@memoryprocess/bindings 0.0.0-stage → 0.0.3-beta.2

package/native/module.h

@@ -0,0 +1,55 @@
+#pragma once
+#include <napi.h>
+#include "process.h"
+
+namespace mp {
+
+Napi::Value OpenProcessSync(const Napi::CallbackInfo& info);
+Napi::Value CloseHandleSync(const Napi::CallbackInfo& info);
+Napi::Value ListProcessesSync(const Napi::CallbackInfo& info);
+Napi::Value GetModulesSync(const Napi::CallbackInfo& info);
+Napi::Value GetRegionsSync(const Napi::CallbackInfo& info);
+Napi::Value ReadValueSync(const Napi::CallbackInfo& info);
+Napi::Value WriteValueSync(const Napi::CallbackInfo& info);
+Napi::Value ReadBufferSync(const Napi::CallbackInfo& info);
+Napi::Value WriteBufferSync(const Napi::CallbackInfo& info);
+Napi::Value ScanAsync(const Napi::CallbackInfo& info);
+
+// v2 Tier-1/2 additions
+Napi::Value AllocMemorySync(const Napi::CallbackInfo& info);      // VirtualAllocEx
+Napi::Value FreeMemorySync(const Napi::CallbackInfo& info);       // VirtualFreeEx
+Napi::Value ProtectMemorySync(const Napi::CallbackInfo& info);    // VirtualProtectEx
+Napi::Value IsWow64Sync(const Napi::CallbackInfo& info);          // IsWow64Process
+Napi::Value ListThreadsSync(const Napi::CallbackInfo& info);      // TH32CS_SNAPTHREAD
+Napi::Value SuspendThreadSync(const Napi::CallbackInfo& info);    // OpenThread+SuspendThread
+Napi::Value ResumeThreadSync(const Napi::CallbackInfo& info);     // OpenThread+ResumeThread
+
+// v2 final-batch additions
+Napi::Value ReadSafeSync(const Napi::CallbackInfo& info);         // VirtualQueryEx walk + zero-fill
+Napi::Value FlushInstructionsSync(const Napi::CallbackInfo& info);// FlushInstructionCache
+Napi::Value InjectDllSync(const Napi::CallbackInfo& info);        // LoadLibraryA remote thread
+Napi::Value EjectDllSync(const Napi::CallbackInfo& info);         // FreeLibrary remote thread
+
+// v2 Tier-3 additions
+Napi::Value QueryAddressSync(const Napi::CallbackInfo& info);     // single VirtualQueryEx
+Napi::Value GetThreadContextSync(const Napi::CallbackInfo& info); // GetThreadContext (CONTEXT_ALL|DEBUG)
+Napi::Value SetThreadContextSync(const Napi::CallbackInfo& info); // patch fields + SetThreadContext
+Napi::Value CallRemoteSync(const Napi::CallbackInfo& info);       // CreateRemoteThread + wait
+
+// v2 disasm (HDE64 length decode)
+Napi::Value DisasmInstructionsSync(const Napi::CallbackInfo& info); // hde64_disasm walk
+
+// v2.1 additions
+Napi::Value ScanValueAsync(const Napi::CallbackInfo& info);          // typed value scan (rolling window)
+Napi::Value SuspendProcessSync(const Napi::CallbackInfo& info);      // NtSuspendProcess
+Napi::Value ResumeProcessSync(const Napi::CallbackInfo& info);       // NtResumeProcess
+Napi::Value EnableDebugPrivilegeSync(const Napi::CallbackInfo& info);// SeDebugPrivilege on self
+Napi::Value WaitForExitAsync(const Napi::CallbackInfo& info);        // async WaitForSingleObject
+Napi::Value FindWhatWritesAsync(const Napi::CallbackInfo& info);     // DebugActiveProcess + HW write-bp loop
+
+// QA4 hardening additions
+Napi::Value HookStealSync(const Napi::CallbackInfo& info);           // steal+relocate-check for hook
+Napi::Value WriteProtectedMemorySync(const Napi::CallbackInfo& info);// per-region protect/write/restore
+Napi::Value CurrentThreadIdSync(const Napi::CallbackInfo& info);     // GetCurrentThreadId (suspendAll)
+
+} // namespace mp

package/native/pattern.cc

@@ -0,0 +1,304 @@
+#include "module.h"
+#include "memory.h"
+#include <string>
+#include <vector>
+#include <optional>
+#include <cstring>
+
+namespace mp {
+
+struct PatternByte { std::uint8_t value; bool wildcard; };
+
+// Parse a hex-byte pattern ("DE AD ?? EF"). Tokens must be 1-2 hex digits or
+// ?/?? wildcards. Returns nullopt on ANY malformed token - the caller turns
+// this into a JS error; no C++ exception can cross the N-API boundary.
+static std::optional<std::vector<PatternByte>> ParsePattern(const std::string& pat) {
+  std::vector<PatternByte> out;
+  std::string tok;
+  auto flush = [&]() -> bool {
+    if (tok.empty()) return true;
+    if (tok == "?" || tok == "??") { out.push_back({0, true}); tok.clear(); return true; }
+    if (tok.size() > 2 || tok.find('?') != std::string::npos) return false;
+    unsigned long v = 0;
+    for (char c : tok) {
+      v <<= 4;
+      if (c >= '0' && c <= '9') v |= static_cast<unsigned long>(c - '0');
+      else if (c >= 'a' && c <= 'f') v |= static_cast<unsigned long>(c - 'a' + 10);
+      else if (c >= 'A' && c <= 'F') v |= static_cast<unsigned long>(c - 'A' + 10);
+      else return false;
+    }
+    out.push_back({static_cast<std::uint8_t>(v & 0xff), false});
+    tok.clear();
+    return true;
+  };
+  for (size_t i = 0; i <= pat.size(); i++) {
+    char c = i < pat.size() ? pat[i] : ' ';
+    if (c == ' ' || c == '\t' || c == '\r' || c == '\n') {
+      if (!flush()) return std::nullopt;
+    } else tok += c;
+  }
+  if (out.empty()) return std::nullopt;
+  return out;
+}
+
+static const std::size_t CHUNK = 64 * 1024;
+static const std::uintptr_t USER_TOP = 0x7FFFFFFFFFFFULL;
+
+static inline bool RegionReadable(const MEMORY_BASIC_INFORMATION& mbi) {
+  return (mbi.State == MEM_COMMIT) &&
+         !(mbi.Protect & (PAGE_NOACCESS | PAGE_GUARD)) &&
+         (mbi.Protect & (PAGE_READONLY | PAGE_READWRITE | PAGE_WRITECOPY |
+                         PAGE_EXECUTE_READ | PAGE_EXECUTE_READWRITE | PAGE_EXECUTE_WRITECOPY));
+}
+static inline bool RegionWritable(const MEMORY_BASIC_INFORMATION& mbi) {
+  return (mbi.State == MEM_COMMIT) &&
+         !(mbi.Protect & (PAGE_NOACCESS | PAGE_GUARD)) &&
+         (mbi.Protect & (PAGE_READWRITE | PAGE_WRITECOPY |
+                         PAGE_EXECUTE_READWRITE | PAGE_EXECUTE_WRITECOPY));
+}
+
+// Async region-scan worker shared by the AOB scan and the typed-value scan.
+// Runs with a PRIVATE least-privilege process handle opened from the pid (a
+// JS-side close() can never invalidate it mid-scan), and scans each committed
+// range with a rolling window - 64KB chunks plus a (needle-1)-byte overlap - 
+// so multi-hundred-MB regions never accumulate in memory.
+class ScanWorker : public Napi::AsyncWorker {
+public:
+  ScanWorker(Napi::Env env, Napi::Promise::Deferred deferred, DWORD pid,
+             std::vector<PatternByte> pat, std::uintptr_t start, std::uintptr_t end,
+             bool onlyReadable)
+      : Napi::AsyncWorker(env), deferred_(deferred), pid_(pid), pat_(std::move(pat)),
+        start_(start), end_(end), onlyReadable_(onlyReadable) {}
+
+  ScanWorker(Napi::Env env, Napi::Promise::Deferred deferred, DWORD pid,
+             std::vector<std::uint8_t> needle, std::uintptr_t start, std::uintptr_t end,
+             bool onlyWritable, std::size_t alignment)
+      : Napi::AsyncWorker(env), deferred_(deferred), pid_(pid), needle_(std::move(needle)),
+        start_(start), end_(end), valueMode_(true), onlyWritable_(onlyWritable),
+        alignment_(alignment) {}
+
+  ~ScanWorker() override { if (proc_) CloseHandle(proc_); }
+
+  void Execute() override {
+    proc_ = OpenProcess(PROCESS_VM_READ | PROCESS_QUERY_INFORMATION, FALSE, pid_);
+    if (!proc_) { SetError("OpenProcess failed (pid gone or access denied)"); return; }
+
+    // QA4 lifecycle-M1: a C++ exception (bad_alloc in hits_ growth or the
+    // per-chunk vector) escaping Execute() used to skip CloseHandle - a real
+    // handle leak under memory pressure, every scan call. Guard all exits.
+    try {
+      const std::uintptr_t limit = end_ ? end_ : USER_TOP;
+      MEMORY_BASIC_INFORMATION mbi{};
+      std::uintptr_t addr = start_;
+      while (addr < limit) {
+        if (!VirtualQueryEx(proc_, reinterpret_cast<LPCVOID>(addr), &mbi, sizeof(mbi))) break;
+        const std::uintptr_t rBase = reinterpret_cast<std::uintptr_t>(mbi.BaseAddress);
+        const std::uintptr_t rEnd = rBase + mbi.RegionSize;
+        if (mbi.RegionSize == 0) break;
+        const bool ok = valueMode_
+            ? (onlyWritable_ ? RegionWritable(mbi) : RegionReadable(mbi) ||
+               ((mbi.State == MEM_COMMIT) && !(mbi.Protect & (PAGE_NOACCESS | PAGE_GUARD))))
+            : (onlyReadable_ ? RegionReadable(mbi)
+                             : ((mbi.State == MEM_COMMIT) && !(mbi.Protect & (PAGE_NOACCESS | PAGE_GUARD))));
+        if (ok) {
+          // clamp window to [start_, limit)
+          const std::uintptr_t s = rBase > start_ ? rBase : start_;
+          const std::uintptr_t e = rEnd < limit ? rEnd : limit;
+          if (s < e) ScanRange(s, e);
+        }
+        addr = rEnd;
+      }
+    } catch (const std::exception& e) {
+      CloseHandle(proc_);
+      proc_ = nullptr;
+      SetError(std::string("scan failed: ") + e.what());
+      return;
+    } catch (...) {
+      CloseHandle(proc_);
+      proc_ = nullptr;
+      SetError("scan failed: unknown exception");
+      return;
+    }
+    CloseHandle(proc_);
+    proc_ = nullptr;
+  }
+
+  void OnOK() override {
+    auto arr = Napi::Array::New(Env(), hits_.size());
+    for (size_t i = 0; i < hits_.size(); i++)
+      arr.Set(i, Napi::BigInt::New(Env(), static_cast<std::uint64_t>(hits_[i])));
+    deferred_.Resolve(arr);
+  }
+
+  void OnError(const Napi::Error& e) override { deferred_.Reject(e.Value()); }
+
+private:
+  std::size_t NeedleLen() const { return valueMode_ ? needle_.size() : pat_.size(); }
+
+  bool MatchAt(const std::uint8_t* p) const {
+    if (valueMode_) return std::memcmp(p, needle_.data(), needle_.size()) == 0;
+    for (std::size_t j = 0; j < pat_.size(); j++)
+      if (!pat_[j].wildcard && p[j] != pat_[j].value) return false;
+    return true;
+  }
+
+  // Rolling-window scan of the committed VA range [lo, hi).
+  void ScanRange(std::uintptr_t lo, std::uintptr_t hi) {
+    const std::size_t patLen = NeedleLen();
+    const std::size_t overlap = patLen - 1;
+    std::vector<std::uint8_t> tail;   // last `overlap` bytes read (contiguity kept)
+    std::uintptr_t pos = lo;
+    while (pos < hi) {
+      const std::size_t toRead =
+          (hi - pos > CHUNK) ? CHUNK : static_cast<std::size_t>(hi - pos);
+      std::vector<std::uint8_t> chunk(toRead);
+      SIZE_T got = 0;
+      if (!ReadProcessMemory(proc_, reinterpret_cast<LPCVOID>(pos),
+                             chunk.data(), toRead, &got) || got == 0) {
+        tail.clear(); // VA discontinuity: a match can't straddle a failed read
+        // Don't blindly skip the whole 64KB chunk - a single inaccessible
+        // page inside a readable region would drop signatures CE finds.
+        // Re-query the sub-region at `pos`: skip only up to its end, or just
+        // one 4KB page when the sub-region still claims to be readable (the
+        // failure was a commit/protection race beyond the first page).
+        MEMORY_BASIC_INFORMATION smbi{};
+        std::uintptr_t next = pos + toRead;
+        if (VirtualQueryEx(proc_, reinterpret_cast<LPCVOID>(pos), &smbi, sizeof(smbi))) {
+          const std::uintptr_t sEnd =
+              reinterpret_cast<std::uintptr_t>(smbi.BaseAddress) + smbi.RegionSize;
+          const bool subOk = valueMode_
+              ? (onlyWritable_ ? RegionWritable(smbi) : RegionReadable(smbi))
+              : (onlyReadable_ ? RegionReadable(smbi)
+                               : ((smbi.State == MEM_COMMIT) &&
+                                  !(smbi.Protect & (PAGE_NOACCESS | PAGE_GUARD))));
+          next = subOk ? pos + 0x1000 : (sEnd > pos ? sEnd : pos + 0x1000);
+        }
+        if (next <= pos) next = pos + toRead; // never stall the walk
+        pos = next > hi ? hi : next;
+        continue;
+      }
+      chunk.resize(got);
+      const std::size_t keep = tail.size() < overlap ? tail.size() : overlap;
+      // window = tail(keep) + chunk(got); window[0] is at VA (pos - keep)
+      std::vector<std::uint8_t> win;
+      win.reserve(keep + got);
+      win.insert(win.end(), tail.end() - static_cast<std::ptrdiff_t>(keep), tail.end());
+      win.insert(win.end(), chunk.begin(), chunk.end());
+      const std::uintptr_t winBase = pos - keep;
+      // match starts that touch >=1 new byte: i >= keep - overlap (clamped 0)
+      const std::size_t firstI = keep > overlap ? keep - overlap : 0;
+      if (win.size() >= patLen) {
+        const std::size_t lastI = win.size() - patLen; // inclusive
+        for (std::size_t i = firstI; i <= lastI; i++) {
+          const std::uintptr_t va = winBase + i;
+          if (va < start_ || va >= (end_ ? end_ : USER_TOP)) continue;
+          if (valueMode_ && alignment_ > 1 && (va % alignment_) != 0) continue;
+          if (MatchAt(win.data() + i)) hits_.push_back(va);
+        }
+      }
+      // keep the last `overlap` bytes for the next iteration
+      if (win.size() > overlap) tail.assign(win.end() - static_cast<std::ptrdiff_t>(overlap), win.end());
+      else tail = std::move(win);
+      pos += got; // short reads shrink the window, next read resumes at pos+got
+    }
+  }
+
+  Napi::Promise::Deferred deferred_;
+  DWORD pid_ = 0;
+  HANDLE proc_ = nullptr;
+  std::vector<PatternByte> pat_;
+  std::vector<std::uint8_t> needle_;
+  std::uintptr_t start_ = 0, end_ = 0;
+  bool onlyReadable_ = true;
+  bool valueMode_ = false;
+  bool onlyWritable_ = false;
+  std::size_t alignment_ = 0;
+  std::vector<std::uintptr_t> hits_;
+};
+
+Napi::Value ScanAsync(const Napi::CallbackInfo& info) {
+  Napi::Env env = info.Env();
+  // scan(pid, pattern[, {start,end,onlyReadable}]) -> Promise<bigint[]>
+  if (info.Length() < 2) {
+    Napi::TypeError::New(env, "expected (pid, pattern[, opts])").ThrowAsJavaScriptException();
+    return env.Null();
+  }
+  DWORD pid = info[0].As<Napi::Number>().Uint32Value();
+  std::string pat = info[1].As<Napi::String>().Utf8Value();
+  auto bytes = ParsePattern(pat);
+  if (!bytes) {
+    auto err = Napi::Error::New(env, "invalid pattern: expected hex bytes like \"DE AD ?? EF\"");
+    err.Set("code", "INVALID_PATTERN");
+    err.ThrowAsJavaScriptException();
+    return env.Null();
+  }
+
+  std::uintptr_t start = 0, end = 0;
+  bool onlyReadable = true;
+  if (info.Length() > 2 && info[2].IsObject()) {
+    auto o = info[2].As<Napi::Object>();
+    if (o.Get("start").IsNumber()) start = static_cast<std::uintptr_t>(o.Get("start").As<Napi::Number>().DoubleValue());
+    if (o.Get("end").IsNumber()) end = static_cast<std::uintptr_t>(o.Get("end").As<Napi::Number>().DoubleValue());
+    if (o.Get("onlyReadable").IsBoolean()) onlyReadable = o.Get("onlyReadable").As<Napi::Boolean>().Value();
+    // module/section ranges are resolved to start/end in the TS facade
+  }
+
+  auto deferred = Napi::Promise::Deferred::New(env);
+  auto promise = deferred.Promise();
+  auto* w = new ScanWorker(env, std::move(deferred), pid, std::move(*bytes), start, end, onlyReadable);
+  w->Queue();
+  return promise;
+}
+
+// scanValue(pid, needle[, {start,end,onlyWritable,alignment}]) -> Promise<bigint[]>
+// `needle` is a Buffer/Uint8Array holding the little-endian value bytes.
+Napi::Value ScanValueAsync(const Napi::CallbackInfo& info) {
+  Napi::Env env = info.Env();
+  if (info.Length() < 2 || !info[0].IsNumber()) {
+    Napi::TypeError::New(env, "expected (pid, needle[, opts])").ThrowAsJavaScriptException();
+    return env.Null();
+  }
+  DWORD pid = info[0].As<Napi::Number>().Uint32Value();
+  if (!info[1].IsBuffer() && !info[1].IsTypedArray()) {
+    Napi::TypeError::New(env, "needle must be a Buffer/Uint8Array").ThrowAsJavaScriptException();
+    return env.Null();
+  }
+  std::vector<std::uint8_t> needle;
+  if (info[1].IsBuffer()) {
+    auto b = info[1].As<Napi::Buffer<std::uint8_t>>();
+    needle.assign(b.Data(), b.Data() + b.Length());
+  } else {
+    auto ta = info[1].As<Napi::TypedArray>();
+    const auto* p = static_cast<const std::uint8_t*>(ta.ArrayBuffer().Data()) + ta.ByteOffset();
+    needle.assign(p, p + ta.ByteLength());
+  }
+  if (needle.empty() || needle.size() > 16) {
+    Napi::RangeError::New(env, "needle must be 1..16 bytes").ThrowAsJavaScriptException();
+    return env.Null();
+  }
+
+  std::uintptr_t start = 0, end = 0;
+  bool onlyWritable = true;
+  std::size_t alignment = needle.size();
+  if (info.Length() > 2 && info[2].IsObject()) {
+    auto o = info[2].As<Napi::Object>();
+    if (o.Get("start").IsNumber()) start = static_cast<std::uintptr_t>(o.Get("start").As<Napi::Number>().DoubleValue());
+    if (o.Get("end").IsNumber()) end = static_cast<std::uintptr_t>(o.Get("end").As<Napi::Number>().DoubleValue());
+    if (o.Get("onlyWritable").IsBoolean()) onlyWritable = o.Get("onlyWritable").As<Napi::Boolean>().Value();
+    if (o.Get("onlyReadable").IsBoolean() && !o.Get("onlyWritable").IsBoolean())
+      onlyWritable = !o.Get("onlyReadable").As<Napi::Boolean>().Value();
+    if (o.Get("alignment").IsNumber()) {
+      double a = o.Get("alignment").As<Napi::Number>().DoubleValue();
+      if (a >= 1 && a <= 4096) alignment = static_cast<std::size_t>(a);
+    }
+  }
+
+  auto deferred = Napi::Promise::Deferred::New(env);
+  auto promise = deferred.Promise();
+  auto* w = new ScanWorker(env, std::move(deferred), pid, std::move(needle),
+                           start, end, onlyWritable, alignment);
+  w->Queue();
+  return promise;
+}
+
+} // namespace mp

package/native/process.cc

@@ -0,0 +1,113 @@
+#include "process.h"
+#include <tlhelp32.h>
+#include <psapi.h>
+#include <system_error>
+
+namespace mp {
+
+static DWORD LastErr() { return GetLastError(); }
+
+HANDLE OpenByPid(DWORD pid, DWORD access) {
+  HANDLE h = OpenProcess(access, FALSE, pid);
+  if (!h) throw std::system_error(static_cast<int>(LastErr()), std::system_category(), "OpenProcess");
+  return h;
+}
+
+DWORD PidFromName(const std::string& name) {
+  HANDLE snap = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
+  if (snap == INVALID_HANDLE_VALUE) return 0;
+  PROCESSENTRY32W pe{};
+  pe.dwSize = sizeof(pe);
+  // case-insensitive wide compare
+  std::wstring want(name.begin(), name.end());
+  for (wchar_t& c : want) c = towlower(c);
+  DWORD found = 0;
+  if (Process32FirstW(snap, &pe)) {
+    do {
+      std::wstring cur(pe.szExeFile);
+      for (wchar_t& c : cur) c = towlower(c);
+      if (cur == want) { found = pe.th32ProcessID; break; }
+    } while (Process32NextW(snap, &pe));
+  }
+  CloseHandle(snap);
+  return found;
+}
+
+std::vector<ProcInfo> ListProcesses() {
+  std::vector<ProcInfo> out;
+  HANDLE snap = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
+  if (snap == INVALID_HANDLE_VALUE) return out;
+  PROCESSENTRY32W pe{};
+  pe.dwSize = sizeof(pe);
+  if (Process32FirstW(snap, &pe)) {
+    do {
+      char name[MAX_PATH];
+      size_t n = 0;
+      wcstombs_s(&n, name, pe.szExeFile, sizeof(name) - 1);
+      out.push_back({ pe.th32ProcessID, std::string(name) });
+    } while (Process32NextW(snap, &pe));
+  }
+  CloseHandle(snap);
+  return out;
+}
+
+static std::string WideToUtf8(const wchar_t* w) {
+  if (!w || !*w) return {};
+  int n = WideCharToMultiByte(CP_UTF8, 0, w, -1, nullptr, 0, nullptr, nullptr);
+  if (n <= 1) return {};
+  std::string s(static_cast<size_t>(n) - 1, '\0');
+  WideCharToMultiByte(CP_UTF8, 0, w, -1, s.data(), n, nullptr, nullptr);
+  return s;
+}
+
+std::vector<ModuleInfo> GetModules(HANDLE /*proc*/, DWORD pid) {
+  // Toolhelp snapshot - unlike EnumProcessModulesEx this lists BOTH 64-bit and
+  // 32-bit (WoW64) modules from a 64-bit reader, has no fixed-cap buffer, and
+  // hands us base+size+path in one shot.
+  std::vector<ModuleInfo> out;
+  HANDLE snap = CreateToolhelp32Snapshot(TH32CS_SNAPMODULE | TH32CS_SNAPMODULE32, pid);
+  if (snap == INVALID_HANDLE_VALUE) return out;
+  MODULEENTRY32W me{};
+  me.dwSize = sizeof(me);
+  if (Module32FirstW(snap, &me)) {
+    do {
+      out.push_back({ reinterpret_cast<std::uintptr_t>(me.modBaseAddr),
+                      static_cast<std::uint32_t>(me.modBaseSize),
+                      WideToUtf8(me.szExePath) });
+    } while (Module32NextW(snap, &me));
+  }
+  CloseHandle(snap);
+  return out;
+}
+
+ModuleInfo GetModule(HANDLE proc, DWORD pid, const std::string& name) {
+  auto mods = GetModules(proc, pid);
+  std::string want = name;
+  for (auto& c : want) c = static_cast<char>(tolower(c));
+  for (auto& m : mods) {
+    std::string base = m.path.substr(m.path.find_last_of("\\/") + 1);
+    for (auto& c : base) c = static_cast<char>(tolower(c));
+    if (base == want) return m;
+  }
+  return {};
+}
+
+std::vector<RegionInfo> GetRegions(HANDLE proc) {
+  std::vector<RegionInfo> out;
+  MEMORY_BASIC_INFORMATION mbi{};
+  std::uintptr_t addr = 0;
+  const std::uintptr_t max = 0x7FFFFFFFFFFFULL;
+  while (addr < max && VirtualQueryEx(proc, reinterpret_cast<LPCVOID>(addr), &mbi, sizeof(mbi))) {
+    if (mbi.State == MEM_COMMIT) {
+      out.push_back({ reinterpret_cast<std::uintptr_t>(mbi.BaseAddress),
+                      static_cast<std::size_t>(mbi.RegionSize),
+                      static_cast<std::uint32_t>(mbi.Protect),
+                      static_cast<std::uint32_t>(mbi.Type) });
+    }
+    addr = reinterpret_cast<std::uintptr_t>(mbi.BaseAddress) + mbi.RegionSize;
+    if (mbi.RegionSize == 0) break;
+  }
+  return out;
+}
+
+} // namespace mp

package/native/process.h

@@ -0,0 +1,36 @@
+#pragma once
+#include <napi.h>
+#include <windows.h>
+#include <string>
+#include <vector>
+
+namespace mp {
+
+struct ModuleInfo {
+  std::uintptr_t base;
+  std::uint32_t size;
+  std::string path;
+};
+
+struct RegionInfo {
+  std::uintptr_t baseAddress;
+  std::size_t size;
+  std::uint32_t protection;
+  std::uint32_t type;
+};
+
+struct ProcInfo {
+  std::uint32_t pid;
+  std::string name;
+};
+
+// Open a process by pid. Returns handle or throws via SetLastError mapping.
+HANDLE OpenByPid(DWORD pid, DWORD access);
+// Resolve a process name (e.g. "notepad.exe") to pid. 0 if not found.
+DWORD PidFromName(const std::string& name);
+std::vector<ProcInfo> ListProcesses();
+std::vector<ModuleInfo> GetModules(HANDLE proc, DWORD pid);
+ModuleInfo GetModule(HANDLE proc, DWORD pid, const std::string& name);
+std::vector<RegionInfo> GetRegions(HANDLE proc);
+
+} // namespace mp

package/package.json

@@ -1,6 +1,51 @@
 {
   "name": "@memoryprocess/bindings",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "0.0.3-beta.2",
+  "description": "Native N-API bindings for Windows process memory access (read/write, VirtualQueryEx, pattern scan, thread ops). The .node binary layer of the memoryprocess toolkit.",
+  "type": "module",
+  "packageManager": "bun@1.4.4",
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "exports": {
+    ".": {
+      "bun": "./src/index.ts",
+      "development": "./src/index.ts",
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    }
+  },
+  "files": [
+    "dist",
+    "prebuilds",
+    "binding.gyp",
+    "native"
+  ],
+  "os": [
+    "win32"
+  ],
+  "engines": {
+    "node": ">=22"
+  },
+  "scripts": {
+    "build": "node scripts/build.mjs",
+    "clean": "node scripts/clean.mjs",
+    "check": "bun check",
+    "typecheck": "tsc --noEmit",
+    "prebuild:all": "prebuildify --napi -t 22.17.0 -t 24.4.0 -t 25.0.0 -t 26.0.0",
+    "prepublishOnly": "npm run build && npm run prebuild:all"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/memoryprocess/memoryprocess.git",
+    "directory": "packages/bindings"
+  },
+  "author": "JoShMiQueL",
+  "license": "MIT",
+  "dependencies": {
+    "node-addon-api": "8.3.1",
+    "node-gyp-build": "4.8.4"
+  },
+  "trustedDependencies": [
+    "node-gyp-build"
+  ]
+}

package/README.md

@@ -1,3 +0,0 @@
-# Temporary Holding Version
-
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.