wowdump 0.2.1 → 0.3.2

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (63) hide show
  1. package/LICENSE +1 -1
  2. package/README.md +17 -111
  3. package/dist/adapters/reader.js +33 -0
  4. package/dist/analysis/disassemble.js +77 -0
  5. package/dist/{frida-runtime.js → analysis/frida-runtime.js} +3 -25
  6. package/dist/analysis/runtime-script.js +36 -0
  7. package/dist/cli.js +563 -0
  8. package/dist/core/profile-engine.js +238 -0
  9. package/dist/frida-worker.js +99 -0
  10. package/dist/reader/broker.js +475 -0
  11. package/dist/reader/client.js +1 -0
  12. package/dist/reader/launcher.js +219 -0
  13. package/dist/reader/main.js +100 -0
  14. package/dist/reader/protocol.js +1 -0
  15. package/dist/reader/windows.js +242 -0
  16. package/dist/reader-main.js +2 -0
  17. package/dist/toolchain.js +123 -0
  18. package/package.json +19 -37
  19. package/skills/wowdump/SKILL.md +22 -0
  20. package/skills/wowdump/references/commands.md +63 -0
  21. package/skills/wowdump/references/disassemble.md +18 -0
  22. package/skills/wowdump/references/dynamic.md +54 -0
  23. package/skills/wowdump/references/evidence-workflow.md +41 -0
  24. package/skills/wowdump/references/profiles.md +34 -0
  25. package/skills/wowdump/references/request-schema.md +28 -0
  26. package/skills/wowdump/references/workflow.md +44 -0
  27. package/skills/wowdump/scripts/dynamic-session.js +133 -0
  28. package/dist/agent.js +0 -1335
  29. package/dist/analysis-path.js +0 -38
  30. package/dist/analysis-process-log.js +0 -146
  31. package/dist/broker-client.js +0 -411
  32. package/dist/broker-codec.js +0 -148
  33. package/dist/broker-core.js +0 -1045
  34. package/dist/broker-gateway.js +0 -447
  35. package/dist/broker-ledger.js +0 -196
  36. package/dist/broker-main.js +0 -291
  37. package/dist/broker-protocol.js +0 -119
  38. package/dist/broker-runtime.js +0 -1283
  39. package/dist/broker-server.js +0 -466
  40. package/dist/build-bundle-loader.js +0 -183
  41. package/dist/build-bundle.js +0 -11
  42. package/dist/discovery.js +0 -59
  43. package/dist/dry-run.js +0 -38
  44. package/dist/error-log.js +0 -71
  45. package/dist/focus-errors.js +0 -63
  46. package/dist/focus-service.js +0 -1855
  47. package/dist/focused-session.js +0 -1357
  48. package/dist/mcp-main.js +0 -51
  49. package/dist/mcp.js +0 -924
  50. package/dist/observability.js +0 -41
  51. package/dist/process-log-lock.js +0 -195
  52. package/dist/processes.js +0 -47
  53. package/dist/runtime-config.js +0 -399
  54. package/dist/session.js +0 -145
  55. package/dist/storage.js +0 -12
  56. package/dist/wow-analysis.js +0 -1430
  57. package/resources/builds/retail/12.0.7.68974/build-profile.json +0 -290
  58. package/resources/builds/retail/12.0.7.68974/data-sources.json +0 -1633
  59. package/resources/builds/retail/12.0.7.68974/lua-targets.jsonl +0 -5130
  60. package/resources/builds/retail/12.0.7.68974/manifest.json +0 -63
  61. package/resources/builds/retail/12.0.7.68974/signatures.json +0 -260
  62. /package/dist/{adapters.js → core/build-adapters.js} +0 -0
  63. /package/dist/{types.js → core/types.js} +0 -0
@@ -1,290 +0,0 @@
1
- {
2
- "schema": "wowdump.build-profile.v1",
3
- "buildKey": "retail@12.0.7.68974",
4
- "module": "Wow.exe",
5
- "imageBase": "0x140000000",
6
- "protocolVersion": "2026-07-28",
7
- "binary": {
8
- "originalWowExe": {
9
- "size": 97919184,
10
- "sha256": "e6e1e6209eb1d9665f47d047be2ce07d3577e10b3f80db6f1646fdb79f6f2e81"
11
- },
12
- "runtimeTextExe": {
13
- "size": 97919184,
14
- "sha256": "c400ccd99e695b4ae4218f12f08343a4ac87355b35aa5c2f25a9fffc0c96f456"
15
- },
16
- "runtimeTextDump": {
17
- "size": 65640960,
18
- "sha256": "93b7dee65958f87a544140699f2e5d9972a3207f54c3fe9a786d33dc986e08f0"
19
- },
20
- "imageSize": 138043392,
21
- "sections": [
22
- {
23
- "name": ".text",
24
- "rva": "0x1000",
25
- "virtualSize": 65640668,
26
- "flags": {
27
- "code": true,
28
- "initializedData": false,
29
- "uninitializedData": false,
30
- "execute": true,
31
- "read": true,
32
- "write": false
33
- }
34
- },
35
- {
36
- "name": ".rdata",
37
- "rva": "0x3e9b000",
38
- "virtualSize": 26964460,
39
- "flags": {
40
- "code": false,
41
- "initializedData": true,
42
- "uninitializedData": false,
43
- "execute": false,
44
- "read": true,
45
- "write": false
46
- }
47
- },
48
- {
49
- "name": ".data",
50
- "rva": "0x5853000",
51
- "virtualSize": 42226593,
52
- "flags": {
53
- "code": false,
54
- "initializedData": true,
55
- "uninitializedData": false,
56
- "execute": false,
57
- "read": true,
58
- "write": true
59
- }
60
- },
61
- {
62
- "name": ".pdata",
63
- "rva": "0x8099000",
64
- "virtualSize": 2459928,
65
- "flags": {
66
- "code": false,
67
- "initializedData": true,
68
- "uninitializedData": false,
69
- "execute": false,
70
- "read": true,
71
- "write": false
72
- }
73
- },
74
- {
75
- "name": "_RDATA",
76
- "rva": "0x82f2000",
77
- "virtualSize": 138720,
78
- "flags": {
79
- "code": false,
80
- "initializedData": true,
81
- "uninitializedData": false,
82
- "execute": false,
83
- "read": true,
84
- "write": false
85
- }
86
- },
87
- {
88
- "name": ".rsrc",
89
- "rva": "0x8314000",
90
- "virtualSize": 191792,
91
- "flags": {
92
- "code": false,
93
- "initializedData": true,
94
- "uninitializedData": false,
95
- "execute": false,
96
- "read": true,
97
- "write": false
98
- }
99
- },
100
- {
101
- "name": ".reloc",
102
- "rva": "0x8343000",
103
- "virtualSize": 402584,
104
- "flags": {
105
- "code": false,
106
- "initializedData": true,
107
- "uninitializedData": false,
108
- "execute": false,
109
- "read": true,
110
- "write": false
111
- }
112
- }
113
- ]
114
- },
115
- "addressRules": {
116
- "rvaFormula": "RVA = IDA VA - 0x140000000",
117
- "runtimeFormula": "runtime address = dynamically discovered Wow.exe base + build-specific RVA",
118
- "persistedAddressAuthority": "RVA",
119
- "historicalPidOrBaseMayBeReused": false
120
- },
121
- "dynamicDiscovery": {
122
- "executableName": "Wow.exe",
123
- "buildKey": "retail@12.0.7.68974",
124
- "protocolVersion": "2026-07-28",
125
- "requiredSteps": [
126
- "enumerate processes and select the current Wow.exe PID",
127
- "attach with buildKey retail@12.0.7.68974",
128
- "enumerate modules and select current Wow.exe base/size",
129
- "validate module image size and at least one build signature",
130
- "compute every runtime address as current base + RVA",
131
- "detach and unload every script/hook after verification"
132
- ]
133
- },
134
- "dataRoots": [
135
- {
136
- "dataSourceId": "ds-cvar-registry",
137
- "getterRva": "0x3cc2930",
138
- "globalPointerRva": "0x5898dd8",
139
- "status": "partial",
140
- "invariants": [
141
- "capacity is non-zero, power-of-two, and bounded by reader maxSlots",
142
- "slots pointer is readable for capacity * 0x10 bytes",
143
- "lookup index is hash & (capacity - 1)",
144
- "non-empty CVar pointer is null or points to readable memory",
145
- "value pointer is null or a bounded NUL-terminated string"
146
- ]
147
- },
148
- {
149
- "dataSourceId": "ds-framescript-name-registry",
150
- "getterRva": "0x697930",
151
- "globalPointerRva": "0x5923320",
152
- "status": "partial",
153
- "invariants": [
154
- "bucketCount is non-zero, power-of-two, and bounded by reader maxBuckets",
155
- "size is bounded by reader maxItems",
156
- "buckets pointer is readable for bucketCount pointers",
157
- "each next pointer is null or readable and cycle-detected",
158
- "nameLength is bounded and nameData is readable for nameLength bytes",
159
- "object pointer is null or points to readable committed memory"
160
- ]
161
- },
162
- {
163
- "dataSourceId": "ds-framescript-event-registry",
164
- "getterRva": "0x66e7d0",
165
- "globalPointerRva": "0x7f93418",
166
- "status": "partial",
167
- "invariants": [
168
- "getter returns moduleBase + 0x7f93418 after thread-safe initialization",
169
- "bucketCount is non-zero, power-of-two, and bounded by reader maxBuckets",
170
- "size is bounded by reader maxItems",
171
- "outer and nested chains are cycle-detected",
172
- "FrameScript_Object pointers are null or readable before identity inspection"
173
- ]
174
- }
175
- ],
176
- "readers": [
177
- {
178
- "readerId": "reader-ds-cvar-registry",
179
- "dataSourceId": "ds-cvar-registry",
180
- "buildKey": "retail@12.0.7.68974",
181
- "status": "partial",
182
- "addressPolicy": {
183
- "root": "moduleBase + 0x5898dd8",
184
- "hardcodedRuntimeAddress": false
185
- },
186
- "kind": "keyed-lookup",
187
- "limits": {
188
- "maxItems": 4096,
189
- "maxBuckets": 8192,
190
- "maxStringBytes": 1024,
191
- "maxChainDepth": 512,
192
- "timeoutMs": 250
193
- },
194
- "preconditions": [
195
- "buildKey exactly matches retail@12.0.7.68974",
196
- "Wow.exe module base and size are dynamically discovered",
197
- "root RVA is inside the current module image",
198
- "memory ranges are readable before every dereference",
199
- "signature and container invariants pass"
200
- ],
201
- "algorithm": [
202
- "compute case-insensitive FNV-1a hash for requested CVar name",
203
- "read and bound capacity; require power-of-two",
204
- "probe 0x10-byte slots with cycle/iteration limit",
205
- "validate CVar pointer, flags, and bounded value string"
206
- ],
207
- "failureContract": "return validation_failed with the base, RVA, computed address, failed invariant, and no guessed data",
208
- "crossValidationStatus": "not_run"
209
- },
210
- {
211
- "readerId": "reader-ds-framescript-name-registry",
212
- "dataSourceId": "ds-framescript-name-registry",
213
- "buildKey": "retail@12.0.7.68974",
214
- "status": "partial",
215
- "addressPolicy": {
216
- "root": "moduleBase + 0x5923320",
217
- "hardcodedRuntimeAddress": false
218
- },
219
- "kind": "bounded-enumeration",
220
- "limits": {
221
- "maxItems": 4096,
222
- "maxBuckets": 8192,
223
- "maxStringBytes": 1024,
224
- "maxChainDepth": 512,
225
- "timeoutMs": 250
226
- },
227
- "preconditions": [
228
- "buildKey exactly matches retail@12.0.7.68974",
229
- "Wow.exe module base and size are dynamically discovered",
230
- "root RVA is inside the current module image",
231
- "memory ranges are readable before every dereference",
232
- "signature and container invariants pass"
233
- ],
234
- "algorithm": [
235
- "read and validate bucketCount, buckets, size, and load factor globals",
236
- "walk bucket chains with pointer set for cycle detection",
237
- "validate name length/data and object pointer",
238
- "stop at maxItems/maxChainDepth/timeoutMs"
239
- ],
240
- "failureContract": "return validation_failed with the base, RVA, computed address, failed invariant, and no guessed data",
241
- "crossValidationStatus": "not_run"
242
- },
243
- {
244
- "readerId": "reader-ds-framescript-event-registry",
245
- "dataSourceId": "ds-framescript-event-registry",
246
- "buildKey": "retail@12.0.7.68974",
247
- "status": "partial",
248
- "addressPolicy": {
249
- "root": "moduleBase + 0x7f93418",
250
- "hardcodedRuntimeAddress": false
251
- },
252
- "kind": "bounded-enumeration",
253
- "limits": {
254
- "maxItems": 4096,
255
- "maxBuckets": 8192,
256
- "maxStringBytes": 1024,
257
- "maxChainDepth": 512,
258
- "timeoutMs": 250
259
- },
260
- "preconditions": [
261
- "buildKey exactly matches retail@12.0.7.68974",
262
- "Wow.exe module base and size are dynamically discovered",
263
- "root RVA is inside the current module image",
264
- "memory ranges are readable before every dereference",
265
- "signature and container invariants pass"
266
- ],
267
- "algorithm": [
268
- "call no native code; compute inline header address from module base + RVA",
269
- "validate initialized header and bucket array",
270
- "walk bounded outer object chains",
271
- "report nested event maps as unresolved until node offsets are live-confirmed"
272
- ],
273
- "failureContract": "return validation_failed with the base, RVA, computed address, failed invariant, and no guessed data",
274
- "crossValidationStatus": "not_run"
275
- }
276
- ],
277
- "crossBuildRelocation": {
278
- "reuseOldRva": false,
279
- "requiredSteps": [
280
- "dynamically discover the new Wow.exe base",
281
- "identify the exact new build",
282
- "scan stored AOB/signature candidates",
283
- "verify function boundaries and entry bytes",
284
- "verify caller/callee and string/global anchors",
285
- "verify structure/container invariants",
286
- "write a new build profile with new RVAs",
287
- "run reader verification and cross-validation"
288
- ]
289
- }
290
- }