debugging time deltas"
-		}
-	]
-}, {
-	dll: "ntdll.dll",
-	funcs: [
-		{
-			name: "NtQueryInformationProcess",
-			mechanism: "ntquery_debug",
-			confidence: "high",
-			bypass: "Hook NtQueryInformationProcess: return 0 for ProcessDebugPort (7), ProcessDebugObjectHandle (30), ProcessDebugFlags (31)"
-		},
-		{
-			name: "NtSetInformationThread",
-			mechanism: "thread_hiding",
-			confidence: "medium",
-			bypass: "Hook NtSetInformationThread: intercept ThreadHideFromDebugger (0x11) calls"
-		},
-		{
-			name: "NtClose",
-			mechanism: "exception_based",
-			confidence: "low",
-			bypass: "NtClose with invalid handle detects debugger via exception — hook to suppress"
-		},
-		{
-			name: "RtlGetNtGlobalFlags",
-			mechanism: "heap_flags",
-			confidence: "medium",
-			bypass: "Clear NtGlobalFlag (FLG_HEAP_*) in PEB at offset 0xBC (x64)"
-		}
-	]
-}];
-const DR_CHECK_IMPORTS = ["GetThreadContext", "SetThreadContext"];
-const DEFAULT_LIMITS = {
-	guardPageMaxRegions: 2e4,
-	guardPageTimeoutMs: 2e3,
-	integrityMaxModules: 32,
-	integrityMaxSections: 128,
-	integrityMaxBytes: 16 * 1024 * 1024,
-	integrityMaxSectionBytes: 2 * 1024 * 1024,
-	integrityTimeoutMs: 3e3
-};
-var AntiCheatDetector = class {
-	peAnalyzer = new PEAnalyzer();
-	options;
-	constructor(options = {}) {
-		this.options = {
-			...DEFAULT_LIMITS,
-			...options
-		};
-	}
-	/**
-	* Scan process for anti-debug / anti-cheat mechanisms by analyzing imports.
-	*/
-	async detect(pid) {
-		const detections = [];
-		const hProcess = openProcessForMemory(pid);
-		try {
-			const modules = this.enumerateModules(hProcess);
-			for (const mod of modules) try {
-				const imports = await this.peAnalyzer.parseImports(pid, mod.base);
-				for (const imp of imports) {
-					const dllLower = imp.dllName.toLowerCase();
-					for (const knownDll of ANTI_DEBUG_IMPORTS) if (dllLower.includes(knownDll.dll.toLowerCase().replace(".dll", ""))) {
-						for (const func of knownDll.funcs) if (imp.functions.some((f) => f.name === func.name)) detections.push({
-							mechanism: func.mechanism,
-							confidence: func.confidence,
-							location: `import:${func.name}`,
-							moduleName: mod.name,
-							details: `${mod.name} imports ${func.name} from ${imp.dllName}`,
-							bypassSuggestion: func.bypass
-						});
-					}
-					for (const func of imp.functions) if (DR_CHECK_IMPORTS.includes(func.name)) detections.push({
-						mechanism: "hardware_breakpoint",
-						confidence: "medium",
-						location: `import:${func.name}`,
-						moduleName: mod.name,
-						details: `${mod.name} imports ${func.name} — may check debug registers for hardware breakpoints`,
-						bypassSuggestion: "Hook GetThreadContext to zero out DR0-DR3 and DR6/DR7 before returning"
-					});
-				}
-			} catch (e) {
-				logger.debug(`Import scan skipped for ${mod.name}: ${e}`);
-			}
-		} finally {
-			CloseHandle(hProcess);
-		}
-		return detections;
-	}
-	/**
-	* Find all guard page regions in the process.
-	*/
-	async findGuardPages(pid) {
-		return (await this.scanGuardPages(pid)).guardPages;
-	}
-	async scanGuardPages(pid) {
-		const guardPages = [];
-		const hProcess = openProcessForMemory(pid);
-		const startedAt = Date.now();
-		const stats = {
-			scannedRegions: 0,
-			queryFailures: 0,
-			durationMs: 0,
-			timedOut: false,
-			truncated: false,
-			maxRegions: this.options.guardPageMaxRegions,
-			timeoutMs: this.options.guardPageTimeoutMs
-		};
-		try {
-			const modules = this.enumerateModules(hProcess);
-			let address = 0n;
-			const maxAddress = 140737488355327n;
-			while (address < maxAddress) {
-				if (this.isTimedOut(startedAt, stats.timeoutMs)) {
-					stats.timedOut = true;
-					stats.truncated = true;
-					break;
-				}
-				if (stats.scannedRegions >= stats.maxRegions) {
-					stats.truncated = true;
-					break;
-				}
-				try {
-					const result = VirtualQueryEx(hProcess, address);
-					if (!result.success) break;
-					const mbi = result.info;
-					const nextAddress = mbi.BaseAddress + mbi.RegionSize;
-					stats.scannedRegions += 1;
-					if ((mbi.Protect & PAGE.GUARD) !== 0) {
-						let moduleName = null;
-						for (const mod of modules) {
-							const modBase = BigInt(mod.base);
-							if (mbi.BaseAddress >= modBase && mbi.BaseAddress < modBase + BigInt(mod.size)) {
-								moduleName = mod.name;
-								break;
-							}
-						}
-						guardPages.push({
-							address: `0x${mbi.BaseAddress.toString(16)}`,
-							size: Number(mbi.RegionSize),
-							moduleName,
-							nearbySymbol: null
-						});
-					}
-					if (mbi.RegionSize <= 0n || nextAddress <= address || nextAddress <= mbi.BaseAddress) {
-						stats.truncated = true;
-						break;
-					}
-					address = nextAddress;
-				} catch {
-					stats.queryFailures += 1;
-					address += 4096n;
-				}
-			}
-		} finally {
-			stats.durationMs = Date.now() - startedAt;
-			CloseHandle(hProcess);
-		}
-		return {
-			guardPages,
-			stats
-		};
-	}
-	/**
-	* Check code section integrity by comparing disk vs memory hashes.
-	*/
-	async checkIntegrity(pid, moduleName) {
-		return (await this.scanIntegrity(pid, moduleName)).sections;
-	}
-	async scanIntegrity(pid, moduleName) {
-		const results = [];
-		const hProcess = openProcessForMemory(pid);
-		const startedAt = Date.now();
-		const stats = {
-			scannedModules: 0,
-			scannedSections: 0,
-			hashedBytes: 0,
-			skippedModules: 0,
-			skippedSections: 0,
-			durationMs: 0,
-			timedOut: false,
-			truncated: false,
-			maxModules: this.options.integrityMaxModules,
-			maxSections: this.options.integrityMaxSections,
-			maxBytes: this.options.integrityMaxBytes,
-			timeoutMs: this.options.integrityTimeoutMs
-		};
-		let stopScan = false;
-		try {
-			const modules = this.enumerateModules(hProcess);
-			const targets = moduleName ? modules.filter((m) => m.name.toLowerCase().includes(moduleName.toLowerCase())) : modules;
-			for (const mod of targets) {
-				if (this.shouldStopIntegrityScan(stats, startedAt)) {
-					if (this.isTimedOut(startedAt, stats.timeoutMs)) stats.timedOut = true;
-					stats.truncated = true;
-					break;
-				}
-				stats.scannedModules += 1;
-				try {
-					const diskData = await promises.readFile(mod.path);
-					const sections = await this.peAnalyzer.listSections(pid, mod.base);
-					for (const sec of sections) {
-						if (this.shouldStopIntegrityScan(stats, startedAt)) {
-							if (this.isTimedOut(startedAt, stats.timeoutMs)) stats.timedOut = true;
-							stats.truncated = true;
-							stopScan = true;
-							break;
-						}
-						if (!sec.isExecutable) continue;
-						const secRva = parseInt(sec.virtualAddress, 16);
-						const secSize = Math.min(sec.virtualSize, sec.rawSize);
-						if (secSize <= 0) continue;
-						if (secSize > this.options.integrityMaxSectionBytes) {
-							stats.skippedSections += 1;
-							continue;
-						}
-						if (stats.hashedBytes + secSize > stats.maxBytes) {
-							stats.truncated = true;
-							stopScan = true;
-							break;
-						}
-						const memBytes = ReadProcessMemory(hProcess, BigInt(mod.base) + BigInt(secRva), secSize);
-						const diskOffset = this.rvaToFileOffset(diskData, secRva);
-						if (diskOffset < 0 || diskOffset + secSize > diskData.length) continue;
-						const diskBytes = diskData.subarray(diskOffset, diskOffset + secSize);
-						const memoryHash = createHash("sha256").update(memBytes).digest("hex");
-						const diskHash = createHash("sha256").update(diskBytes).digest("hex");
-						results.push({
-							sectionName: sec.name,
-							moduleName: mod.name,
-							diskHash,
-							memoryHash,
-							isModified: memoryHash !== diskHash
-						});
-						stats.scannedSections += 1;
-						stats.hashedBytes += secSize;
-					}
-				} catch (e) {
-					stats.skippedModules += 1;
-					logger.debug(`Integrity check skipped for ${mod.name}: ${e}`);
-				}
-				if (stopScan) break;
-			}
-		} finally {
-			stats.durationMs = Date.now() - startedAt;
-			CloseHandle(hProcess);
-		}
-		return {
-			sections: results,
-			stats
-		};
-	}
-	enumerateModules(hProcess) {
-		const modules = [];
-		try {
-			const { modules: modHandles, count } = EnumProcessModules(hProcess);
-			for (let i = 0; i < count; i++) {
-				const hMod = modHandles[i];
-				const name = GetModuleBaseName(hProcess, hMod);
-				const info = GetModuleInformation(hProcess, hMod);
-				const modulePath = GetModuleFileNameEx(hProcess, hMod) ?? name;
-				if (info.success) modules.push({
-					name,
-					base: `0x${info.info.lpBaseOfDll.toString(16)}`,
-					path: modulePath,
-					size: info.info.SizeOfImage
-				});
-			}
-		} catch (e) {
-			logger.debug(`Module enumeration failed: ${e}`);
-		}
-		return modules;
-	}
-	rvaToFileOffset(peData, rva) {
-		const e_lfanew = peData.readUInt32LE(60);
-		const numSections = peData.readUInt16LE(e_lfanew + 6);
-		const sizeOfOptionalHeader = peData.readUInt16LE(e_lfanew + 20);
-		const secStart = e_lfanew + 24 + sizeOfOptionalHeader;
-		for (let i = 0; i < numSections; i++) {
-			const off = secStart + i * 40;
-			if (off + 40 > peData.length) break;
-			const virtualAddr = peData.readUInt32LE(off + 12);
-			const virtualSize = peData.readUInt32LE(off + 8);
-			const rawOffset = peData.readUInt32LE(off + 20);
-			if (rva >= virtualAddr && rva < virtualAddr + virtualSize) return rawOffset + (rva - virtualAddr);
-		}
-		return -1;
-	}
-	isTimedOut(startedAt, timeoutMs) {
-		return Date.now() - startedAt >= timeoutMs;
-	}
-	shouldStopIntegrityScan(stats, startedAt) {
-		return this.isTimedOut(startedAt, stats.timeoutMs) || stats.scannedModules >= stats.maxModules || stats.scannedSections >= stats.maxSections || stats.hashedBytes >= stats.maxBytes;
-	}
-};
-const antiCheatDetector = new AntiCheatDetector();
-//#endregion
-export { AntiCheatDetector, antiCheatDetector };

package/dist/CacheAdapters-jJFy20G-.mjs

@@ -1,80 +0,0 @@
-//#region src/utils/CacheAdapters.ts
-var DetailedDataManagerAdapter = class {
-	name = "DetailedDataManager";
-	constructor(manager) {
-		this.manager = manager;
-	}
-	getStats() {
-		const stats = this.manager.getStats();
-		return {
-			entries: stats.cacheSize,
-			size: this.estimateSize(stats.cacheSize),
-			hits: 0,
-			misses: 0,
-			ttl: stats.defaultTTLSeconds * 1e3,
-			maxSize: stats.maxCacheSize
-		};
-	}
-	clear() {
-		this.manager.clear();
-	}
-	estimateSize(entries) {
-		return entries * 50 * 1024;
-	}
-};
-var CodeCacheAdapter = class {
-	name = "CodeCache";
-	constructor(cache) {
-		this.cache = cache;
-	}
-	async getStats() {
-		const stats = await this.cache.getStats();
-		return {
-			entries: stats.memoryEntries + stats.diskEntries,
-			size: stats.totalSize,
-			hits: 0,
-			misses: 0
-		};
-	}
-	async cleanup() {
-		await this.cache.cleanup();
-	}
-	async clear() {
-		await this.cache.clear();
-	}
-};
-var CodeCompressorAdapter = class {
-	name = "CodeCompressor";
-	constructor(compressor) {
-		this.compressor = compressor;
-	}
-	getStats() {
-		const stats = this.compressor.getStats();
-		const cacheSize = this.compressor.getCacheSize();
-		const total = stats.cacheHits + stats.cacheMisses;
-		const hitRate = total > 0 ? stats.cacheHits / total : 0;
-		return {
-			entries: cacheSize,
-			size: this.estimateSize(cacheSize, stats.totalCompressedSize),
-			hits: stats.cacheHits,
-			misses: stats.cacheMisses,
-			hitRate
-		};
-	}
-	clear() {
-		this.compressor.clearCache();
-	}
-	estimateSize(entries, totalCompressed) {
-		if (entries === 0) return 0;
-		return entries * (totalCompressed / Math.max(1, entries));
-	}
-};
-function createCacheAdapters(detailedDataManager, codeCache, codeCompressor) {
-	return [
-		new DetailedDataManagerAdapter(detailedDataManager),
-		new CodeCacheAdapter(codeCache),
-		new CodeCompressorAdapter(codeCompressor)
-	];
-}
-//#endregion
-export { createCacheAdapters };

package/dist/CodeInjector-BdjRfNx7.mjs

@@ -1,150 +0,0 @@
-import { A as CODE_CAVE_MIN_SIZE } from "./constants-CDZLOoVv.mjs";
-import { _ as WriteProcessMemory, b as openProcessForMemory, d as ReadProcessMemory, f as VirtualAllocEx, h as VirtualQueryEx, l as MEM, m as VirtualProtectEx, p as VirtualFreeEx, t as CloseHandle, u as PAGE } from "./Win32API-C2kjj0ze.mjs";
-import { l as FlushInstructionCache } from "./Win32Debug-CKrGOTpo.mjs";
-import { n as isExecutable } from "./NativeMemoryManager.utils-BBlAixF5.mjs";
-import { t as nativeMemoryManager } from "./NativeMemoryManager.impl-D9Lkovvn.mjs";
-import { randomUUID } from "node:crypto";
-//#region src/native/CodeInjector.ts
-/**
-* Code Injector — runtime code patching, NOP, code cave discovery.
-*
-* @module CodeInjector
-*/
-var CodeInjector = class {
-	patches = /* @__PURE__ */ new Map();
-	/** Write bytes to target process at address (runtime patch) */
-	async patchBytes(pid, address, bytes) {
-		const addr = BigInt(address.startsWith("0x") ? address : `0x${address}`);
-		const patchBuf = Buffer.from(bytes);
-		const handle = openProcessForMemory(pid, true);
-		try {
-			const originalBuf = ReadProcessMemory(handle, addr, patchBuf.length);
-			const { success: protOk, oldProtect } = VirtualProtectEx(handle, addr, patchBuf.length, PAGE.EXECUTE_READWRITE);
-			WriteProcessMemory(handle, addr, patchBuf);
-			FlushInstructionCache(handle, addr, patchBuf.length);
-			if (protOk) VirtualProtectEx(handle, addr, patchBuf.length, oldProtect);
-			const op = {
-				id: randomUUID(),
-				pid,
-				address: `0x${addr.toString(16).toUpperCase()}`,
-				originalBytes: Array.from(originalBuf),
-				patchBytes: bytes,
-				isApplied: true,
-				timestamp: Date.now()
-			};
-			this.patches.set(op.id, op);
-			return op;
-		} finally {
-			CloseHandle(handle);
-		}
-	}
-	/** Restore original bytes from a previous patch */
-	async unpatch(patchId) {
-		const patch = this.patches.get(patchId);
-		if (!patch?.isApplied) return false;
-		const addr = BigInt(patch.address);
-		const originalBuf = Buffer.from(patch.originalBytes);
-		const handle = openProcessForMemory(patch.pid, true);
-		try {
-			const { oldProtect } = VirtualProtectEx(handle, addr, originalBuf.length, PAGE.EXECUTE_READWRITE);
-			WriteProcessMemory(handle, addr, originalBuf);
-			FlushInstructionCache(handle, addr, originalBuf.length);
-			VirtualProtectEx(handle, addr, originalBuf.length, oldProtect);
-			patch.isApplied = false;
-			return true;
-		} finally {
-			CloseHandle(handle);
-		}
-	}
-	/** NOP out instructions at address (replace with 0x90) */
-	async nopBytes(pid, address, count) {
-		const nops = Array.from({ length: count }, () => 144);
-		return this.patchBytes(pid, address, nops);
-	}
-	/** Find code caves (runs of 0x00 or 0xCC in executable sections) */
-	async findCodeCaves(pid, minSize) {
-		const min = minSize ?? CODE_CAVE_MIN_SIZE;
-		const caves = [];
-		const handle = openProcessForMemory(pid, false);
-		try {
-			const modules = await nativeMemoryManager.enumerateModules(pid);
-			if (!modules.success || !modules.modules) return caves;
-			for (const mod of modules.modules) {
-				const modBase = BigInt(mod.baseAddress.startsWith("0x") ? mod.baseAddress : `0x${mod.baseAddress}`);
-				let addr = modBase;
-				const modEnd = modBase + BigInt(mod.size);
-				while (addr < modEnd) {
-					const { success, info } = VirtualQueryEx(handle, addr);
-					if (!success || info.RegionSize === 0n) break;
-					const regionSize = Number(info.RegionSize);
-					if (isExecutable(info.Protect) && regionSize > 0) try {
-						const chunk = ReadProcessMemory(handle, info.BaseAddress, Math.min(regionSize, 4 * 1024 * 1024));
-						let caveStart = -1;
-						for (let i = 0; i < chunk.length; i++) {
-							const b = chunk[i];
-							if (b === 0 || b === 204) {
-								if (caveStart === -1) caveStart = i;
-							} else if (caveStart !== -1) {
-								const caveSize = i - caveStart;
-								if (caveSize >= min) {
-									const caveAddr = info.BaseAddress + BigInt(caveStart);
-									caves.push({
-										address: `0x${caveAddr.toString(16).toUpperCase()}`,
-										size: caveSize,
-										module: mod.name,
-										section: ".text"
-									});
-								}
-								caveStart = -1;
-							}
-						}
-						if (caveStart !== -1) {
-							const caveSize = chunk.length - caveStart;
-							if (caveSize >= min) {
-								const caveAddr = info.BaseAddress + BigInt(caveStart);
-								caves.push({
-									address: `0x${caveAddr.toString(16).toUpperCase()}`,
-									size: caveSize,
-									module: mod.name,
-									section: ".text"
-								});
-							}
-						}
-					} catch {}
-					addr = info.BaseAddress + info.RegionSize;
-				}
-			}
-		} finally {
-			CloseHandle(handle);
-		}
-		return caves.toSorted((a, b) => b.size - a.size);
-	}
-	/** Allocate executable memory in target process */
-	async allocateRemote(pid, size) {
-		const handle = openProcessForMemory(pid, true);
-		try {
-			const addr = VirtualAllocEx(handle, 0n, size, MEM.COMMIT | MEM.RESERVE, PAGE.EXECUTE_READWRITE);
-			if (addr === 0n) throw new Error("VirtualAllocEx failed");
-			return `0x${addr.toString(16).toUpperCase()}`;
-		} finally {
-			CloseHandle(handle);
-		}
-	}
-	/** Free remote memory */
-	async freeRemote(pid, address, _size) {
-		const addr = BigInt(address.startsWith("0x") ? address : `0x${address}`);
-		const handle = openProcessForMemory(pid, true);
-		try {
-			return VirtualFreeEx(handle, addr, 0, MEM.RELEASE);
-		} finally {
-			CloseHandle(handle);
-		}
-	}
-	/** List all active patches */
-	listPatches() {
-		return Array.from(this.patches.values());
-	}
-};
-const codeInjector = new CodeInjector();
-//#endregion
-export { CodeInjector, codeInjector };