wowdump 0.3.1 → 0.3.2

package/dist/reader/windows.js

@@ -0,0 +1,242 @@
+import koffi from "koffi";
+import { basename } from "node:path";
+const PROCESS_QUERY_INFORMATION = 0x0400;
+const PROCESS_VM_READ = 0x0010;
+const PROCESS_QUERY_LIMITED_INFORMATION = 0x1000;
+const HANDLE = koffi.pointer("WOWDUMP_HANDLE", koffi.opaque());
+const BYTE_POINTER = koffi.pointer("WOWDUMP_BYTE", koffi.opaque());
+const SIZE_T = process.arch === "x64" ? "uint64_t" : "uint32_t";
+const kernel32 = koffi.load("kernel32.dll");
+const shell32 = koffi.load("shell32.dll");
+const OpenProcess = kernel32.func("OpenProcess", HANDLE, ["uint32_t", "bool", "uint32_t"]);
+const ReadProcessMemory = kernel32.func("ReadProcessMemory", "bool", [HANDLE, "uint64_t", koffi.pointer("uint8_t"), SIZE_T, koffi.out(koffi.pointer(SIZE_T))]);
+const VirtualQueryEx = kernel32.func("VirtualQueryEx", SIZE_T, [HANDLE, "uint64_t", koffi.pointer("uint8_t"), SIZE_T]);
+const CloseHandle = kernel32.func("CloseHandle", "bool", [HANDLE]);
+const GetLastError = kernel32.func("GetLastError", "uint32_t", []);
+const QueryFullProcessImageNameW = kernel32.func("QueryFullProcessImageNameW", "bool", [HANDLE, "uint32_t", koffi.pointer("char16_t"), koffi.inout(koffi.pointer("uint32_t"))]);
+const IsUserAnAdmin = shell32.func("IsUserAnAdmin", "bool", []);
+const MODULEENTRY32W = koffi.struct("WOWDUMP_MODULEENTRY32W", {
+    dwSize: "uint32_t",
+    th32ModuleID: "uint32_t",
+    th32ProcessID: "uint32_t",
+    GlblcntUsage: "uint32_t",
+    ProccntUsage: "uint32_t",
+    modBaseAddr: BYTE_POINTER,
+    modBaseSize: "uint32_t",
+    hModule: HANDLE,
+    szModule: koffi.array("char16_t", 256, "String"),
+    szExePath: koffi.array("char16_t", 260, "String")
+});
+const PROCESSENTRY32W = koffi.struct("WOWDUMP_PROCESSENTRY32W", {
+    dwSize: "uint32_t",
+    cntUsage: "uint32_t",
+    th32ProcessID: "uint32_t",
+    th32DefaultHeapID: "uint64_t",
+    th32ModuleID: "uint32_t",
+    cntThreads: "uint32_t",
+    th32ParentProcessID: "uint32_t",
+    pcPriClassBase: "int32_t",
+    dwFlags: "uint32_t",
+    szExeFile: koffi.array("char16_t", 260, "String")
+});
+const CreateToolhelp32Snapshot = kernel32.func("CreateToolhelp32Snapshot", HANDLE, ["uint32_t", "uint32_t"]);
+const Module32FirstW = kernel32.func("Module32FirstW", "bool", [HANDLE, koffi.inout(koffi.pointer(MODULEENTRY32W))]);
+const Module32NextW = kernel32.func("Module32NextW", "bool", [HANDLE, koffi.inout(koffi.pointer(MODULEENTRY32W))]);
+const Process32FirstW = kernel32.func("Process32FirstW", "bool", [HANDLE, koffi.inout(koffi.pointer(PROCESSENTRY32W))]);
+const Process32NextW = kernel32.func("Process32NextW", "bool", [HANDLE, koffi.inout(koffi.pointer(PROCESSENTRY32W))]);
+const TH32CS_SNAPMODULE = 0x00000008;
+const TH32CS_SNAPMODULE32 = 0x00000010;
+const TH32CS_SNAPPROCESS = 0x00000002;
+function addressOf(handle) {
+    return `0x${koffi.address(handle).toString(16)}`;
+}
+function win32Error(operation) {
+    const win32 = Number(GetLastError());
+    const error = new Error(`${operation} failed with Win32 error ${win32}`);
+    error.code = "WIN32_ERROR";
+    error.win32 = win32;
+    return error;
+}
+class WindowsHandle {
+    raw;
+    pid;
+    id;
+    constructor(raw, pid) {
+        this.raw = raw;
+        this.pid = pid;
+        this.id = addressOf(raw);
+    }
+    close() {
+        if (this.raw !== null) {
+            CloseHandle(this.raw);
+            this.raw = null;
+        }
+    }
+}
+export class WindowsNativeReader {
+    async enumerateModules(pid) {
+        const snapshot = CreateToolhelp32Snapshot(TH32CS_SNAPMODULE | TH32CS_SNAPMODULE32, pid);
+        if (!snapshot)
+            throw win32Error(`CreateToolhelp32Snapshot(${pid})`);
+        const modules = [];
+        try {
+            const entry = {
+                dwSize: koffi.sizeof(MODULEENTRY32W),
+                th32ModuleID: 0,
+                th32ProcessID: 0,
+                GlblcntUsage: 0,
+                ProccntUsage: 0,
+                modBaseAddr: null,
+                modBaseSize: 0,
+                hModule: null,
+                szModule: "",
+                szExePath: ""
+            };
+            let first = Module32FirstW(snapshot, entry);
+            while (first) {
+                const base = entry.modBaseAddr ? `0x${koffi.address(entry.modBaseAddr).toString(16)}` : "0x0";
+                modules.push({ name: String(entry.szModule), base, size: Number(entry.modBaseSize), path: String(entry.szExePath) });
+                first = Module32NextW(snapshot, entry);
+            }
+            if (modules.some(module => module.name.length > 0 || Boolean(module.path)))
+                return modules;
+            const path = await this.queryProcessPath(pid);
+            if (path)
+                return [{ name: basename(path), base: "0x0", size: 0, path }];
+            throw win32Error(`QueryFullProcessImageNameW(${pid})`);
+        }
+        finally {
+            CloseHandle(snapshot);
+        }
+    }
+    async queryProcessPath(pid) {
+        const handle = OpenProcess(PROCESS_QUERY_LIMITED_INFORMATION | PROCESS_QUERY_INFORMATION, false, pid);
+        if (!handle)
+            return undefined;
+        try {
+            const capacity = 32768;
+            const buffer = Buffer.alloc(capacity * 2);
+            const length = [capacity];
+            if (!QueryFullProcessImageNameW(handle, 0, buffer, length))
+                return undefined;
+            const count = Math.max(0, Math.min(Number(length[0]), capacity));
+            return buffer.toString("utf16le", 0, count * 2) || undefined;
+        }
+        finally {
+            CloseHandle(handle);
+        }
+    }
+    async openProcess(pid, rights) {
+        const requested = rights.reduce((mask, right) => {
+            if (right === "PROCESS_QUERY_INFORMATION")
+                return mask | PROCESS_QUERY_INFORMATION;
+            if (right === "PROCESS_VM_READ")
+                return mask | PROCESS_VM_READ;
+            return mask;
+        }, 0);
+        const handle = OpenProcess(requested || PROCESS_QUERY_INFORMATION | PROCESS_VM_READ, false, pid);
+        if (!handle)
+            throw win32Error(`OpenProcess(${pid})`);
+        return new WindowsHandle(handle, pid);
+    }
+    async readProcessMemory(handle, address, size) {
+        const native = handle;
+        const bytes = Buffer.allocUnsafe(size);
+        const read = [0n];
+        const ok = ReadProcessMemory(native.raw, address, bytes, size, read);
+        const bytesRead = Number(read[0]);
+        if (!ok && bytesRead === 0)
+            throw win32Error(`ReadProcessMemory(${native.id}, ${`0x${address.toString(16)}`})`);
+        return { bytes: bytes.subarray(0, bytesRead), bytesRead };
+    }
+    async virtualQueryEx(handle, address) {
+        const native = handle;
+        const buffer = Buffer.alloc(48);
+        const result = Number(VirtualQueryEx(native.raw, address, buffer, buffer.length));
+        if (result === 0)
+            throw win32Error(`VirtualQueryEx(${native.id})`);
+        return {
+            baseAddress: `0x${buffer.readBigUInt64LE(0).toString(16)}`,
+            allocationBase: `0x${buffer.readBigUInt64LE(8).toString(16)}`,
+            allocationProtect: buffer.readUInt32LE(16),
+            regionSize: buffer.readBigUInt64LE(24).toString(),
+            state: buffer.readUInt32LE(32),
+            protect: buffer.readUInt32LE(36),
+            type: buffer.readUInt32LE(40),
+            bytesReturned: result
+        };
+    }
+    async isProcessAlive(pid) {
+        try {
+            const handle = await this.openProcess(pid, ["PROCESS_QUERY_INFORMATION"]);
+            handle.close();
+            return true;
+        }
+        catch {
+            return false;
+        }
+    }
+    elevationStatus() {
+        return {
+            elevated: Boolean(IsUserAnAdmin()),
+            processArchitecture: process.arch,
+            backend: "koffi/kernel32",
+            requestedRights: ["PROCESS_QUERY_INFORMATION", "PROCESS_VM_READ"]
+        };
+    }
+}
+/** Enumerate processes without spawning a shell or depending on Frida. */
+export function enumerateWindowsProcesses() {
+    if (process.platform !== "win32")
+        return [];
+    const snapshot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
+    if (!snapshot)
+        throw win32Error("CreateToolhelp32Snapshot(processes)");
+    const rows = [];
+    try {
+        const entry = {
+            dwSize: koffi.sizeof(PROCESSENTRY32W),
+            cntUsage: 0,
+            th32ProcessID: 0,
+            th32DefaultHeapID: 0n,
+            th32ModuleID: 0,
+            cntThreads: 0,
+            th32ParentProcessID: 0,
+            pcPriClassBase: 0,
+            dwFlags: 0,
+            szExeFile: ""
+        };
+        let found = Process32FirstW(snapshot, entry);
+        while (found) {
+            const pid = Number(entry.th32ProcessID);
+            const name = String(entry.szExeFile);
+            let path = null;
+            if (pid > 0) {
+                const handle = OpenProcess(PROCESS_QUERY_LIMITED_INFORMATION | PROCESS_QUERY_INFORMATION, false, pid);
+                if (handle) {
+                    try {
+                        const capacity = 32768;
+                        const buffer = Buffer.alloc(capacity * 2);
+                        const length = [capacity];
+                        if (QueryFullProcessImageNameW(handle, 0, buffer, length)) {
+                            const count = Math.max(0, Math.min(Number(length[0]), capacity));
+                            path = buffer.toString("utf16le", 0, count * 2) || null;
+                        }
+                    }
+                    finally {
+                        CloseHandle(handle);
+                    }
+                }
+            }
+            rows.push({ pid, name, path });
+            found = Process32NextW(snapshot, entry);
+        }
+    }
+    finally {
+        CloseHandle(snapshot);
+    }
+    return rows;
+}
+export function createWindowsNativeReader() {
+    return new WindowsNativeReader();
+}

package/dist/reader-main.js

@@ -1,67 +1,2 @@
 #!/usr/bin/env node
-import { createServer } from "node:net";
-import { mkdir, rm, writeFile } from "node:fs/promises";
-import { dirname } from "node:path";
-import { serveReaderBroker } from "./reader-broker.js";
-import { createWindowsNativeReader } from "./windows-reader.js";
-function argument(name) {
-    const index = process.argv.indexOf(name);
-    return index >= 0 ? process.argv[index + 1] : undefined;
-}
-const listen = argument("--listen");
-const port = Number(argument("--port") ?? "0");
-const token = argument("--token");
-const metadata = argument("--metadata");
-let server;
-const broker = serveReaderBroker({
-    attachStdio: !listen,
-    backend: process.env.WOWDUMP_USE_FAKE_READER === "1" ? undefined : createWindowsNativeReader(),
-    onShutdown: async () => {
-        server?.close();
-        if (metadata)
-            await rm(metadata, { force: true }).catch(() => undefined);
-    }
-});
-if (listen) {
-    if (listen !== "127.0.0.1" || !token || !metadata || !Number.isSafeInteger(port) || port < 0 || port > 65535) {
-        throw new Error("--listen requires 127.0.0.1, a valid --port, --token and --metadata");
-    }
-    server = createServer(socket => {
-        socket.setEncoding("utf8");
-        let buffer = "";
-        let pending = Promise.resolve();
-        socket.on("data", chunk => {
-            buffer += chunk;
-            while (buffer.includes("\n")) {
-                const newline = buffer.indexOf("\n");
-                const line = buffer.slice(0, newline);
-                buffer = buffer.slice(newline + 1);
-                pending = pending.then(async () => {
-                    try {
-                        const envelope = JSON.parse(line);
-                        if (envelope.token !== token || !envelope.request) {
-                            socket.write(`${JSON.stringify({ ok: false, command: "auth", timestamp: Date.now(), error: { code: "AUTH_FAILED", message: "invalid reader broker token" } })}\n`);
-                            return;
-                        }
-                        socket.write(`${JSON.stringify(await broker.handle(envelope.request))}\n`);
-                    }
-                    catch (error) {
-                        socket.write(`${JSON.stringify({ ok: false, command: "parse", timestamp: Date.now(), error: { code: "INVALID_JSON", message: error instanceof Error ? error.message : String(error) } })}\n`);
-                    }
-                });
-            }
-        });
-    });
-    server.listen(port, listen, async () => {
-        await mkdir(dirname(metadata), { recursive: true });
-        const address = server?.address();
-        if (!address || typeof address === "string")
-            throw new Error("reader broker did not acquire a TCP endpoint");
-        await writeFile(metadata, `${JSON.stringify({ schema: "wowdump.reader-broker.v1", host: listen, port: address.port, token, pid: process.pid })}\n`, { encoding: "utf8", mode: 0o600 });
-    });
-}
-const shutdown = () => {
-    void broker.shutdown("request").catch(() => process.exitCode = 1);
-};
-process.once("SIGINT", shutdown);
-process.once("SIGTERM", shutdown);
+import "./reader/main.js";