wowdump 0.3.1 → 0.3.2

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (43) hide show
  1. package/LICENSE +21 -21
  2. package/README.md +21 -53
  3. package/dist/adapters/reader.js +33 -0
  4. package/dist/analysis/disassemble.js +77 -0
  5. package/dist/{frida-runtime.js → analysis/frida-runtime.js} +48 -48
  6. package/dist/analysis/runtime-script.js +36 -0
  7. package/dist/cli.js +255 -189
  8. package/dist/core/profile-engine.js +238 -0
  9. package/dist/frida-worker.js +54 -55
  10. package/dist/{reader-broker.js → reader/broker.js} +15 -0
  11. package/dist/{reader-client.js → reader/client.js} +1 -1
  12. package/dist/{windows-launcher.js → reader/launcher.js} +16 -4
  13. package/dist/reader/main.js +100 -0
  14. package/dist/reader/protocol.js +1 -0
  15. package/dist/reader/windows.js +242 -0
  16. package/dist/reader-main.js +1 -66
  17. package/dist/toolchain.js +102 -573
  18. package/package.json +9 -10
  19. package/skills/wowdump/SKILL.md +22 -15
  20. package/skills/wowdump/references/commands.md +63 -0
  21. package/skills/wowdump/references/disassemble.md +18 -0
  22. package/skills/wowdump/references/dynamic.md +54 -0
  23. package/skills/wowdump/references/evidence-workflow.md +41 -0
  24. package/skills/wowdump/references/profiles.md +34 -0
  25. package/skills/wowdump/references/request-schema.md +28 -0
  26. package/skills/wowdump/references/workflow.md +44 -0
  27. package/skills/wowdump/scripts/dynamic-session.js +133 -0
  28. package/dist/agent.js +0 -1332
  29. package/dist/discovery.js +0 -48
  30. package/dist/dry-run.js +0 -36
  31. package/dist/error-log.js +0 -71
  32. package/dist/focused-session.js +0 -89
  33. package/dist/ghidra.js +0 -769
  34. package/dist/main.js +0 -66
  35. package/dist/observability.js +0 -41
  36. package/dist/processes.js +0 -44
  37. package/dist/session.js +0 -42
  38. package/dist/storage.js +0 -12
  39. package/dist/windows-reader.js +0 -102
  40. package/dist/wow-analysis.js +0 -1405
  41. package/skills/wowdump/commands.md +0 -44
  42. /package/dist/{adapters.js → core/build-adapters.js} +0 -0
  43. /package/dist/{types.js → core/types.js} +0 -0
package/skills/wowdump/commands.md DELETED
@@ -1,44 +0,0 @@
1
- # wowdump 命令参考
2
-
3
- ## 1. 静态发现
4
-
5
- ```powershell
6
- wowdump analyze static --exe "C:\path with spaces\Wow.exe" --build "retail@VERSION"
7
- ```
8
-
9
- 输出是候选 profile：包含 `module.imageBase`、段范围、函数/字符串/交叉引用，以及由 `address - imageBase` 得到的候选 RVA。此阶段只读磁盘文件，不连接游戏；结果 `confidence` 为 `candidate`。
10
-
11
- ## 2. Frida 运行时导出
12
-
13
- 运行时导出必须先确认准确的 PID、build、目标操作、Hook 数、持续时间、事件上限和清理期限：
14
-
15
- ```powershell
16
- wowdump analyze runtime-export --pid 1234 --build "retail@VERSION" --static-profile .wowdump\profiles\static.json --kind providers --confirm
17
- ```
18
-
19
- Frida 只负责一次性验证：获取 `Wow.exe` 的 `moduleBase`/`moduleSize`，读取静态 profile 指定 RVA 的现场字节或运行时事件，并把 `runtimeAddress = moduleBase + rva` 写入导出证据。完成后卸载脚本并断开连接。
20
-
21
- ## 3. 验证并落盘
22
-
23
- ```powershell
24
- wowdump analyze verify --static-profile .wowdump\profiles\static.json --runtime-export .wowdump\runtime\export.json --output .wowdump\profiles\verified.json
25
- ```
26
-
27
- 验证 build key、可执行文件 SHA256、模块基址、段边界、RVA 入口字节和字段约束。只有检查全部通过的记录才可标为 `reader_ready`；不匹配项原样保留，不能静默升级置信度。
28
-
29
- ## 4. 后续只读 reader
30
-
31
- ```powershell
32
- wowdump target
33
- wowdump profiles reader-ready
34
- wowdump memory read --pid 1234 --profile reader-ready
35
- wowdump memory watch start --pid 1234 --profile reader-ready
36
- wowdump memory watch poll --id WATCH_ID
37
- wowdump memory watch stop --id WATCH_ID
38
- ```
39
-
40
- reader 从 profile 取 `moduleName`、`root.rva`、指针链、字段偏移和校验规则，先计算 `moduleBase + rva`，再执行只读 `ReadProcessMemory`。没有 `reader_ready`、build 不匹配或身份变化时返回结构化错误，不猜测地址。
41
-
42
- ## 5. 工具链和 broker
43
-
44
- `npm install`/`wowdump init` 会探测 JDK/Ghidra；缺失依赖下载到 `WOWDUMP_HOME/toolchains`。Skill 默认安装到 `~/.agents/skills/wowdump`，可用 `WOWDUMP_SKILL_HOME` 覆盖。Windows 首次 reader 调用由 Node 触发 UAC，broker 复用句柄和监控状态，空闲 20 分钟后退出。
/package/dist/{adapters.js → core/build-adapters.js} RENAMED
File without changes
/package/dist/{types.js → core/types.js} RENAMED
File without changes