wowdump 0.2.0 → 0.3.1

package/dist/frida-runtime.js

@@ -1,16 +1,6 @@
 import { createHash } from "node:crypto";
 import { appendFile, mkdir } from "node:fs/promises";
 import { join } from "node:path";
-export const BROKER_MANAGED_COMMAND = Symbol("wowdump.broker-managed-command");
-export function brokerManagedCommand(request, purpose) {
-    Object.defineProperty(request, BROKER_MANAGED_COMMAND, {
-        value: { purpose, irreversibleReason: "Broker-managed observation instrumentation is cleaned through the owned resource graph." },
-        enumerable: false,
-        configurable: false,
-        writable: false
-    });
-    return request;
-}
 const DEFAULT_MAX_SOURCE_BYTES = 4 * 1024 * 1024;
 const DEFAULT_MAX_MEMORY_BYTES = 16 * 1024 * 1024;
 const DEFAULT_SCRIPT_TIMEOUT_MS = 150;
@@ -19,54 +9,54 @@ const DEFAULT_SCRIPT_TIMEOUT_MS = 150;
  * `script_load` still accept native GumJS, so a new WoW build can use any
  * Frida API without requiring a host release for every new command.
  */
-const BRIDGE_SOURCE = String.raw `
-function __wowBytes(value) {
-  return value == null ? [] : Array.from(new Uint8Array(value));
-}
-function __wowModule(value) {
-  return { name: value.name, base: value.base.toString(), size: value.size, path: value.path };
-}
-function __wowExport(value) {
-  return { type: value.type, name: value.name, address: value.address.toString(), moduleName: value.moduleName };
-}
-function __wowRange(value) {
-  return { base: value.base.toString(), size: value.size, protection: value.protection, file: value.file ?? null };
-}
-rpc.exports = {
-  enumerateModules() {
-    return Process.enumerateModules().map(__wowModule);
-  },
-  enumerateExports(moduleName) {
-    const module = Process.getModuleByName(moduleName);
-    return module.enumerateExports().map(__wowExport);
-  },
-  enumerateRanges(protection, coalesce) {
-    try {
-      return Process.enumerateRanges({ protection: protection || "r--", coalesce: Boolean(coalesce) }).map(__wowRange);
-    } catch (_) {
-      return Process.enumerateRanges(protection || "r--").map(__wowRange);
-    }
-  },
-  readMemory(address, size) {
-    return __wowBytes(ptr(address).readByteArray(size));
-  },
-  writeMemory(address, bytes) {
-    const target = ptr(address);
-    const input = Uint8Array.from(bytes || []);
-    const before = __wowBytes(target.readByteArray(input.byteLength));
-    target.writeByteArray(input.buffer);
-    return { before, after: Array.from(input), address: target.toString(), size: input.byteLength };
-  },
-  protectMemory(address, size, protection) {
-    const changed = Memory.protect(ptr(address), size, protection);
-    return { address: ptr(address).toString(), size, protection, changed };
-  },
-  scanMemory(address, size, pattern) {
-    return Memory.scanSync(ptr(address), size, pattern).map(match => ({
-      address: match.address.toString(), size: match.size
-    }));
-  }
-};
+const BRIDGE_SOURCE = String.raw `
+function __wowBytes(value) {
+  return value == null ? [] : Array.from(new Uint8Array(value));
+}
+function __wowModule(value) {
+  return { name: value.name, base: value.base.toString(), size: value.size, path: value.path };
+}
+function __wowExport(value) {
+  return { type: value.type, name: value.name, address: value.address.toString(), moduleName: value.moduleName };
+}
+function __wowRange(value) {
+  return { base: value.base.toString(), size: value.size, protection: value.protection, file: value.file ?? null };
+}
+rpc.exports = {
+  enumerateModules() {
+    return Process.enumerateModules().map(__wowModule);
+  },
+  enumerateExports(moduleName) {
+    const module = Process.getModuleByName(moduleName);
+    return module.enumerateExports().map(__wowExport);
+  },
+  enumerateRanges(protection, coalesce) {
+    try {
+      return Process.enumerateRanges({ protection: protection || "r--", coalesce: Boolean(coalesce) }).map(__wowRange);
+    } catch (_) {
+      return Process.enumerateRanges(protection || "r--").map(__wowRange);
+    }
+  },
+  readMemory(address, size) {
+    return __wowBytes(ptr(address).readByteArray(size));
+  },
+  writeMemory(address, bytes) {
+    const target = ptr(address);
+    const input = Uint8Array.from(bytes || []);
+    const before = __wowBytes(target.readByteArray(input.byteLength));
+    target.writeByteArray(input.buffer);
+    return { before, after: Array.from(input), address: target.toString(), size: input.byteLength };
+  },
+  protectMemory(address, size, protection) {
+    const changed = Memory.protect(ptr(address), size, protection);
+    return { address: ptr(address).toString(), size, protection, changed };
+  },
+  scanMemory(address, size, pattern) {
+    return Memory.scanSync(ptr(address), size, pattern).map(match => ({
+      address: match.address.toString(), size: match.size
+    }));
+  }
+};
 `;
 function asRecord(value) {
     return value && typeof value === "object" ? value : {};
@@ -196,9 +186,6 @@ function buildPrelude(context) {
         buildKey: context?.buildKey,
         flavor: context?.flavor,
         executable: context?.executable,
-        processStartTime: context?.processStartTime,
-        moduleBase: context?.moduleBase,
-        moduleIdentity: context?.moduleIdentity,
         adapter: context?.adapter
     });
     const verifiedPrelude = context?.adapter?.adapter?.fridaPrelude ?? "";
@@ -213,10 +200,7 @@ function requestContext(request, context, existing) {
         ...(request.buildKey === undefined ? {} : { buildKey: request.buildKey }),
         ...(request.flavor === undefined ? {} : { flavor: request.flavor }),
         ...(request.adapter === undefined ? {} : { adapter: request.adapter }),
-        ...(request.executable === undefined ? {} : { executable: request.executable }),
-        ...(request.processStartTime === undefined ? {} : { processStartTime: request.processStartTime }),
-        ...(request.moduleBase === undefined ? {} : { moduleBase: request.moduleBase }),
-        ...(request.moduleIdentity === undefined ? {} : { moduleIdentity: request.moduleIdentity })
+        ...(request.executable === undefined ? {} : { executable: request.executable })
     };
 }
 function sessionContext(record) {
@@ -226,10 +210,7 @@ function sessionContext(record) {
         ...(context.buildKey === undefined ? {} : { buildKey: context.buildKey }),
         ...(context.flavor === undefined ? {} : { flavor: context.flavor }),
         ...(context.adapter === undefined ? {} : { adapter: context.adapter }),
-        ...(context.executable === undefined ? {} : { executable: context.executable }),
-        ...(context.processStartTime === undefined ? {} : { processStartTime: context.processStartTime }),
-        ...(context.moduleBase === undefined ? {} : { moduleBase: context.moduleBase }),
-        ...(context.moduleIdentity === undefined ? {} : { moduleIdentity: context.moduleIdentity })
+        ...(context.executable === undefined ? {} : { executable: context.executable })
     };
 }
 function serializeDevice(device) {
@@ -514,10 +495,6 @@ export class FridaCommandRuntime {
         const record = this.sessions.get(id);
         if (!record)
             throw new Error(`session ${id} was not found`);
-        // Detach is an at-most-once terminal transition. Frida may report an
-        // error after teardown has already started, so retaining the record would
-        // let Broker cleanup call detach again on a half-destroyed agent.
-        this.sessions.delete(id);
         for (const scriptId of [...record.scripts.keys()])
             await this.unloadScript(scriptId).catch(() => undefined);
         try {
@@ -525,6 +502,7 @@ export class FridaCommandRuntime {
         }
         catch { /* bridge cleanup is best effort */ }
         await record.session.detach();
+        this.sessions.delete(id);
     }
     async resume(request, context) {
         const pid = this.requirePid(request, context);

package/dist/frida-worker.js

@@ -0,0 +1,100 @@
+import { readFile } from "node:fs/promises";
+import { createInterface } from "node:readline";
+import { FridaCommandRuntime } from "./frida-runtime.js";
+function record(value) {
+    return value && typeof value === "object" && !Array.isArray(value) ? value : {};
+}
+function requiredPositive(value, name) {
+    const number = typeof value === "number" ? value : Number(value);
+    if (!Number.isSafeInteger(number) || number < 1)
+        throw new Error(`${name} must be a positive integer`);
+    return number;
+}
+function hex(value, name) {
+    if (typeof value === "number" && Number.isSafeInteger(value) && value >= 0)
+        return `0x${value.toString(16)}`;
+    if (typeof value !== "string" || !/^(?:0x)?[0-9a-f]+$/i.test(value.trim()))
+        throw new Error(`${name} must be hexadecimal`);
+    return `0x${BigInt(value).toString(16)}`;
+}
+function add(base, offset) {
+    return `0x${(BigInt(base) + BigInt(offset)).toString(16)}`;
+}
+async function run(input) {
+    if (input.command !== "runtime-export")
+        throw new Error("unsupported worker command");
+    const pid = requiredPositive(input.pid, "pid");
+    const buildKey = String(input.build ?? input.buildKey ?? "").trim();
+    if (!buildKey)
+        throw new Error("build is required");
+    const profileFile = typeof input.staticProfile === "string" ? input.staticProfile : undefined;
+    const profile = profileFile ? record(JSON.parse(await readFile(profileFile, "utf8"))) : {};
+    const moduleProfile = record(profile.module);
+    const moduleName = typeof moduleProfile.name === "string" ? moduleProfile.name : "Wow.exe";
+    const runtime = new FridaCommandRuntime({ artifactDir: process.env.WOW_ANALYZE_DIR });
+    try {
+        const attached = await runtime.execute({ operation: "attach", pid, buildKey, allowUnmatched: true });
+        const sessionId = String(attached.sessionId);
+        const modules = await runtime.execute({ operation: "modules", sessionId, pid, buildKey });
+        const list = Array.isArray(modules.modules) ? modules.modules : [];
+        const module = list.find(item => String(item.name ?? "").toLowerCase() === moduleName.toLowerCase())
+            ?? list.find(item => String(item.name ?? "").toLowerCase() === "wow.exe");
+        if (!module || typeof module.base !== "string")
+            throw new Error(`${moduleName} module was not found`);
+        const moduleBase = module.base;
+        const moduleSize = Number(module.size ?? 0);
+        const candidates = [
+            ...(Array.isArray(profile.signatures) ? profile.signatures : []),
+            ...(Array.isArray(profile.providers) ? profile.providers : []),
+            ...(Array.isArray(profile.functions) ? profile.functions : [])
+        ].map(record);
+        const limit = Math.min(requiredPositive(input.maxEvents ?? 100, "max-events"), 10000);
+        const records = [];
+        for (const [index, candidate] of candidates.slice(0, limit).entries()) {
+            const rvaValue = candidate.rva;
+            if (rvaValue === undefined)
+                continue;
+            const rva = hex(rvaValue, `profile record ${index}.rva`);
+            const address = add(moduleBase, rva);
+            const size = Math.min(Math.max(Number(candidate.size ?? 16), 1), 256);
+            const read = await runtime.execute({ operation: "read_memory", sessionId, address, size, pid, buildKey });
+            records.push({
+                name: typeof candidate.name === "string" ? candidate.name : `record_${index}`,
+                rva,
+                runtimeAddress: address,
+                bytesHex: read.bytesHex ?? null,
+                source: "frida",
+                confidence: "unverified"
+            });
+        }
+        return {
+            ok: true,
+            command: "analyze.runtime-export",
+            pid,
+            buildKey,
+            module: { name: module.name, moduleBase, moduleSize },
+            moduleBase,
+            moduleSize,
+            records,
+            evidence: [{ kind: "frida-runtime-read", source: "frida", moduleBase, count: records.length }]
+        };
+    }
+    finally {
+        await runtime.close();
+    }
+}
+const input = createInterface({ input: process.stdin, crlfDelay: Infinity });
+let failed = false;
+for await (const line of input) {
+    if (!line.trim())
+        continue;
+    try {
+        process.stdout.write(`${JSON.stringify(await run(record(JSON.parse(line))))}\n`);
+    }
+    catch (error) {
+        failed = true;
+        process.stderr.write(`${error instanceof Error ? error.message : String(error)}\n`);
+    }
+}
+if (failed)
+    process.exitCode = 1;