wowdump 0.3.1 → 0.3.3

package/dist/cli.js

@@ -1,82 +1,106 @@
 #!/usr/bin/env node
 import { spawn } from "node:child_process";
-import { existsSync, realpathSync } from "node:fs";
-import { readFile, readdir } from "node:fs/promises";
-import { basename, extname, isAbsolute, join, resolve } from "node:path";
-import { pathToFileURL } from "node:url";
+import { createHash } from "node:crypto";
+import { existsSync, realpathSync, readFileSync } from "node:fs";
+import { mkdir, readFile, readdir, writeFile } from "node:fs/promises";
+import { basename, dirname, extname, isAbsolute, join, resolve } from "node:path";
+import { fileURLToPath, pathToFileURL } from "node:url";
 import { Command } from "commander";
-import { WindowsBrokerManager } from "./windows-launcher.js";
-import { bootstrapToolchain, resolveToolchain, resolveWowdumpHome } from "./toolchain.js";
-import { runGhidraStaticAnalysis as runCanonicalGhidraStaticAnalysis, buildGhidraHeadlessCommand } from "./ghidra.js";
-async function runStaticAnalysis(options) {
-    // ghidra.ts owns the canonical evidence/profile schema. Keep the small
-    // toolchain resolver as the CLI-facing bootstrap layer, then translate the
-    // command options into the canonical runner's vocabulary.
-    const ghidraValue = options.ghidra;
-    const ghidraResolved = ghidraValue ? resolve(ghidraValue) : undefined;
-    const ghidraIsFile = ghidraResolved ? existsSync(ghidraResolved) && !existsSync(join(ghidraResolved, "support")) : false;
-    const canonicalOptions = {
-        exe: options.executable,
-        buildKey: options.buildKey,
-        output: options.evidenceFile ?? join(options.outputDirectory ?? resolveWowdumpHome(options.env ?? process.env), "profiles", `${options.buildKey.replace(/[^A-Za-z0-9_.-]+/g, "-")}.json`),
-        projectDir: options.projectDirectory,
-        projectName: options.projectName,
-        ghidraHome: ghidraResolved && !ghidraIsFile ? ghidraResolved : undefined,
-        analyzeHeadless: ghidraResolved && ghidraIsFile ? ghidraResolved : undefined,
-        javaPath: options.java,
-        scriptPath: options.scriptDirectory,
-        scriptName: options.exporterScript,
-        timeoutMs: (options.timeoutSeconds ?? 1800) * 1000,
-        env: options.env,
-        home: options.home,
-        commandRunner: options.runner
-            ? async (file, args, commandOptions) => {
-                const value = await options.runner({ file, args: [...args], cwd: commandOptions.cwd, env: commandOptions.env });
-                return { code: value.exitCode, stdout: value.stdout, stderr: value.stderr };
+import { WindowsBrokerManager } from "./reader/launcher.js";
+import { initializeWowdumpHome, bootstrapToolchain, resolveToolchain, resolveWowdumpHome } from "./toolchain.js";
+import { runDisassembly } from "./analysis/disassemble.js";
+import { RUNTIME_EXPORT_SCRIPT } from "./analysis/runtime-script.js";
+import { ProfileEngine } from "./core/profile-engine.js";
+import { ReaderProfileAdapter } from "./adapters/reader.js";
+import { enumerateWindowsProcesses } from "./reader/windows.js";
+export function parseBuildInfo(content, file) {
+    const lines = content.split(/\r?\n/).filter(line => line.trim());
+    const headers = lines[0]?.split("|") ?? [];
+    const versionIndex = headers.indexOf("Version!STRING:0");
+    const activeIndex = headers.indexOf("Active!DEC:1");
+    const productIndex = headers.indexOf("Product!STRING:0");
+    if (versionIndex < 0 || activeIndex < 0 || productIndex < 0)
+        return null;
+    const row = lines.slice(1).map(line => line.split("|")).find(values => values[activeIndex] === "1" && values[productIndex] === "wow");
+    const version = row?.[versionIndex]?.trim();
+    const product = row?.[productIndex]?.trim();
+    if (!version || !product)
+        return null;
+    return { fileVersion: version, product, buildKey: `retail@${version}`, buildInfoFile: file };
+}
+async function discoverWowTargets(selectedPid, elevatedModules) {
+    if (process.platform !== "win32")
+        return [];
+    const targets = [];
+    const rows = enumerateWindowsProcesses()
+        .filter(item => /^Wow\.exe$/i.test(item.name))
+        .filter(item => selectedPid === undefined || item.pid === selectedPid);
+    for (const item of rows) {
+        const pid = item.pid;
+        const name = item.name;
+        if (!Number.isSafeInteger(pid) || pid < 1 || !/^Wow\.exe$/i.test(name) || (selectedPid !== undefined && pid !== selectedPid))
+            continue;
+        let path = item.path;
+        let moduleBase = null;
+        let moduleSize = null;
+        let diagnostic;
+        if ((!path || !moduleBase) && elevatedModules) {
+            try {
+                const elevated = elevatedModules(pid);
+                const response = await elevated;
+                const modules = response && typeof response === "object" && Array.isArray(response.modules)
+                    ? response.modules
+                    : [];
+                const main = modules.find(module => /^Wow\.exe$/i.test(String(module.name ?? ""))) ?? modules[0];
+                if (!path && typeof main?.path === "string" && main.path)
+                    path = main.path;
+                if (!moduleBase && typeof main?.base === "string")
+                    moduleBase = main.base;
+                if (moduleSize === null && Number.isFinite(Number(main?.size)))
+                    moduleSize = Number(main?.size);
+            }
+            catch (error) {
+                diagnostic = diagnostic ?? (error instanceof Error ? error.message : String(error));
             }
-            : undefined
-    };
-    if (options.dryRun) {
-        const resolved = resolveToolchain(options);
-        if (!resolved.ghidra || !resolved.java) {
-            throw new CliError("TOOLCHAIN_INCOMPLETE", `Ghidra toolchain is incomplete: missing ${resolved.missing.join(", ")}`, resolved);
         }
-        const projectDir = options.projectDirectory ?? join(resolved.home, "cache", "ghidra", options.buildKey.replace(/[^A-Za-z0-9_.-]+/g, "-"));
-        const command = buildGhidraHeadlessCommand({ analyzeHeadless: resolved.ghidra.executable, javaPath: resolved.java.executable }, {
-            exe: options.executable,
-            buildKey: options.buildKey,
-            projectDir,
-            projectName: options.projectName,
-            scriptPath: options.scriptDirectory,
-            scriptName: options.exporterScript,
-            output: options.evidenceFile
-        });
-        return {
-            ok: true,
-            command: "analyze.static",
-            dryRun: true,
-            buildKey: options.buildKey,
-            executable: resolve(options.executable),
-            outputFile: options.evidenceFile ?? join(projectDir, `${options.buildKey.replace(/[^A-Za-z0-9_.-]+/g, "-")}.json`),
-            commandLine: { file: command.executable, args: command.args, cwd: command.cwd },
-            toolchain: resolved,
-            profile: { schema: "wowdump.profile.v1", buildKey: options.buildKey, confidence: "candidate" }
-        };
+        let buildInfoFile = null;
+        let fileVersion = null;
+        let product = null;
+        if (path) {
+            const candidates = [join(dirname(path), ".build.info"), join(dirname(dirname(path)), ".build.info")];
+            for (const candidate of candidates) {
+                try {
+                    const text = await readFile(candidate, "utf8");
+                    const parsed = parseBuildInfo(text, candidate);
+                    if (parsed) {
+                        fileVersion = parsed.fileVersion;
+                        product = parsed.product;
+                        buildInfoFile = parsed.buildInfoFile;
+                        break;
+                    }
+                }
+                catch { /* try the next parent directory */ }
+            }
+        }
+        targets.push({ pid, name, path, moduleBase, moduleSize, fileVersion, product, buildKey: fileVersion ? `retail@${fileVersion}` : null, ...(buildInfoFile ? { buildInfoFile } : {}), ...(diagnostic ? { diagnostics: { frida: diagnostic } } : {}) });
     }
-    const result = await runCanonicalGhidraStaticAnalysis(canonicalOptions);
-    return {
-        ok: true,
-        command: "analyze.static",
-        dryRun: false,
-        buildKey: result.buildKey,
-        executable: result.executable.path,
-        executableSha256: result.executable.sha256,
-        outputFile: options.evidenceFile ?? join(options.outputDirectory ?? resolveWowdumpHome(options.env ?? process.env), "profiles", `${options.buildKey.replace(/[^A-Za-z0-9_.-]+/g, "-")}.json`),
-        commandLine: { file: result.analysis.command[0] ?? "", args: result.analysis.command.slice(1), cwd: options.projectDirectory ?? resolveWowdumpHome(options.env ?? process.env) },
-        toolchain: resolveToolchain(options),
-        profile: result.profile,
-        evidence: result
-    };
+    return targets;
+}
+function packageVersion() {
+    const override = process.env.WOWDUMP_VERSION?.trim();
+    if (override)
+        return override;
+    try {
+        const packageFile = fileURLToPath(new URL("../package.json", import.meta.url));
+        const packageJson = JSON.parse(readFileSync(packageFile, "utf8"));
+        return typeof packageJson.version === "string" ? packageJson.version : "0.0.0";
+    }
+    catch {
+        return "0.0.0";
+    }
+}
+function installedDistDirectory() {
+    return fileURLToPath(new URL(".", import.meta.url));
 }
 class CliError extends Error {
     code;
@@ -133,17 +157,17 @@ async function defaultSidecar(file, args, input) {
             child.stdin.end();
     });
 }
-function brokerCommandLine(env, cwd) {
+function brokerCommandLine(env, packageDist) {
     const configured = env.WOWDUMP_READER_COMMAND?.trim();
     if (configured)
         return { file: configured, args: [] };
-    const candidate = resolve(cwd, "dist", "reader-main.js");
+    const candidate = join(packageDist, "reader-main.js");
     return existsSync(candidate) ? { file: process.execPath, args: [candidate, "--request-stdio"] } : null;
 }
-async function defaultBroker(invocation, env, cwd, sidecar) {
-    const command = brokerCommandLine(env, cwd);
+async function defaultBroker(invocation, env, packageDist, sidecar) {
+    const command = brokerCommandLine(env, packageDist);
     if (!command) {
-        throw new CliError("BROKER_NOT_CONFIGURED", "reader broker entry was not found", { expected: resolve(cwd, "dist", "reader-main.js"), environment: "WOWDUMP_READER_COMMAND" });
+        throw new CliError("BROKER_NOT_CONFIGURED", "reader broker entry was not found", { expected: join(packageDist, "reader-main.js"), environment: "WOWDUMP_READER_COMMAND" });
     }
     const result = await (sidecar ?? defaultSidecar)(command.file, command.args, `${JSON.stringify(invocation)}\n`);
     if (result.exitCode !== 0)
@@ -158,12 +182,28 @@ async function defaultBroker(invocation, env, cwd, sidecar) {
         throw new CliError("BROKER_PROTOCOL_ERROR", "reader broker returned invalid JSON", { stdout: result.stdout });
     }
 }
+async function runFridaWorker(worker, input, timeoutMs, broker) {
+    if (process.platform !== "win32") {
+        throw new CliError("PLATFORM_UNSUPPORTED", "elevated Frida broker is currently supported on Windows only");
+    }
+    const raw = await broker({ command: "frida", payload: { worker, input, timeoutMs } });
+    const response = raw && typeof raw === "object" ? raw : {};
+    if (response.ok === false) {
+        const error = response.error && typeof response.error === "object" ? response.error : {};
+        throw new CliError("BROKER_FAILED", String(error.message ?? "elevated Frida worker failed"), { response });
+    }
+    return {
+        exitCode: Number.isSafeInteger(Number(response.exitCode)) ? Number(response.exitCode) : 1,
+        stdout: typeof response.stdout === "string" ? response.stdout : "",
+        stderr: typeof response.stderr === "string" ? response.stderr : ""
+    };
+}
 const windowsBrokerManagers = new Map();
-function persistentWindowsBroker(home, cwd) {
+function persistentWindowsBroker(home, packageDist) {
     const key = resolve(home).toLowerCase();
     let manager = windowsBrokerManagers.get(key);
     if (!manager) {
-        manager = new WindowsBrokerManager({ home, readerEntry: resolve(cwd, "dist", "reader-main.js") });
+        manager = new WindowsBrokerManager({ home, readerEntry: join(packageDist, "reader-main.js") });
         windowsBrokerManagers.set(key, manager);
     }
     return manager;
@@ -209,10 +249,10 @@ function selected(source, keys) {
 function requireRuntimeConfirmation(options) {
     if (options.confirm === true)
         return;
-    throw new CliError("CONFIRMATION_REQUIRED", "runtime export requires --confirm", {
+    throw new CliError("CONFIRMATION_REQUIRED", "runtime analysis requires --confirm", {
         pid: options.pid,
         buildKey: options.build,
-        operation: "runtime-export",
+        operation: "runtime",
         kind: options.kind,
         maxHooks: options.maxHooks,
         durationMs: options.durationMs,
@@ -220,53 +260,102 @@ function requireRuntimeConfirmation(options) {
         cleanupDeadlineMs: options.cleanupDeadlineMs
     });
 }
-function nested(record, ...path) {
-    let value = record;
-    for (const key of path) {
-        if (!value || typeof value !== "object" || Array.isArray(value))
-            return undefined;
-        value = value[key];
-    }
+function safeBuildDirectory(buildKey) {
+    const value = buildKey.trim();
+    if (!value || !/^[A-Za-z0-9_.@-]+$/.test(value))
+        throw new CliError("ARGUMENT_INVALID", "build key contains unsupported path characters");
     return value;
 }
-function compareEvidence(staticProfile, runtimeExport) {
-    const definitions = [
-        { name: "buildKey", left: staticProfile.buildKey, right: runtimeExport.buildKey },
-        {
-            name: "executableSha256",
-            left: staticProfile.executableSha256 ?? nested(staticProfile, "executable", "sha256"),
-            right: runtimeExport.executableSha256 ?? nested(runtimeExport, "executable", "sha256")
-        },
-        { name: "moduleBase", left: staticProfile.moduleBase ?? nested(staticProfile, "module", "base"), right: runtimeExport.moduleBase ?? nested(runtimeExport, "module", "base") },
-        { name: "sectionBounds", left: staticProfile.sectionBounds ?? staticProfile.sections, right: runtimeExport.sectionBounds ?? runtimeExport.sections },
-        { name: "entryBytes", left: staticProfile.entryBytes, right: runtimeExport.entryBytes },
-        { name: "matchCount", left: staticProfile.matchCount, right: runtimeExport.matchCount }
-    ];
-    return definitions.map(item => ({
-        name: item.name,
-        static: item.left ?? null,
-        runtime: item.right ?? null,
-        status: item.left === undefined || item.right === undefined
-            ? "missing"
-            : JSON.stringify(item.left) === JSON.stringify(item.right) ? "match" : "mismatch"
-    }));
+function decodeBase64(value, expectedSize, label) {
+    if (typeof value !== "string" || !/^[A-Za-z0-9+/]*={0,2}$/.test(value))
+        throw new CliError("RUNTIME_DUMP_INVALID", `${label} is not valid base64`);
+    const data = Buffer.from(value, "base64");
+    if (data.length !== expectedSize)
+        throw new CliError("RUNTIME_DUMP_INVALID", `${label} size does not match metadata`);
+    return data;
+}
+export async function persistRuntimeDump(value, outputDirectory) {
+    const sections = Array.isArray(value.sections) ? value.sections : [];
+    if (value.ok !== true || sections.length === 0)
+        return value;
+    const directory = resolve(outputDirectory);
+    await mkdir(directory, { recursive: true });
+    const summaries = [];
+    for (const raw of sections) {
+        const section = jsonRecord(JSON.stringify(raw), "runtime section");
+        const name = typeof section.name === "string" && /^[A-Za-z0-9_.-]+$/.test(section.name) ? section.name : "section";
+        const file = join(directory, `${name}.bin`);
+        const chunks = Array.isArray(section.chunks) ? section.chunks : [];
+        const buffers = chunks.map((chunk, index) => {
+            const item = jsonRecord(JSON.stringify(chunk), `runtime section ${name} chunk ${index}`);
+            return decodeBase64(item.dataBase64, Number(item.size), `${name} chunk ${index}`);
+        });
+        const data = Buffer.concat(buffers);
+        await writeFile(file, data);
+        summaries.push({
+            ...selected(section, ["name", "rva", "runtimeAddress", "virtualSize", "rawSize", "characteristics", "protection", "requestedSize", "readSize", "truncated"]),
+            file,
+            bytes: data.length,
+            sha256: createHash("sha256").update(data).digest("hex")
+        });
+    }
+    const manifest = {
+        schema: "wowdump.runtime-dump.v1",
+        kind: "dump",
+        buildKey: value.buildKey ?? null,
+        pid: value.pid ?? null,
+        module: value.module ?? null,
+        totalBytes: value.totalBytes ?? summaries.reduce((total, item) => total + Number(item.bytes ?? 0), 0),
+        truncated: value.truncated === true || summaries.some(item => item.truncated === true),
+        limits: value.limits ?? null,
+        sections: summaries,
+        evidence: value.evidence ?? [],
+        generatedAt: new Date().toISOString()
+    };
+    const manifestFile = join(directory, "manifest.json");
+    await writeFile(manifestFile, `${JSON.stringify(manifest, null, 2)}\n`, "utf8");
+    return { ...value, sections: summaries, outputDirectory: directory, manifestFile, manifest };
 }
 export function createWowdumpCli(dependencies = {}) {
     const io = dependencies.io ?? { stdout: process.stdout, stderr: process.stderr };
     const env = dependencies.env ?? process.env;
     const cwd = resolve(dependencies.cwd ?? process.cwd());
+    const packageDist = installedDistDirectory();
     const home = resolveWowdumpHome(env);
     const broker = dependencies.broker ?? (process.platform === "win32" && !dependencies.sidecar
-        ? (invocation => persistentWindowsBroker(home, cwd).request(invocation))
-        : (invocation => defaultBroker(invocation, env, cwd, dependencies.sidecar)));
-    const staticAnalysis = dependencies.staticAnalysis ?? runStaticAnalysis;
-    const sidecar = dependencies.sidecar ?? defaultSidecar;
+        ? (invocation => persistentWindowsBroker(home, packageDist).request(invocation))
+        : (invocation => defaultBroker(invocation, env, packageDist, dependencies.sidecar)));
+    const baseSidecar = dependencies.sidecar ?? defaultSidecar;
+    const sidecar = async (file, args, input) => {
+        const worker = args.length === 1 && /\.m?js$/i.test(args[0] ?? "") ? args[0] : undefined;
+        if (worker && input !== undefined)
+            return runFridaWorker(worker, input, 120_000, broker);
+        return baseSidecar(file, args, input);
+    };
+    const profileEngine = new ProfileEngine();
+    const profileAdapter = new ReaderProfileAdapter(broker);
     const program = new Command()
         .name("wowdump")
         .description("Build-aware WoW native memory analysis CLI")
-        .version("0.3.0")
+        .version(packageVersion())
         .showHelpAfterError()
         .configureOutput({ writeOut: value => io.stdout.write(value), writeErr: value => io.stderr.write(value) });
+    program.command("targets")
+        .description("Discover running WoW targets, executable paths, and build versions")
+        .option("--pid <pid>", "select one process ID")
+        .action(async (options) => {
+        const selectedPid = options.pid ? positiveInteger(options.pid, "pid") : undefined;
+        const targets = await discoverWowTargets(selectedPid, async (pid) => broker({ command: "modules", payload: { pid } }));
+        if (selectedPid !== undefined && targets.length === 0)
+            throw new CliError("TARGET_NOT_FOUND", `Wow.exe process ${selectedPid} was not found`);
+        writeJson(io, {
+            ok: targets.length > 0,
+            command: "targets",
+            selected: targets.length === 1 ? targets[0] : null,
+            requiresSelection: selectedPid === undefined && targets.length > 1,
+            targets
+        });
+    });
     program.command("target")
         .description("Show target, reader broker, profile, monitor, and Frida state")
         .option("--pid <pid>", "target process ID")
@@ -305,7 +394,8 @@ export function createWowdumpCli(dependencies = {}) {
         .option("--size <bytes>", "bounded byte count")
         .option("--request <json>", "complete read request as JSON")
         .action(async (options) => {
-        const payload = options.request ? jsonRecord(options.request, "request") : {
+        const requested = options.request ? jsonRecord(options.request, "request") : undefined;
+        const payload = requested ?? {
             pid: positiveInteger(options.pid, "pid"),
             ...(options.build ? { buildKey: options.build } : {}),
             ...(options.profile ? { profileId: options.profile } : {}),
@@ -313,6 +403,20 @@ export function createWowdumpCli(dependencies = {}) {
             ...(options.address ? { address: options.address } : {}),
             ...(options.size ? { size: positiveInteger(options.size, "size") } : {})
         };
+        const pid = positiveInteger(String(payload.pid ?? options.pid), "pid");
+        const profileId = typeof payload.profileId === "string" ? payload.profileId : (typeof options.profile === "string" ? options.profile : undefined);
+        if (profileId && payload.address === undefined) {
+            const profileFilePath = profileFile(join(home, "profiles"), profileId);
+            const profile = jsonRecord(await readFile(profileFilePath, "utf8"), profileFilePath);
+            const result = await profileEngine.read({
+                pid,
+                buildKey: typeof payload.buildKey === "string" ? payload.buildKey : undefined,
+                profile,
+                fields: Array.isArray(payload.fields) ? payload.fields.map(String) : undefined
+            }, profileAdapter);
+            writeJson(io, { ...result, profileFile: profileFilePath });
+            return;
+        }
         writeJson(io, await broker({ command: "read", payload }));
     });
     const watch = memory.command("watch").description("Manage broker-owned memory monitors");
@@ -327,17 +431,21 @@ export function createWowdumpCli(dependencies = {}) {
         .option("--interval <ms>", "sample interval", "250")
         .option("--max-samples <count>", "sample limit", "1000")
         .option("--all-samples", "emit unchanged samples")
-        .action(async (options) => writeJson(io, await broker({ command: "watch.start", payload: {
-            pid: positiveInteger(options.pid, "pid"),
-            ...(options.build ? { buildKey: options.build } : {}),
-            ...(options.profile ? { profileId: options.profile } : {}),
-            ...(options.field ? { fields: options.field } : {}),
-            ...(options.address ? { address: options.address } : {}),
-            ...(options.size ? { size: positiveInteger(options.size, "size") } : {}),
-            intervalMs: positiveInteger(options.interval, "interval"),
-            maxSamples: positiveInteger(options.maxSamples, "max-samples"),
-            changeOnly: options.allSamples !== true
-        } })));
+        .action(async (options) => {
+        if (options.profile)
+            throw new CliError("PROFILE_WATCH_UNSUPPORTED", "profile watch requires a fixed address; use repeated memory read calls for dynamic pointer fields");
+        writeJson(io, await broker({ command: "watch.start", payload: {
+                pid: positiveInteger(options.pid, "pid"),
+                ...(options.build ? { buildKey: options.build } : {}),
+                ...(options.profile ? { profileId: options.profile } : {}),
+                ...(options.field ? { fields: options.field } : {}),
+                ...(options.address ? { address: options.address } : {}),
+                ...(options.size ? { size: positiveInteger(options.size, "size") } : {}),
+                intervalMs: positiveInteger(options.interval, "interval"),
+                maxSamples: positiveInteger(options.maxSamples, "max-samples"),
+                changeOnly: options.allSamples !== true
+            } }));
+    });
     watch.command("poll")
         .description("Poll monitor events")
         .requiredOption("--id <watchId>", "monitor ID")
@@ -350,47 +458,39 @@ export function createWowdumpCli(dependencies = {}) {
         .description("Stop a monitor and release its resources")
         .requiredOption("--id <watchId>", "monitor ID")
         .action(async (options) => writeJson(io, await broker({ command: "watch.stop", payload: { watchId: options.id } })));
-    const analyze = program.command("analyze").description("Run separate static, runtime-export, and verification stages");
-    analyze.command("static")
-        .description("Analyze a disk executable with Ghidra Headless")
+    const analyze = program.command("analyze").description("Run Frida evidence export and runtime-guided disassembly");
+    analyze.command("disassemble")
+        .description("Decode Frida text evidence and produce a Reader profile")
         .requiredOption("--exe <path>", "path to Wow.exe")
         .requiredOption("--build <buildKey>", "build key")
-        .option("--build-key <buildKey>", "alias for --build")
-        .option("--java <path>", "Java executable or JDK root")
-        .option("--ghidra <path>", "analyzeHeadless executable or Ghidra root")
-        .option("--output <directory>", "profile output directory")
-        .option("--project-directory <directory>", "Ghidra project directory")
-        .option("--project-name <name>", "Ghidra project name")
-        .option("--script-directory <directory>", "Ghidra script directory")
-        .option("--exporter-script <name>", "Ghidra post-script name")
-        .option("--evidence <file>", "Ghidra exporter JSON output")
-        .option("--timeout <seconds>", "analysis timeout", "1800")
-        .option("--dry-run", "print the exact command without starting Ghidra")
-        .action(async (options) => writeJson(io, await staticAnalysis({
-        executable: options.exe,
-        buildKey: options.build ?? options.buildKey,
-        home,
-        env,
-        java: options.java,
-        ghidra: options.ghidra,
-        outputDirectory: options.output,
-        projectDirectory: options.projectDirectory,
-        projectName: options.projectName,
-        scriptDirectory: options.scriptDirectory,
-        exporterScript: options.exporterScript,
-        evidenceFile: options.evidence,
-        timeoutSeconds: positiveInteger(options.timeout, "timeout"),
+        .requiredOption("--runtime-export <file>", "runtime evidence JSON")
+        .option("--ida-evidence <file>", "JSON produced by an IDA Pro MCP analysis")
+        .option("--output <file>", "profile output JSON")
+        .option("--max-instructions <count>", "maximum decoded instructions", "256")
+        .option("--dry-run", "validate inputs without writing a profile")
+        .action(async (options) => writeJson(io, await runDisassembly({
+        exe: options.exe,
+        buildKey: options.build,
+        runtimeExport: options.runtimeExport,
+        ...(options.idaEvidence ? { idaEvidence: options.idaEvidence } : {}),
+        ...(options.output ? { output: options.output } : {}),
+        maxInstructions: positiveInteger(options.maxInstructions, "max-instructions"),
         dryRun: options.dryRun === true
     })));
-    analyze.command("runtime-export")
-        .description("Export runtime evidence through the isolated Frida sidecar")
+    analyze.command("runtime")
+        .description("Dump runtime PE sections or verify profile candidates through the elevated Frida broker")
         .requiredOption("--pid <pid>", "target process ID")
         .requiredOption("--build <buildKey>", "build key")
         .option("--build-key <buildKey>", "alias for --build")
-        .option("--kind <kind>", "text or providers", "providers")
+        .option("--kind <kind>", "dump or verify", "dump")
         .option("--worker <path>", "Frida worker entry")
-        .option("--static-profile <path>", "static profile containing candidate RVAs")
-        .option("--max-hooks <count>", "maximum hooks", "1")
+        .option("--profile <path>", "reader profile containing candidate RVAs (verify only)")
+        .option("--output-dir <path>", "directory for dump manifest and section binaries")
+        .option("--max-section-bytes <bytes>", "per-section dump limit", "134217728")
+        .option("--max-total-bytes <bytes>", "total dump limit", "268435456")
+        .option("--chunk-size <bytes>", "dump chunk size", "1048576")
+        .option("--max-verify-bytes <bytes>", "maximum bytes read per candidate", "256")
+        .option("--max-hooks <count>", "reserved compatibility limit", "1")
         .option("--duration-ms <ms>", "maximum duration", "5000")
         .option("--max-events <count>", "maximum events", "100")
         .option("--cleanup-deadline-ms <ms>", "cleanup deadline", "2000")
@@ -404,54 +504,97 @@ export function createWowdumpCli(dependencies = {}) {
             durationMs: positiveInteger(options.durationMs, "duration-ms"),
             maxEvents: positiveInteger(options.maxEvents, "max-events"),
             cleanupDeadlineMs: positiveInteger(options.cleanupDeadlineMs, "cleanup-deadline-ms"),
+            maxSectionBytes: positiveInteger(options.maxSectionBytes, "max-section-bytes"),
+            maxTotalBytes: positiveInteger(options.maxTotalBytes, "max-total-bytes"),
+            chunkSize: positiveInteger(options.chunkSize, "chunk-size"),
+            maxVerifyBytes: positiveInteger(options.maxVerifyBytes, "max-verify-bytes"),
             confirm: options.confirm === true
         };
-        if (!["text", "providers"].includes(normalized.kind))
-            throw new CliError("ARGUMENT_INVALID", "kind must be text or providers");
+        if (!["dump", "verify"].includes(normalized.kind))
+            throw new CliError("ARGUMENT_INVALID", "kind must be dump or verify");
         requireRuntimeConfirmation(normalized);
-        const worker = resolve(options.worker ?? env.WOWDUMP_FRIDA_WORKER ?? join(cwd, "dist", "frida-worker.js"));
+        if (normalized.kind === "verify" && !options.profile)
+            throw new CliError("PROFILE_REQUIRED", "verify requires --profile <file>");
+        const worker = resolve(options.worker ?? env.WOWDUMP_FRIDA_WORKER ?? join(packageDist, "frida-worker.js"));
         if (!existsSync(worker))
             throw new CliError("FRIDA_WORKER_NOT_FOUND", `Frida worker was not found: ${worker}`);
+        const profile = options.profile
+            ? jsonRecord(await readFile(resolve(options.profile), "utf8"), options.profile)
+            : undefined;
         const request = {
-            command: "runtime-export",
-            ...selected(normalized, ["pid", "build", "kind", "maxHooks", "durationMs", "maxEvents", "cleanupDeadlineMs"]),
-            ...(options.staticProfile ? { staticProfile: resolve(options.staticProfile) } : {})
+            command: "dynamic-script",
+            pid: normalized.pid,
+            build: normalized.build,
+            source: RUNTIME_EXPORT_SCRIPT,
+            exportName: "collect",
+            args: {
+                kind: normalized.kind,
+                maxHooks: normalized.maxHooks,
+                durationMs: normalized.durationMs,
+                maxEvents: normalized.maxEvents,
+                cleanupDeadlineMs: normalized.cleanupDeadlineMs,
+                maxSectionBytes: normalized.maxSectionBytes,
+                maxTotalBytes: normalized.maxTotalBytes,
+                chunkSize: normalized.chunkSize,
+                maxVerifyBytes: normalized.maxVerifyBytes,
+                ...(profile ? { profile } : {})
+            },
+            callArgs: [],
+            durationMs: normalized.durationMs
         };
         const result = await sidecar(process.execPath, [worker], `${JSON.stringify(request)}\n`);
         if (result.exitCode !== 0)
             throw new CliError("FRIDA_WORKER_FAILED", result.stderr.trim() || `Frida worker exited with ${result.exitCode}`);
         const line = result.stdout.split(/\r?\n/).find(value => value.trim());
-        writeJson(io, line ? JSON.parse(line) : { ok: true, command: "analyze.runtime-export", stdout: result.stdout });
+        const value = line ? jsonRecord(line, "runtime result") : { ok: true, stdout: result.stdout };
+        if (normalized.kind === "dump" && value.ok === true) {
+            const defaultDirectory = join(home, safeBuildDirectory(normalized.build), "runtime", `dump-${Date.now()}`);
+            const persisted = await persistRuntimeDump(value, options.outputDir ?? defaultDirectory);
+            writeJson(io, { ...persisted, command: "analyze.runtime.dump" });
+        }
+        else {
+            writeJson(io, { ...value, command: "analyze.runtime.verify" });
+        }
     });
-    analyze.command("verify")
-        .description("Compare static and runtime evidence without implicit promotion")
-        .requiredOption("--static-profile <path>", "static profile JSON")
-        .requiredOption("--runtime-export <path>", "runtime export JSON")
-        .option("--output <path>", "optional verification report path")
+    analyze.command("dynamic")
+        .description("Run a caller-supplied GumJS script through Frida")
+        .requiredOption("--pid <pid>", "target process ID")
+        .requiredOption("--build <buildKey>", "build key")
+        .requiredOption("--script <path>", "GumJS script file")
+        .option("--export <name>", "rpc.exports function to call")
+        .option("--args <json>", "JSON object exposed as __WOWDUMP_INPUT__", "{}")
+        .option("--call-args <json>", "JSON array passed to the exported function", "[]")
+        .option("--duration-ms <ms>", "maximum script duration", "5000")
+        .option("--confirm", "confirm the exact Frida operation")
         .action(async (options) => {
-        const staticFile = resolve(options.staticProfile);
-        const runtimeFile = resolve(options.runtimeExport);
-        const staticProfile = jsonRecord(await readFile(staticFile, "utf8"), staticFile);
-        const runtimeExport = jsonRecord(await readFile(runtimeFile, "utf8"), runtimeFile);
-        const checks = compareEvidence(staticProfile, runtimeExport);
-        const report = {
-            ok: checks.every(check => check.status !== "mismatch"),
-            command: "analyze.verify",
-            staticProfile: staticFile,
-            runtimeExport: runtimeFile,
-            checks,
-            confidence: staticProfile.confidence ?? "unverified",
-            promoted: false
+        const normalized = {
+            pid: positiveInteger(options.pid, "pid"),
+            build: options.build,
+            script: resolve(options.script),
+            ...(options.export ? { exportName: options.export } : {}),
+            args: jsonRecord(options.args, "args"),
+            callArgs: JSON.parse(options.callArgs),
+            durationMs: positiveInteger(options.durationMs, "duration-ms"),
+            confirm: options.confirm === true
         };
-        if (options.output) {
-            const { writeFile } = await import("node:fs/promises");
-            await writeFile(resolve(options.output), `${JSON.stringify(report, null, 2)}\n`, "utf8");
-        }
-        writeJson(io, report);
+        if (!Array.isArray(normalized.callArgs))
+            throw new CliError("ARGUMENT_INVALID", "call-args must be a JSON array");
+        requireRuntimeConfirmation(normalized);
+        if (!existsSync(normalized.script))
+            throw new CliError("FRIDA_SCRIPT_NOT_FOUND", `Frida script was not found: ${normalized.script}`);
+        const worker = resolve(env.WOWDUMP_FRIDA_WORKER ?? join(packageDist, "frida-worker.js"));
+        if (!existsSync(worker))
+            throw new CliError("FRIDA_WORKER_NOT_FOUND", `Frida worker was not found: ${worker}`);
+        const request = { command: "dynamic-script", ...selected(normalized, ["pid", "build", "script", "exportName", "args", "callArgs", "durationMs"]) };
+        const result = await sidecar(process.execPath, [worker], `${JSON.stringify(request)}\n`);
+        if (result.exitCode !== 0)
+            throw new CliError("FRIDA_WORKER_FAILED", result.stderr.trim() || `Frida worker exited with ${result.exitCode}`);
+        const line = result.stdout.split(/\r?\n/).find(value => value.trim());
+        writeJson(io, line ? JSON.parse(line) : { ok: true, command: "analyze.dynamic", stdout: result.stdout });
     });
     program.command("init")
         .description("Initialize WOWDUMP_HOME without overwriting existing files")
-        .option("--skip-toolchain-download", "only detect existing Java/Ghidra installations")
+        .option("--skip-toolchain-download", "kept for compatibility; no external toolchain is installed")
         .action(async (options) => {
         const installMissing = options.skipToolchainDownload !== true && env.WOWDUMP_SKIP_TOOLCHAIN_DOWNLOAD !== "1";
         const result = await bootstrapToolchain({ home, env, installMissing });
@@ -493,5 +636,7 @@ if (process.argv[1]) {
         invokedFile = pathToFileURL(invokedPath).href;
     }
 }
-if (invokedFile === import.meta.url)
+if (invokedFile === import.meta.url) {
+    await initializeWowdumpHome();
     process.exitCode = await runWowdumpCli();
+}