wowdump 0.2.0 → 0.3.1

package/dist/wow-analysis.js

@@ -1,8 +1,6 @@
 import { createHash } from "node:crypto";
 import { readFile } from "node:fs/promises";
 import { basename, join, resolve } from "node:path";
-import { brokerManagedCommand } from "./frida-runtime.js";
-import { BuildBundleStore } from "./build-bundle-loader.js";
 export const WOW_ANALYSIS_BUILD_KEY = "retail@12.0.7.68974";
 export const WOW_ANALYSIS_MODULE = "Wow.exe";
 export const WOW_IDA_IMAGE_BASE = "0x140000000";
@@ -192,208 +190,206 @@ function requireSelection(input) {
         throw new Error("an explicit API, namespace, glob, RVA, cluster, or all=true selection is required");
     }
 }
-const CPP_TRACE_SOURCE = String.raw `
-let catalog = null;
-let listeners = [];
-let events = [];
-let nextSeq = 1;
-let droppedEvents = 0;
-let active = false;
-let timer = null;
-let startedAt = null;
-let stoppedAt = null;
-let stopReason = null;
-const depthByThread = new Map();
-function emit(event, maxEvents) {
-  event.seq = nextSeq++;
-  if (events.length >= maxEvents) { events.shift(); droppedEvents++; }
-  events.push(event);
-}
-function stop(reason) {
-  const errors = [];
-  if (timer !== null) { clearTimeout(timer); timer = null; }
-  const detachedHooks = listeners.length;
-  for (const listener of listeners.splice(0)) {
-    try { listener.detach(); } catch (error) { errors.push(String(error)); }
-  }
-  depthByThread.clear();
-  active = false;
-  stoppedAt = new Date().toISOString();
-  stopReason = reason || 'requested';
-  return { ...status(), detachedHooks, detachErrors: errors };
-}
-function status() {
-  return {
-    active, buildKey: catalog && catalog.buildKey, moduleName: catalog && catalog.moduleName,
-    installedHooks: listeners.length, queuedEvents: events.length, droppedEvents,
-    startedAt, stoppedAt, stopReason
-  };
-}
-rpc.exports = {
-  configureCppTrace(value) {
-    stop('reconfigured');
-    catalog = value;
-    events = []; nextSeq = 1; droppedEvents = 0;
-    return { configured: true, buildKey: value.buildKey, targets: value.targets.length };
-  },
-  wowCppTraceStart(request) {
-    if (!catalog) throw new Error('C++ trace catalog is not configured');
-    if (active) throw new Error('C++ trace is already active');
-    if (request.buildKey !== catalog.buildKey) throw new Error('build mismatch');
-    if (request.pid !== undefined && request.pid !== Process.id) throw new Error('PID mismatch');
-    const module = Process.getModuleByName(catalog.moduleName);
-    const maxEvents = request.maxEvents;
-    const sampling = request.sampling;
-    const argumentCount = request.argumentCount;
-    for (const target of catalog.targets) {
-      const address = module.base.add(target.rvaNumber);
-      const range = Process.findRangeByAddress(address);
-      if (range === null || range.protection.indexOf('x') < 0) throw new Error('target is not executable: ' + target.id);
-      const listener = Interceptor.attach(address, {
-        onEnter(args) {
-          if (sampling < 1 && Math.random() > sampling) { this.__wowCppSkipped = true; return; }
-          const threadId = this.threadId;
-          const depth = (depthByThread.get(threadId) || 0) + 1;
-          depthByThread.set(threadId, depth);
-          this.__wowCppDepth = depth;
-          const captured = [];
-          if (request.captureArguments) {
-            for (let index = 0; index < argumentCount; index++) captured.push(args[index].toString());
-          }
-          emit({ type: 'cpp_trace_enter', timestamp: new Date().toISOString(), buildKey: catalog.buildKey,
-            moduleName: module.name, moduleBase: module.base.toString(), threadId, depth, target,
-            arguments: captured }, maxEvents);
-        },
-        onLeave(retval) {
-          if (this.__wowCppSkipped) return;
-          const threadId = this.threadId;
-          const depth = this.__wowCppDepth || depthByThread.get(threadId) || 1;
-          emit({ type: 'cpp_trace_leave', timestamp: new Date().toISOString(), buildKey: catalog.buildKey,
-            moduleName: module.name, moduleBase: module.base.toString(), threadId, depth, target,
-            returnValue: request.captureReturn ? retval.toString() : undefined }, maxEvents);
-          if (depth <= 1) depthByThread.delete(threadId); else depthByThread.set(threadId, depth - 1);
-        }
-      });
-      listeners.push(listener);
-    }
-    active = true; startedAt = new Date().toISOString(); stoppedAt = null; stopReason = null;
-    if (request.durationMs > 0) timer = setTimeout(() => stop('duration_elapsed'), request.durationMs);
-    return { ...status(), pid: Process.id, moduleBase: module.base.toString(), selectedTargets: catalog.targets.length };
-  },
-  wowCppTraceRead(afterSeq, limit) {
-    const selected = events.filter(event => event.seq > afterSeq).slice(0, limit);
-    return { events: selected, oldestSeq: events[0] ? events[0].seq : null,
-      newestSeq: events.length ? events[events.length - 1].seq : null,
-      nextAfterSeq: selected.length ? selected[selected.length - 1].seq : afterSeq, droppedEvents };
-  },
-  wowCppTraceStatus() { return status(); },
-  wowCppTraceStop(reason) { return stop(reason); },
-  dispose() { const result = stop('disposed'); catalog = null; return result; }
-};
+const CPP_TRACE_SOURCE = String.raw `
+let catalog = null;
+let listeners = [];
+let events = [];
+let nextSeq = 1;
+let droppedEvents = 0;
+let active = false;
+let timer = null;
+let startedAt = null;
+let stoppedAt = null;
+let stopReason = null;
+const depthByThread = new Map();
+function emit(event, maxEvents) {
+  event.seq = nextSeq++;
+  if (events.length >= maxEvents) { events.shift(); droppedEvents++; }
+  events.push(event);
+}
+function stop(reason) {
+  const errors = [];
+  if (timer !== null) { clearTimeout(timer); timer = null; }
+  const detachedHooks = listeners.length;
+  for (const listener of listeners.splice(0)) {
+    try { listener.detach(); } catch (error) { errors.push(String(error)); }
+  }
+  depthByThread.clear();
+  active = false;
+  stoppedAt = new Date().toISOString();
+  stopReason = reason || 'requested';
+  return { ...status(), detachedHooks, detachErrors: errors };
+}
+function status() {
+  return {
+    active, buildKey: catalog && catalog.buildKey, moduleName: catalog && catalog.moduleName,
+    installedHooks: listeners.length, queuedEvents: events.length, droppedEvents,
+    startedAt, stoppedAt, stopReason
+  };
+}
+rpc.exports = {
+  configureCppTrace(value) {
+    stop('reconfigured');
+    catalog = value;
+    events = []; nextSeq = 1; droppedEvents = 0;
+    return { configured: true, buildKey: value.buildKey, targets: value.targets.length };
+  },
+  wowCppTraceStart(request) {
+    if (!catalog) throw new Error('C++ trace catalog is not configured');
+    if (active) throw new Error('C++ trace is already active');
+    if (request.buildKey !== catalog.buildKey) throw new Error('build mismatch');
+    if (request.pid !== undefined && request.pid !== Process.id) throw new Error('PID mismatch');
+    const module = Process.getModuleByName(catalog.moduleName);
+    const maxEvents = request.maxEvents;
+    const sampling = request.sampling;
+    const argumentCount = request.argumentCount;
+    for (const target of catalog.targets) {
+      const address = module.base.add(target.rvaNumber);
+      const range = Process.findRangeByAddress(address);
+      if (range === null || range.protection.indexOf('x') < 0) throw new Error('target is not executable: ' + target.id);
+      const listener = Interceptor.attach(address, {
+        onEnter(args) {
+          if (sampling < 1 && Math.random() > sampling) { this.__wowCppSkipped = true; return; }
+          const threadId = this.threadId;
+          const depth = (depthByThread.get(threadId) || 0) + 1;
+          depthByThread.set(threadId, depth);
+          this.__wowCppDepth = depth;
+          const captured = [];
+          if (request.captureArguments) {
+            for (let index = 0; index < argumentCount; index++) captured.push(args[index].toString());
+          }
+          emit({ type: 'cpp_trace_enter', timestamp: new Date().toISOString(), buildKey: catalog.buildKey,
+            moduleName: module.name, moduleBase: module.base.toString(), threadId, depth, target,
+            arguments: captured }, maxEvents);
+        },
+        onLeave(retval) {
+          if (this.__wowCppSkipped) return;
+          const threadId = this.threadId;
+          const depth = this.__wowCppDepth || depthByThread.get(threadId) || 1;
+          emit({ type: 'cpp_trace_leave', timestamp: new Date().toISOString(), buildKey: catalog.buildKey,
+            moduleName: module.name, moduleBase: module.base.toString(), threadId, depth, target,
+            returnValue: request.captureReturn ? retval.toString() : undefined }, maxEvents);
+          if (depth <= 1) depthByThread.delete(threadId); else depthByThread.set(threadId, depth - 1);
+        }
+      });
+      listeners.push(listener);
+    }
+    active = true; startedAt = new Date().toISOString(); stoppedAt = null; stopReason = null;
+    if (request.durationMs > 0) timer = setTimeout(() => stop('duration_elapsed'), request.durationMs);
+    return { ...status(), pid: Process.id, moduleBase: module.base.toString(), selectedTargets: catalog.targets.length };
+  },
+  wowCppTraceRead(afterSeq, limit) {
+    const selected = events.filter(event => event.seq > afterSeq).slice(0, limit);
+    return { events: selected, oldestSeq: events[0] ? events[0].seq : null,
+      newestSeq: events.length ? events[events.length - 1].seq : null,
+      nextAfterSeq: selected.length ? selected[selected.length - 1].seq : afterSeq, droppedEvents };
+  },
+  wowCppTraceStatus() { return status(); },
+  wowCppTraceStop(reason) { return stop(reason); },
+  dispose() { const result = stop('disposed'); catalog = null; return result; }
+};
 `;
-const DATA_READER_SOURCE = String.raw `
-function readable(address, size) {
-  const range = Process.findRangeByAddress(address);
-  if (range === null || range.protection.indexOf('r') < 0) throw new Error('unreadable address ' + address);
-  const end = address.add(size);
-  if (end.compare(range.base.add(range.size)) > 0) throw new Error('read crosses range at ' + address);
-}
-function readField(base, field, maxStringBytes) {
-  const address = base.add(field.offset);
-  const sizeByKind = { bool: 1, u8: 1, s8: 1, u16: 2, s16: 2, u32: 4, s32: 4,
-    float: 4, u64: 8, s64: 8, double: 8, pointer: Process.pointerSize };
-  if (field.kind === 'utf8') {
-    const length = Math.min(field.maxBytes || maxStringBytes, maxStringBytes);
-    readable(address, 1);
-    return address.readUtf8String(length);
-  }
-  if (field.kind === 'bytes') {
-    const length = field.size;
-    readable(address, length);
-    const value = address.readByteArray(length);
-    return Array.from(new Uint8Array(value)).map(v => v.toString(16).padStart(2, '0')).join('');
-  }
-  const size = sizeByKind[field.kind];
-  if (!size) throw new Error('unsupported field kind ' + field.kind);
-  readable(address, size);
-  switch (field.kind) {
-    case 'bool': return address.readU8() !== 0;
-    case 'u8': return address.readU8(); case 's8': return address.readS8();
-    case 'u16': return address.readU16(); case 's16': return address.readS16();
-    case 'u32': return address.readU32(); case 's32': return address.readS32();
-    case 'float': return address.readFloat(); case 'double': return address.readDouble();
-    case 'u64': return address.readU64().toString(); case 's64': return address.readS64().toString();
-    case 'pointer': return address.readPointer().toString();
-  }
-}
-function validateInvariant(rule, address, fields, module) {
-  if (rule.kind === 'non_null') return { kind: rule.kind, passed: !address.isNull() };
-  if (rule.kind === 'aligned') return { kind: rule.kind, passed: address.and(rule.alignment - 1).isNull() };
-  if (rule.kind === 'field_range') {
-    const value = Number(fields[rule.field]);
-    return { kind: rule.kind, field: rule.field, passed: Number.isFinite(value) && value >= rule.minimum && value <= rule.maximum };
-  }
-  if (rule.kind === 'field_equals') return { kind: rule.kind, field: rule.field, passed: String(fields[rule.field]) === String(rule.value) };
-  if (rule.kind === 'vtable_in_module') {
-    const pointer = address.add(rule.offset || 0).readPointer();
-    const passed = pointer.compare(module.base) >= 0 && pointer.compare(module.base.add(module.size)) < 0;
-    return { kind: rule.kind, pointer: pointer.toString(), passed };
-  }
-  return { kind: rule.kind, passed: false, error: 'unsupported invariant' };
-}
-rpc.exports = {
-  readDataSource(plan, requestedLimit) {
-    const module = Process.getModuleByName(plan.moduleName);
-    const rva = Number(plan.root.rva);
-    if (!Number.isSafeInteger(rva) || rva < 0 || rva >= module.size) {
-      return { allPassed: false, error: 'root RVA is outside module', moduleBase: module.base.toString() };
-    }
-    try {
-      const rootAddress = module.base.add(rva);
-      let address = rootAddress;
-      if (plan.root.kind === 'global_pointer_rva') { readable(address, Process.pointerSize); address = address.readPointer(); }
-      for (const step of plan.pointerChain) {
-        address = address.add(step.offset);
-        if (step.dereference) { readable(address, Process.pointerSize); address = address.readPointer(); }
-      }
-      if (address.isNull()) throw new Error('resolved root is null');
-      const fields = {};
-      for (const field of plan.fields) fields[field.name] = readField(address, field, plan.maxStringBytes);
-      const validations = plan.invariants.map(rule => validateInvariant(rule, address, fields, module));
-      const result = { dataSourceId: plan.dataSourceId, buildKey: plan.buildKey, moduleName: module.name,
-        moduleBase: module.base.toString(), rootRva: plan.root.rva, rootAddress: rootAddress.toString(),
-        resolvedAddress: address.toString(), fields, validations, items: [] };
-      if (plan.container && plan.container.kind === 'vector') {
-        const begin = address.add(plan.container.beginOffset).readPointer();
-        const end = address.add(plan.container.endOffset).readPointer();
-        const byteLength = Number(BigInt(end.toString()) - BigInt(begin.toString()));
-        const elementSize = plan.container.elementSize;
-        const count = byteLength >= 0 && byteLength % elementSize === 0 ? byteLength / elementSize : -1;
-        const limit = Math.min(requestedLimit, plan.maxItems);
-        validations.push({ kind: 'vector_bounds', passed: count >= 0 && count <= plan.maxItems, count });
-        if (count >= 0 && count <= plan.maxItems) {
-          for (let index = 0; index < Math.min(count, limit); index++) {
-            const itemAddress = begin.add(index * elementSize);
-            const item = {};
-            for (const field of plan.container.fields || []) item[field.name] = readField(itemAddress, field, plan.maxStringBytes);
-            result.items.push({ index, address: itemAddress.toString(), fields: item });
-          }
-        }
-      }
-      result.allPassed = validations.length > 0 && validations.every(item => item.passed === true);
-      return result;
-    } catch (error) {
-      return { dataSourceId: plan.dataSourceId, buildKey: plan.buildKey, moduleName: module.name,
-        moduleBase: module.base.toString(), rootRva: plan.root.rva, allPassed: false, error: String(error) };
-    }
-  }
-};
+const DATA_READER_SOURCE = String.raw `
+function readable(address, size) {
+  const range = Process.findRangeByAddress(address);
+  if (range === null || range.protection.indexOf('r') < 0) throw new Error('unreadable address ' + address);
+  const end = address.add(size);
+  if (end.compare(range.base.add(range.size)) > 0) throw new Error('read crosses range at ' + address);
+}
+function readField(base, field, maxStringBytes) {
+  const address = base.add(field.offset);
+  const sizeByKind = { bool: 1, u8: 1, s8: 1, u16: 2, s16: 2, u32: 4, s32: 4,
+    float: 4, u64: 8, s64: 8, double: 8, pointer: Process.pointerSize };
+  if (field.kind === 'utf8') {
+    const length = Math.min(field.maxBytes || maxStringBytes, maxStringBytes);
+    readable(address, 1);
+    return address.readUtf8String(length);
+  }
+  if (field.kind === 'bytes') {
+    const length = field.size;
+    readable(address, length);
+    const value = address.readByteArray(length);
+    return Array.from(new Uint8Array(value)).map(v => v.toString(16).padStart(2, '0')).join('');
+  }
+  const size = sizeByKind[field.kind];
+  if (!size) throw new Error('unsupported field kind ' + field.kind);
+  readable(address, size);
+  switch (field.kind) {
+    case 'bool': return address.readU8() !== 0;
+    case 'u8': return address.readU8(); case 's8': return address.readS8();
+    case 'u16': return address.readU16(); case 's16': return address.readS16();
+    case 'u32': return address.readU32(); case 's32': return address.readS32();
+    case 'float': return address.readFloat(); case 'double': return address.readDouble();
+    case 'u64': return address.readU64().toString(); case 's64': return address.readS64().toString();
+    case 'pointer': return address.readPointer().toString();
+  }
+}
+function validateInvariant(rule, address, fields, module) {
+  if (rule.kind === 'non_null') return { kind: rule.kind, passed: !address.isNull() };
+  if (rule.kind === 'aligned') return { kind: rule.kind, passed: address.and(rule.alignment - 1).isNull() };
+  if (rule.kind === 'field_range') {
+    const value = Number(fields[rule.field]);
+    return { kind: rule.kind, field: rule.field, passed: Number.isFinite(value) && value >= rule.minimum && value <= rule.maximum };
+  }
+  if (rule.kind === 'field_equals') return { kind: rule.kind, field: rule.field, passed: String(fields[rule.field]) === String(rule.value) };
+  if (rule.kind === 'vtable_in_module') {
+    const pointer = address.add(rule.offset || 0).readPointer();
+    const passed = pointer.compare(module.base) >= 0 && pointer.compare(module.base.add(module.size)) < 0;
+    return { kind: rule.kind, pointer: pointer.toString(), passed };
+  }
+  return { kind: rule.kind, passed: false, error: 'unsupported invariant' };
+}
+rpc.exports = {
+  readDataSource(plan, requestedLimit) {
+    const module = Process.getModuleByName(plan.moduleName);
+    const rva = Number(plan.root.rva);
+    if (!Number.isSafeInteger(rva) || rva < 0 || rva >= module.size) {
+      return { allPassed: false, error: 'root RVA is outside module', moduleBase: module.base.toString() };
+    }
+    try {
+      const rootAddress = module.base.add(rva);
+      let address = rootAddress;
+      if (plan.root.kind === 'global_pointer_rva') { readable(address, Process.pointerSize); address = address.readPointer(); }
+      for (const step of plan.pointerChain) {
+        address = address.add(step.offset);
+        if (step.dereference) { readable(address, Process.pointerSize); address = address.readPointer(); }
+      }
+      if (address.isNull()) throw new Error('resolved root is null');
+      const fields = {};
+      for (const field of plan.fields) fields[field.name] = readField(address, field, plan.maxStringBytes);
+      const validations = plan.invariants.map(rule => validateInvariant(rule, address, fields, module));
+      const result = { dataSourceId: plan.dataSourceId, buildKey: plan.buildKey, moduleName: module.name,
+        moduleBase: module.base.toString(), rootRva: plan.root.rva, rootAddress: rootAddress.toString(),
+        resolvedAddress: address.toString(), fields, validations, items: [] };
+      if (plan.container && plan.container.kind === 'vector') {
+        const begin = address.add(plan.container.beginOffset).readPointer();
+        const end = address.add(plan.container.endOffset).readPointer();
+        const byteLength = Number(BigInt(end.toString()) - BigInt(begin.toString()));
+        const elementSize = plan.container.elementSize;
+        const count = byteLength >= 0 && byteLength % elementSize === 0 ? byteLength / elementSize : -1;
+        const limit = Math.min(requestedLimit, plan.maxItems);
+        validations.push({ kind: 'vector_bounds', passed: count >= 0 && count <= plan.maxItems, count });
+        if (count >= 0 && count <= plan.maxItems) {
+          for (let index = 0; index < Math.min(count, limit); index++) {
+            const itemAddress = begin.add(index * elementSize);
+            const item = {};
+            for (const field of plan.container.fields || []) item[field.name] = readField(itemAddress, field, plan.maxStringBytes);
+            result.items.push({ index, address: itemAddress.toString(), fields: item });
+          }
+        }
+      }
+      result.allPassed = validations.length > 0 && validations.every(item => item.passed === true);
+      return result;
+    } catch (error) {
+      return { dataSourceId: plan.dataSourceId, buildKey: plan.buildKey, moduleName: module.name,
+        moduleBase: module.base.toString(), rootRva: plan.root.rva, allPassed: false, error: String(error) };
+    }
+  }
+};
 `;
 export class WowAnalysisService {
     executor;
-    profileRoot;
-    packagedProfiles;
-    buildBundles;
+    artifactDir;
     moduleName;
     options;
     sessions = new Map();
@@ -404,9 +400,7 @@ export class WowAnalysisService {
         if (!options || typeof options.executor?.execute !== "function")
             throw new TypeError("executor is required");
         this.executor = options.executor;
-        this.profileRoot = resolve(requiredString(options.profileRoot ?? options.artifactDir, "profileRoot"));
-        this.packagedProfiles = options.profileRoot !== undefined;
-        this.buildBundles = this.packagedProfiles ? new BuildBundleStore(this.profileRoot) : undefined;
+        this.artifactDir = resolve(requiredString(options.artifactDir, "artifactDir"));
         this.moduleName = options.moduleName ?? WOW_ANALYSIS_MODULE;
         this.options = options;
     }
@@ -432,17 +426,17 @@ export class WowAnalysisService {
         if (this.luaTrace)
             throw new Error("Lua trace is already loaded; stop it before starting another trace");
         const request = this.normalizeLuaStart(input);
-        const catalog = await this.loadLuaCatalog(input.buildKey);
         const target = await this.acquireTarget(input.buildKey, input.pid);
         let scriptId;
         try {
             const source = await this.luaSource();
-            const loaded = await this.executor.execute(brokerManagedCommand({
+            const loaded = await this.executor.execute({
                 operation: "script_load",
                 sessionId: target.sessionId,
                 source
-            }, "wow.lua_trace.script_load"), target.context);
+            }, target.context);
             scriptId = requiredString(loaded.scriptId, "script_load.scriptId");
+            const catalog = await this.loadLuaCatalog(input.buildKey);
             const configured = await this.callScript(scriptId, "configureLuaTrace", [catalog]);
             const started = await this.callScript(scriptId, "wowLuaTraceStart", [{ ...request, pid: target.pid }]);
             const value = isRecord(started.value) ? started.value : {};
@@ -483,11 +477,11 @@ export class WowAnalysisService {
         const target = await this.acquireTarget(input.buildKey, input.pid);
         let scriptId;
         try {
-            const loaded = await this.executor.execute(brokerManagedCommand({
+            const loaded = await this.executor.execute({
                 operation: "script_load",
                 sessionId: target.sessionId,
                 source: this.options.cppTraceSource ?? CPP_TRACE_SOURCE
-            }, "wow.cpp_trace.script_load"), target.context);
+            }, target.context);
             scriptId = requiredString(loaded.scriptId, "script_load.scriptId");
             const configured = await this.callScript(scriptId, "configureCppTrace", [catalog]);
             const started = await this.callScript(scriptId, "wowCppTraceStart", [{ ...request, pid: target.pid }]);
@@ -566,11 +560,11 @@ export class WowAnalysisService {
         const target = await this.acquireTarget(buildKey, input.pid);
         let scriptId;
         try {
-            const loaded = await this.executor.execute(brokerManagedCommand({
+            const loaded = await this.executor.execute({
                 operation: "script_load",
                 sessionId: target.sessionId,
                 source: this.options.dataReaderSource ?? DATA_READER_SOURCE
-            }, "wow.data_reader.script_load"), target.context);
+            }, target.context);
             scriptId = requiredString(loaded.scriptId, "script_load.scriptId");
             const result = await this.callScript(scriptId, "readDataSource", [plan, boundedInteger(input.limit, plan.maxItems, 1, plan.maxItems, "limit")]);
             const value = isRecord(result.value) ? result.value : { allPassed: false, error: "reader returned a non-object result" };
@@ -599,9 +593,6 @@ export class WowAnalysisService {
     async wowBuildProfileValidate(input) {
         const buildKey = requiredString(input.buildKey, "buildKey");
         const profile = await this.readBuildProfile(buildKey);
-        const signatureSource = this.packagedProfiles
-            ? await this.buildBundles.readJson(buildKey, "signatures.json")
-            : profile;
         const target = await this.acquireTarget(buildKey, input.pid);
         const checks = [];
         try {
@@ -615,7 +606,7 @@ export class WowAnalysisService {
             checks.push({ name: "module_name", expected: profileModule, actual: target.moduleName, passed: profileModule.toLowerCase() === target.moduleName.toLowerCase() });
             checks.push({ name: "runtime_base_dynamic", actual: target.moduleBase, passed: /^0x[0-9a-f]+$/i.test(target.moduleBase) });
             checks.push({ name: "image_base", expected: WOW_IDA_IMAGE_BASE, actual: profile.imageBase, passed: normalizeHex(profile.imageBase ?? WOW_IDA_IMAGE_BASE, "imageBase") === WOW_IDA_IMAGE_BASE });
-            const signatures = this.signatureRecords(signatureSource).slice(0, boundedInteger(input.maxChecks, 128, 1, MAX_SIGNATURE_CHECKS, "maxChecks"));
+            const signatures = this.signatureRecords(profile).slice(0, boundedInteger(input.maxChecks, 128, 1, MAX_SIGNATURE_CHECKS, "maxChecks"));
             if (signatures.length === 0) {
                 checks.push({ name: "signature_evidence_present", passed: false, error: "build profile contains no verifiable entry signatures" });
             }
@@ -656,7 +647,7 @@ export class WowAnalysisService {
         const suffix = buildSuffix(buildKey);
         const artifacts = [];
         for (const spec of REQUIRED_ARTIFACTS) {
-            const path = join(this.profileRoot, spec.file(suffix));
+            const path = join(this.artifactDir, spec.file(suffix));
             try {
                 const data = await readFile(path);
                 let parsed;
@@ -699,7 +690,7 @@ export class WowAnalysisService {
         const nonLuaRecords = recordsFrom(nonLua, ["systems", "records"]);
         return {
             buildKey,
-            profileRoot: this.profileRoot,
+            artifactDir: this.artifactDir,
             generatedAt: new Date().toISOString(),
             requiredArtifacts: artifacts.length,
             presentArtifacts: artifacts.filter(item => item.exists === true).length,
@@ -890,10 +881,10 @@ export class WowAnalysisService {
         return readFile(path, "utf8");
     }
     async callScript(scriptId, exportName, args = []) {
-        return this.executor.execute(brokerManagedCommand({ operation: "script_call", scriptId, exportName, args }, `wow.analysis.${exportName}`));
+        return this.executor.execute({ operation: "script_call", scriptId, exportName, args });
     }
     async unloadScript(scriptId) {
-        await this.executor.execute(brokerManagedCommand({ operation: "script_unload", scriptId }, "wow.analysis.script_unload"));
+        await this.executor.execute({ operation: "script_unload", scriptId });
     }
     activeTrace(kind) {
         return kind === "lua" ? this.luaTrace : this.cppTrace;
@@ -978,27 +969,13 @@ export class WowAnalysisService {
         }
     }
     artifactPath(buildKey, stem) {
-        if (!this.packagedProfiles)
-            return join(this.profileRoot, `${stem}-${buildSuffix(buildKey)}.json`);
-        const names = {
-            "build-profile": "build-profile.json",
-            "cpp-data-sources": "data-sources.json",
-            "wow-lua-api-all-rva": "lua-targets.jsonl"
-        };
-        return names[stem];
+        return join(this.artifactDir, `${stem}-${buildSuffix(buildKey)}.json`);
     }
     async readArtifact(buildKey, stem) {
         const path = this.artifactPath(buildKey, stem);
-        if (!path)
-            throw new Error(`${stem} is not included in the packaged build bundle for ${buildKey}`);
         let value;
         try {
-            const text = this.packagedProfiles
-                ? await this.buildBundles.readText(buildKey, path)
-                : await readFile(path, "utf8");
-            value = path.endsWith(".jsonl")
-                ? { buildKey, records: text.split(/\r?\n/).filter(Boolean).map(line => JSON.parse(line)) }
-                : JSON.parse(text);
+            value = JSON.parse(await readFile(path, "utf8"));
         }
         catch (error) {
             throw new Error(`failed to read ${basename(path)}: ${errorText(error)}`);
@@ -1011,8 +988,6 @@ export class WowAnalysisService {
         return value;
     }
     async readArtifactOptional(buildKey, stem) {
-        if (this.packagedProfiles && !this.artifactPath(buildKey, stem))
-            return undefined;
         try {
             return await this.readArtifact(buildKey, stem);
         }

package/package.json

@@ -1,37 +1,21 @@
 {
   "name": "wowdump",
-  "version": "0.2.0",
-  "description": "Build-aware World of Warcraft runtime analysis MCP server backed by Frida",
-  "type": "module",
-  "bin": {
-    "wowdump": "dist/mcp-main.js"
-  },
-  "files": [
-    "dist/**",
-    "!dist/main.js",
-    "resources/**",
-    "README.md",
-    "LICENSE"
-  ],
+  "version": "0.3.1",
+  "description": "WoW native memory analysis CLI with Ghidra, Frida validation, and an elevated reader broker",
   "license": "MIT",
-  "author": "Follenfang",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/Follen/wowdump.git"
   },
-  "bugs": {
-    "url": "https://github.com/Follen/wowdump/issues"
-  },
-  "homepage": "https://github.com/Follen/wowdump#readme",
-  "keywords": [
-    "mcp",
-    "frida",
-    "world-of-warcraft",
-    "wow",
-    "runtime-analysis"
+  "files": [
+    "dist",
+    "skills",
+    "README.md",
+    "LICENSE"
   ],
-  "publishConfig": {
-    "access": "public"
+  "type": "module",
+  "bin": {
+    "wowdump": "dist/cli.js"
   },
   "engines": {
     "node": ">=22"
@@ -40,19 +24,18 @@
     "build": "npm run build:host && npm run build:agent",
     "build:host": "tsc -p tsconfig.json",
     "build:agent": "frida-compile agent/index.ts -o dist/agent.js",
-    "bundle:build": "node scripts/build-build-bundle.mjs --analysis-root analyze/vm --output-root resources/builds",
-    "bundle:verify": "node scripts/verify-build-bundle.mjs resources/builds/retail/12.0.7.68974",
-    "package:verify": "node scripts/verify-package.mjs",
-    "release:verify": "node scripts/verify-release-workflow.mjs verify",
-    "mcp": "node dist/mcp-main.js",
-    "test": "npm run build:host && node --test tests/*.test.mjs && npm run release:verify",
-    "typecheck": "tsc --noEmit -p tsconfig.json",
-    "prepack": "npm run build && npm run bundle:verify"
+    "wowdump": "node dist/cli.js",
+    "postinstall": "npm run build:host --if-present && node dist/toolchain.js --postinstall",
+    "start": "node dist/main.js",
+    "discover": "node dist/main.js --discover",
+    "dry-run": "node dist/main.js --dry-run",
+    "test": "npm run build:host && node --test tests/*.test.mjs",
+    "typecheck": "tsc --noEmit -p tsconfig.json"
   },
   "dependencies": {
-    "@modelcontextprotocol/server": "2.0.0",
     "commander": "^13.1.0",
     "frida": "^17.2.0",
+    "koffi": "^2.16.3",
     "pino": "^9.6.0",
     "zod": "^3.24.2"
   },