wowdump 0.3.1 → 0.3.3

package/dist/ghidra.js

@@ -1,769 +0,0 @@
-import { createHash } from "node:crypto";
-import { execFile, spawn } from "node:child_process";
-import { mkdir, readFile, writeFile } from "node:fs/promises";
-import { existsSync, readdirSync } from "node:fs";
-import { homedir, platform, tmpdir } from "node:os";
-import { basename, delimiter, dirname, extname, isAbsolute, join, normalize, resolve } from "node:path";
-import { promisify } from "node:util";
-export class GhidraError extends Error {
-    details;
-    constructor(message, details = {}) {
-        super(message);
-        this.details = details;
-        this.name = "GhidraError";
-    }
-}
-export class GhidraToolchainError extends GhidraError {
-    constructor(message, details = {}) {
-        super(message, details);
-        this.name = "GhidraToolchainError";
-    }
-}
-const execFileAsync = promisify(execFile);
-const DEFAULT_TIMEOUT_MS = 30 * 60 * 1000;
-const DEFAULT_MAX_FUNCTIONS = 100_000;
-const DEFAULT_MAX_STRINGS = 100_000;
-const DEFAULT_MAX_XREFS = 250_000;
-const TOOLCHAIN_VERSION = "unknown";
-function stringValue(value, fallback = "") {
-    return typeof value === "string" ? value : value == null ? fallback : String(value);
-}
-function numberValue(value) {
-    if (typeof value === "number" && Number.isFinite(value))
-        return value;
-    if (typeof value === "bigint") {
-        const number = Number(value);
-        return Number.isSafeInteger(number) ? number : undefined;
-    }
-    if (typeof value === "string" && value.trim() !== "") {
-        const number = Number(value);
-        return Number.isFinite(number) ? number : undefined;
-    }
-    return undefined;
-}
-function recordValue(value) {
-    return value && typeof value === "object" && !Array.isArray(value)
-        ? value
-        : {};
-}
-function arrayValue(value) {
-    return Array.isArray(value) ? value : [];
-}
-/** Convert all addresses to strings so 64-bit values never pass through Number. */
-export function normalizeAddress(value) {
-    if (value == null || value === "")
-        return undefined;
-    try {
-        if (typeof value === "bigint")
-            return `0x${value.toString(16)}`;
-        if (typeof value === "number") {
-            if (!Number.isSafeInteger(value) || value < 0)
-                return undefined;
-            return `0x${value.toString(16)}`;
-        }
-        const text = String(value).trim();
-        if (!text)
-            return undefined;
-        const parsed = /^0x/i.test(text) ? BigInt(text) : BigInt(text);
-        if (parsed < 0n)
-            return undefined;
-        return `0x${parsed.toString(16)}`;
-    }
-    catch {
-        return undefined;
-    }
-}
-function normalizedConfidence(value, fallback = "candidate") {
-    return value === "confirmed" || value === "unverified" || value === "candidate" ? value : fallback;
-}
-function safeLimit(value, fallback, maximum) {
-    const number = numberValue(value);
-    if (number == null || number < 0)
-        return fallback;
-    return Math.min(Math.floor(number), maximum);
-}
-function firstDefined(record, keys) {
-    for (const key of keys)
-        if (record[key] !== undefined && record[key] !== null)
-            return record[key];
-    return undefined;
-}
-function normalizeSection(value) {
-    const item = recordValue(value);
-    const start = normalizeAddress(firstDefined(item, ["start", "address", "base", "minAddress"]));
-    const end = normalizeAddress(firstDefined(item, ["end", "maxAddress"]));
-    const size = numberValue(firstDefined(item, ["size", "length"]));
-    return {
-        name: stringValue(firstDefined(item, ["name", "block", "section"]), "unknown"),
-        ...(start ? { start } : {}),
-        ...(end ? { end } : {}),
-        ...(size !== undefined ? { size } : {}),
-        ...(stringValue(firstDefined(item, ["permissions", "permission", "flags"])) ? { permissions: stringValue(firstDefined(item, ["permissions", "permission", "flags"])) } : {}),
-        ...(typeof item.initialized === "boolean" ? { initialized: item.initialized } : {})
-    };
-}
-function normalizeFunction(value, source) {
-    const item = recordValue(value);
-    const address = normalizeAddress(firstDefined(item, ["address", "entry", "entryPoint", "start", "offset"])) ?? "0x0";
-    const rawName = firstDefined(item, ["name", "symbol", "label"]);
-    const name = stringValue(rawName, `sub_${address.slice(2)}`);
-    const size = numberValue(firstDefined(item, ["size", "length", "bodySize"]));
-    const confidence = normalizedConfidence(item.confidence);
-    return {
-        address,
-        name,
-        ...(size !== undefined ? { size } : {}),
-        ...(stringValue(item.namespace) ? { namespace: stringValue(item.namespace) } : {}),
-        ...(stringValue(firstDefined(item, ["signature", "prototype"])) ? { signature: stringValue(firstDefined(item, ["signature", "prototype"])) } : {}),
-        ...(stringValue(firstDefined(item, ["callingConvention", "callConvention"])) ? { callingConvention: stringValue(firstDefined(item, ["callingConvention", "callConvention"])) } : {}),
-        confidence,
-        source
-    };
-}
-function normalizeString(value, source) {
-    const item = recordValue(value);
-    const raw = typeof value === "string" ? value : firstDefined(item, ["value", "string", "text", "contents"]);
-    const text = stringValue(raw);
-    const address = typeof value === "string" ? undefined : normalizeAddress(firstDefined(item, ["address", "location", "offset"]));
-    const length = numberValue(firstDefined(item, ["length", "byteLength"]));
-    return {
-        ...(address ? { address } : {}),
-        value: text,
-        ...(length !== undefined ? { length } : {}),
-        ...(stringValue(firstDefined(item, ["encoding", "charset"])) ? { encoding: stringValue(firstDefined(item, ["encoding", "charset"])) } : {}),
-        confidence: normalizedConfidence(item.confidence),
-        source
-    };
-}
-function normalizeXref(value, source) {
-    const item = recordValue(value);
-    return {
-        ...(normalizeAddress(firstDefined(item, ["from", "source", "caller", "address"])) ? { from: normalizeAddress(firstDefined(item, ["from", "source", "caller", "address"])) } : {}),
-        ...(normalizeAddress(firstDefined(item, ["to", "target", "callee"])) ? { to: normalizeAddress(firstDefined(item, ["to", "target", "callee"])) } : {}),
-        ...(stringValue(firstDefined(item, ["type", "kind"])) ? { type: stringValue(firstDefined(item, ["type", "kind"])) } : {}),
-        ...(stringValue(firstDefined(item, ["function", "functionName"])) ? { function: stringValue(firstDefined(item, ["function", "functionName"])) } : {}),
-        confidence: normalizedConfidence(item.confidence),
-        source
-    };
-}
-function deriveRva(address, imageBase) {
-    if (!address || !imageBase)
-        return undefined;
-    try {
-        const value = BigInt(address);
-        const base = BigInt(imageBase);
-        if (value < base)
-            return undefined;
-        return `0x${(value - base).toString(16)}`;
-    }
-    catch {
-        return undefined;
-    }
-}
-function normalizeMatch(value, source) {
-    const item = recordValue(value);
-    const address = normalizeAddress(firstDefined(item, ["address", "entry", "location"]));
-    const rva = normalizeAddress(firstDefined(item, ["rva", "relativeVirtualAddress"]));
-    const details = recordValue(item.details ?? item.metadata);
-    return {
-        ...(stringValue(firstDefined(item, ["name", "id", "label"])) ? { name: stringValue(firstDefined(item, ["name", "id", "label"])) } : {}),
-        ...(address ? { address } : {}),
-        ...(rva ? { rva } : {}),
-        ...(stringValue(firstDefined(item, ["pattern", "signature", "bytes"])) ? { pattern: stringValue(firstDefined(item, ["pattern", "signature", "bytes"])) } : {}),
-        ...(stringValue(item.provider) ? { provider: stringValue(item.provider) } : {}),
-        ...(Object.keys(details).length ? { details } : {}),
-        confidence: normalizedConfidence(item.confidence),
-        source
-    };
-}
-function findArray(raw, keys) {
-    for (const key of keys) {
-        const value = raw[key];
-        if (Array.isArray(value))
-            return value;
-    }
-    return [];
-}
-/**
- * Normalize output from the repository Ghidra script or a fixture exporter.
- * Unknown fields are ignored intentionally; the profile contract stays stable across Ghidra releases.
- */
-export function normalizeGhidraExport(raw, context) {
-    const source = context.source ?? "ghidra";
-    const record = recordValue(raw);
-    const moduleRecord = recordValue(record.module ?? record.binary ?? record.program);
-    const sections = findArray(moduleRecord, ["sections", "memoryBlocks", "blocks"]);
-    const startedAt = context.startedAt ?? new Date().toISOString();
-    const finishedAt = context.finishedAt ?? new Date().toISOString();
-    const startedMs = Date.parse(startedAt);
-    const finishedMs = Date.parse(finishedAt);
-    const durationMs = Number.isFinite(startedMs) && Number.isFinite(finishedMs) ? Math.max(0, finishedMs - startedMs) : 0;
-    const moduleName = stringValue(firstDefined(moduleRecord, ["name", "module", "programName"]), basename(context.exe));
-    const module = {
-        name: moduleName,
-        ...(normalizeAddress(firstDefined(moduleRecord, ["imageBase", "base", "address"])) ? { imageBase: normalizeAddress(firstDefined(moduleRecord, ["imageBase", "base", "address"])) } : {}),
-        ...(numberValue(firstDefined(moduleRecord, ["size", "imageSize"])) !== undefined ? { size: numberValue(firstDefined(moduleRecord, ["size", "imageSize"])) } : {}),
-        sections: sections.map(normalizeSection)
-    };
-    const imageBase = module.imageBase;
-    const functions = findArray(record, ["functions", "functionRecords"]).map(value => {
-        const item = normalizeFunction(value, source);
-        return { ...item, ...(item.rva ? {} : { rva: deriveRva(item.address, imageBase) }) };
-    });
-    const strings = findArray(record, ["strings", "stringRecords"]).map(value => {
-        const item = normalizeString(value, source);
-        return { ...item, ...(item.rva ? {} : { rva: deriveRva(item.address, imageBase) }) };
-    });
-    const xrefs = findArray(record, ["xrefs", "crossReferences", "references"]).map(value => {
-        const item = normalizeXref(value, source);
-        return {
-            ...item,
-            ...(item.fromRva ? {} : { fromRva: deriveRva(item.from, imageBase) }),
-            ...(item.toRva ? {} : { toRva: deriveRva(item.to, imageBase) })
-        };
-    });
-    const providers = findArray(record, ["providers", "providerMatches", "providerEvidence"]).map(value => {
-        const item = normalizeMatch(value, source);
-        return { ...item, ...(item.rva ? {} : { rva: deriveRva(item.address, imageBase) }) };
-    });
-    const signatures = findArray(record, ["signatures", "signatureMatches", "patternMatches"]).map(value => {
-        const item = normalizeMatch(value, source);
-        return { ...item, ...(item.rva ? {} : { rva: deriveRva(item.address, imageBase) }) };
-    });
-    const evidence = Array.isArray(record.evidence)
-        ? record.evidence.filter(item => item && typeof item === "object").map(item => ({ ...recordValue(item), source: recordValue(item).source ?? source }))
-        : [];
-    const confidence = normalizedConfidence(record.confidence, "candidate");
-    const sha256 = context.executableSha256 ?? stringValue(record.executableSha256 ?? record.sha256, "unknown");
-    const executableSize = context.executableSize ?? numberValue(record.executableSize) ?? 0;
-    const analysisVersion = recordValue(record.analysisVersion);
-    const analysis = {
-        tool: "ghidra-headless",
-        ghidraVersion: context.toolchain?.ghidraVersion ?? stringValue(analysisVersion.ghidraVersion ?? record.ghidraVersion, TOOLCHAIN_VERSION),
-        javaVersion: context.toolchain?.javaVersion ?? stringValue(analysisVersion.javaVersion ?? record.javaVersion, TOOLCHAIN_VERSION),
-        command: [...(context.command ?? [])],
-        startedAt,
-        finishedAt,
-        durationMs
-    };
-    const profile = {
-        schema: "wowdump.profile.v1",
-        buildKey: context.buildKey,
-        executableSha256: sha256,
-        module,
-        functions,
-        strings,
-        xrefs,
-        providers,
-        signatures,
-        confidence,
-        evidence
-    };
-    return {
-        schema: "wowdump.ghidra-evidence.v1",
-        buildKey: context.buildKey,
-        executable: { path: resolve(context.exe), sha256, size: executableSize },
-        module,
-        functions,
-        strings,
-        xrefs,
-        providers,
-        signatures,
-        analysis,
-        confidence,
-        evidence,
-        profile
-    };
-}
-function quoteWindowsArg(value) {
-    if (!/[\s"&()\[\]{}^=;!,+'`~]/.test(value))
-        return value;
-    return `"${value.replace(/(\\*)"/g, "$1$1\\\"").replace(/(\\+)$/g, "$1$1")}"`;
-}
-function isBatch(file) {
-    const extension = extname(file).toLowerCase();
-    return extension === ".bat" || extension === ".cmd";
-}
-function commandInvocation(executable, args) {
-    if (platform() !== "win32" || !isBatch(executable))
-        return { file: executable, args: [...args] };
-    const commandLine = [quoteWindowsArg(executable), ...args.map(quoteWindowsArg)].join(" ");
-    return { file: process.env.ComSpec || "cmd.exe", args: ["/d", "/s", "/c", commandLine] };
-}
-/** Expose the platform launcher shape for tests and diagnostics without starting a process. */
-export function buildGhidraProcessInvocation(executable, args, platformName = platform()) {
-    const invocation = platformName === "win32" && isBatch(executable)
-        ? { file: process.env.ComSpec || "cmd.exe", args: ["/d", "/s", "/c", "call", executable, ...args] }
-        : { file: executable, args: [...args] };
-    return { ...invocation, shell: false };
-}
-/** Standard-library process runner used by detection and analysis. */
-export const defaultGhidraCommandRunner = async (executable, args, options) => {
-    const invocation = buildGhidraProcessInvocation(executable, args);
-    return await new Promise((resolveResult, reject) => {
-        const child = spawn(invocation.file, invocation.args, {
-            cwd: options.cwd,
-            env: options.env,
-            windowsHide: true,
-            stdio: ["ignore", "pipe", "pipe"]
-        });
-        const stdout = [];
-        const stderr = [];
-        let settled = false;
-        let timedOut = false;
-        const timer = options.timeoutMs && options.timeoutMs > 0
-            ? setTimeout(() => {
-                timedOut = true;
-                child.kill();
-            }, options.timeoutMs)
-            : undefined;
-        child.stdout.on("data", chunk => stdout.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(String(chunk))));
-        child.stderr.on("data", chunk => stderr.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(String(chunk))));
-        child.once("error", error => {
-            if (timer)
-                clearTimeout(timer);
-            if (settled)
-                return;
-            settled = true;
-            reject(error);
-        });
-        child.once("close", (code, signal) => {
-            if (timer)
-                clearTimeout(timer);
-            if (settled)
-                return;
-            settled = true;
-            resolveResult({
-                code: code ?? (timedOut ? 124 : 1),
-                ...(signal ? { signal } : {}),
-                stdout: Buffer.concat(stdout).toString("utf8"),
-                stderr: Buffer.concat(stderr).toString("utf8"),
-                ...(timedOut ? { timedOut: true } : {})
-            });
-        });
-    });
-};
-function commandExists(command, env) {
-    if (isAbsolute(command))
-        return existsSync(command);
-    const path = env.PATH ?? "";
-    const extensions = platform() === "win32" ? (env.PATHEXT ?? ".EXE;.CMD;.BAT").split(";") : [""];
-    return path.split(delimiter).some(directory => extensions.some(extension => existsSync(join(directory, command + extension))));
-}
-function findOnPath(command, env) {
-    if (isAbsolute(command))
-        return existsSync(command) ? command : undefined;
-    const path = env.PATH ?? "";
-    const extensions = platform() === "win32" ? (env.PATHEXT ?? ".EXE;.CMD;.BAT").split(";") : [""];
-    for (const directory of path.split(delimiter)) {
-        for (const extension of extensions) {
-            const candidate = join(directory, command + extension);
-            if (existsSync(candidate))
-                return candidate;
-        }
-    }
-    return undefined;
-}
-function uniqueExisting(paths) {
-    const seen = new Set();
-    const result = [];
-    for (const value of paths) {
-        if (!value)
-            continue;
-        const normalized = normalize(resolve(value));
-        const key = platform() === "win32" ? normalized.toLowerCase() : normalized;
-        if (seen.has(key))
-            continue;
-        seen.add(key);
-        if (existsSync(normalized))
-            result.push(normalized);
-    }
-    return result;
-}
-function discoverGhidraHomes(root) {
-    const candidates = [];
-    if (!existsSync(root))
-        return candidates;
-    // Managed installs commonly use either ghidra-<version> or ghidra/current.
-    for (const direct of [join(root, "ghidra"), join(root, "ghidra-current"), join(root, "ghidra", "current")]) {
-        if (existsSync(direct))
-            candidates.push(direct);
-    }
-    try {
-        for (const entry of readdirSync(root, { withFileTypes: true })) {
-            if (!entry.isDirectory() || !/^ghidra([_-]|$)/i.test(entry.name))
-                continue;
-            candidates.push(join(root, entry.name));
-        }
-    }
-    catch {
-        // A protected installation directory is simply skipped; the diagnostic lists it.
-    }
-    return candidates;
-}
-function discoverJavaHomes(root) {
-    if (!existsSync(root))
-        return [];
-    const candidates = [];
-    for (const direct of [join(root, "jdk"), join(root, "jdk", "current"), join(root, "temurin"), join(root, "java")]) {
-        if (javaForHome(direct))
-            candidates.push(direct);
-    }
-    try {
-        for (const entry of readdirSync(root, { withFileTypes: true })) {
-            if (!entry.isDirectory() || !/(jdk|java|temurin)/i.test(entry.name))
-                continue;
-            const candidate = join(root, entry.name);
-            if (javaForHome(candidate))
-                candidates.push(candidate);
-        }
-    }
-    catch {
-        // Keep the managed root in the diagnostic even when enumeration is denied.
-    }
-    return candidates;
-}
-function analyzeHeadlessForHome(home) {
-    const names = platform() === "win32" ? ["analyzeHeadless.bat", "analyzeHeadless.cmd", "analyzeHeadless"] : ["analyzeHeadless"];
-    for (const relative of [join("support", names[0]), join("support", names[1] ?? names[0]), join("support", names[2] ?? names[0]), names[0]]) {
-        const candidate = join(home, relative);
-        if (existsSync(candidate))
-            return candidate;
-    }
-    return undefined;
-}
-function javaForHome(javaHome) {
-    const names = platform() === "win32" ? ["java.exe", "java"] : ["java"];
-    for (const name of names) {
-        const candidate = join(javaHome, "bin", name);
-        if (existsSync(candidate))
-            return candidate;
-    }
-    return undefined;
-}
-function parseVersion(output) {
-    const line = output.split(/\r?\n/).find(value => /version\s+["']?[^"'\s]+/i.test(value));
-    if (!line)
-        return TOOLCHAIN_VERSION;
-    const match = line.match(/version\s+["']?([^"'\s]+)/i);
-    return match?.[1] ?? line.trim().slice(0, 120);
-}
-async function probeVersion(command, runner, env) {
-    try {
-        const result = await runner(command, ["-version"], { env, timeoutMs: 15_000 });
-        return parseVersion(`${result.stdout}\n${result.stderr}`);
-    }
-    catch {
-        return TOOLCHAIN_VERSION;
-    }
-}
-function explicitHome(options, env) {
-    return options.ghidraHome ?? env.WOWDUMP_GHIDRA_HOME ?? env.WOWDUMP_GHIDRA;
-}
-/** Locate Java and Ghidra without downloading or modifying the user's installation. */
-export async function detectGhidraToolchain(options = {}) {
-    const env = options.env ?? process.env;
-    const home = options.home ?? env.WOWDUMP_HOME ?? join(options.home ?? homedir(), ".wowdump");
-    const runner = options.commandRunner ?? defaultGhidraCommandRunner;
-    if (options.mock) {
-        const mock = options.mock;
-        const ghidraHome = resolve(mock.ghidraHome ?? options.ghidraHome ?? join(home, "toolchains", "ghidra-mock"));
-        const analyzeHeadless = mock.analyzeHeadless ?? options.analyzeHeadless ?? join(ghidraHome, "support", platform() === "win32" ? "analyzeHeadless.bat" : "analyzeHeadless");
-        const javaPath = mock.javaPath ?? options.javaPath ?? join(ghidraHome, "jdk", "bin", platform() === "win32" ? "java.exe" : "java");
-        return {
-            ghidraHome,
-            analyzeHeadless,
-            javaPath,
-            ghidraVersion: mock.ghidraVersion ?? "mock",
-            javaVersion: mock.javaVersion ?? "mock",
-            source: "mock",
-            searched: [ghidraHome, javaPath]
-        };
-    }
-    const searched = [];
-    const explicitGhidra = explicitHome(options, env);
-    const explicitAnalyze = options.analyzeHeadless ?? env.WOWDUMP_ANALYZE_HEADLESS;
-    const ghidraHomes = [];
-    if (explicitAnalyze) {
-        searched.push(explicitAnalyze);
-        if (existsSync(explicitAnalyze))
-            ghidraHomes.push({ home: dirname(dirname(explicitAnalyze)), source: "explicit" });
-    }
-    if (explicitGhidra) {
-        searched.push(explicitGhidra);
-        ghidraHomes.push({ home: explicitGhidra, source: "explicit" });
-    }
-    const managedRoot = join(home, "toolchains");
-    for (const candidate of discoverGhidraHomes(managedRoot))
-        ghidraHomes.push({ home: candidate, source: "managed" });
-    const programRoots = platform() === "win32"
-        ? [env.ProgramFiles, env["ProgramFiles(x86)"], env.LOCALAPPDATA, env.APPDATA].filter((value) => Boolean(value)).map(value => join(value, "Ghidra"))
-        : ["/opt", "/usr/local", join(options.home ?? homedir(), ".local", "opt")];
-    for (const root of programRoots) {
-        searched.push(root);
-        for (const candidate of discoverGhidraHomes(root))
-            ghidraHomes.push({ home: candidate, source: "system" });
-        if (analyzeHeadlessForHome(root))
-            ghidraHomes.push({ home: root, source: "system" });
-    }
-    const pathAnalyze = explicitAnalyze && !isAbsolute(explicitAnalyze) ? findOnPath(explicitAnalyze, env) : findOnPath("analyzeHeadless", env);
-    if (pathAnalyze)
-        ghidraHomes.push({ home: dirname(dirname(pathAnalyze)), source: "environment" });
-    const javaHome = options.javaHome ?? env.WOWDUMP_JAVA_HOME ?? env.JAVA_HOME;
-    const managedJavaHomes = discoverJavaHomes(managedRoot);
-    const javaPath = options.javaPath ?? env.WOWDUMP_JAVA ?? (javaHome ? javaForHome(javaHome) : undefined)
-        ?? managedJavaHomes.map(javaForHome).find((value) => Boolean(value))
-        ?? findOnPath("java", env);
-    if (javaHome)
-        searched.push(javaHome);
-    if (javaPath)
-        searched.push(javaPath);
-    const uniqueHomes = uniqueExisting(ghidraHomes.map(item => item.home));
-    for (const candidate of uniqueHomes) {
-        const match = ghidraHomes.find(item => normalize(item.home).toLowerCase() === normalize(candidate).toLowerCase());
-        const analyze = (match?.home === dirname(dirname(explicitAnalyze ?? "")) && explicitAnalyze && existsSync(explicitAnalyze))
-            ? explicitAnalyze
-            : analyzeHeadlessForHome(candidate);
-        if (!analyze) {
-            searched.push(join(candidate, "support", "analyzeHeadless"));
-            continue;
-        }
-        if (!javaPath || (!isAbsolute(javaPath) && !commandExists(javaPath, env))) {
-            continue;
-        }
-        const actualJava = isAbsolute(javaPath) ? javaPath : findOnPath(javaPath, env) ?? javaPath;
-        const probe = options.probeVersions === false ? false : true;
-        const [ghidraVersion, javaVersion] = probe
-            ? await Promise.all([probeVersion(analyze, runner, env), probeVersion(actualJava, runner, env)])
-            : [TOOLCHAIN_VERSION, TOOLCHAIN_VERSION];
-        return {
-            ghidraHome: candidate,
-            analyzeHeadless: analyze,
-            javaPath: actualJava,
-            ghidraVersion,
-            javaVersion,
-            source: match?.source ?? "system",
-            searched
-        };
-    }
-    throw new GhidraToolchainError("Ghidra Headless toolchain was not found", { searched, hints: ["set WOWDUMP_GHIDRA_HOME and JAVA_HOME", "install Ghidra and a supported JDK", "run npm install to populate WOWDUMP_HOME/toolchains"] });
-}
-function safeProjectName(buildKey) {
-    const value = buildKey.replace(/[^A-Za-z0-9_.-]+/g, "_").replace(/^\.+/, "");
-    return value || "wowdump";
-}
-function shellCommand(command) {
-    return [command.executable, ...command.args];
-}
-/** Build an argv-safe Ghidra Headless invocation. */
-export function buildGhidraHeadlessCommand(toolchain, options) {
-    const projectDir = resolve(options.projectDir ?? join(tmpdir(), "wowdump-ghidra", safeProjectName(options.buildKey)));
-    const projectName = options.projectName ?? safeProjectName(options.buildKey);
-    const scriptPath = resolve(options.scriptPath ?? join(process.cwd(), "ghidra"));
-    const scriptName = options.scriptName ?? "WowdumpExport.java";
-    const output = resolve(options.output ?? join(projectDir, `${projectName}.raw.json`));
-    const manifestPath = resolve(options.manifestPath ?? join(projectDir, `${projectName}.manifest.json`));
-    const args = [
-        projectDir,
-        projectName,
-        "-import",
-        options.exe,
-        "-overwrite",
-        "-scriptPath",
-        scriptPath,
-        "-postScript",
-        scriptName,
-        manifestPath
-    ];
-    // Keep these values in argv too: this makes logs self-contained and helps fixture launchers.
-    args.push("-analysisTimeoutPerFile", "0");
-    return {
-        executable: toolchain.analyzeHeadless,
-        args,
-        cwd: projectDir,
-        env: { ...process.env, JAVA_HOME: dirname(dirname(toolchain.javaPath)), WOWDUMP_BUILD_KEY: options.buildKey, WOWDUMP_OUTPUT: output }
-    };
-}
-function extractJson(stdout) {
-    const trimmed = stdout.trim();
-    if (!trimmed)
-        return undefined;
-    try {
-        return JSON.parse(trimmed);
-    }
-    catch { /* continue with line/object extraction */ }
-    const lines = trimmed.split(/\r?\n/).reverse();
-    for (const line of lines) {
-        try {
-            return JSON.parse(line);
-        }
-        catch { /* ignore diagnostic lines */ }
-    }
-    const first = trimmed.indexOf("{");
-    const last = trimmed.lastIndexOf("}");
-    if (first >= 0 && last > first) {
-        try {
-            return JSON.parse(trimmed.slice(first, last + 1));
-        }
-        catch {
-            return undefined;
-        }
-    }
-    return undefined;
-}
-async function sha256File(file) {
-    const handle = await import("node:fs/promises").then(fs => fs.open(file, "r"));
-    const hash = createHash("sha256");
-    let size = 0;
-    try {
-        for await (const chunk of handle.createReadStream()) {
-            const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
-            hash.update(buffer);
-            size += buffer.length;
-        }
-    }
-    finally {
-        await handle.close();
-    }
-    return { sha256: hash.digest("hex"), size };
-}
-async function readJsonFile(file) {
-    try {
-        return JSON.parse(await readFile(file, "utf8"));
-    }
-    catch (error) {
-        throw new GhidraError(`Ghidra exporter did not produce valid JSON: ${file}`, { file, cause: String(error) });
-    }
-}
-/** Run Ghidra Headless and write a normalized, build-specific evidence/profile JSON file. */
-export async function runGhidraStaticAnalysis(options) {
-    if (!options.exe)
-        throw new GhidraError("an executable path is required");
-    if (!options.buildKey)
-        throw new GhidraError("a build key is required");
-    const exe = resolve(options.exe);
-    let executableInfo;
-    try {
-        executableInfo = await sha256File(exe);
-    }
-    catch (error) {
-        throw new GhidraError(`cannot read executable: ${exe}`, { exe, cause: String(error) });
-    }
-    const output = resolve(options.output ?? join(options.projectDir ?? join(tmpdir(), "wowdump-ghidra", safeProjectName(options.buildKey)), `static-${safeProjectName(options.buildKey)}.json`));
-    const projectDir = resolve(options.projectDir ?? join(tmpdir(), "wowdump-ghidra", safeProjectName(options.buildKey)));
-    await mkdir(projectDir, { recursive: true });
-    await mkdir(dirname(output), { recursive: true });
-    const startedAt = new Date().toISOString();
-    let raw;
-    let toolchain;
-    let command;
-    if (options.mock !== undefined) {
-        toolchain = {
-            ghidraHome: join(projectDir, "mock-ghidra"),
-            analyzeHeadless: "mock-analyzeHeadless",
-            javaPath: "mock-java",
-            ghidraVersion: "mock",
-            javaVersion: "mock",
-            source: "mock",
-            searched: []
-        };
-        if (typeof options.mock === "string")
-            raw = await readJsonFile(resolve(options.mock));
-        else
-            raw = options.mock;
-    }
-    else {
-        toolchain = options.toolchain ?? await detectGhidraToolchain({
-            ghidraHome: options.ghidraHome,
-            analyzeHeadless: options.analyzeHeadless,
-            javaHome: options.javaHome,
-            javaPath: options.javaPath,
-            env: options.env,
-            home: options.home,
-            probeVersions: options.probeVersions,
-            commandRunner: options.commandRunner
-        });
-        const manifestPath = join(projectDir, `${safeProjectName(options.buildKey)}.manifest.json`);
-        const manifest = {
-            schema: "wowdump.ghidra-manifest.v1",
-            buildKey: options.buildKey,
-            executable: exe,
-            output,
-            limits: {
-                functions: safeLimit(options.maxFunctions, DEFAULT_MAX_FUNCTIONS, DEFAULT_MAX_FUNCTIONS),
-                strings: safeLimit(options.maxStrings, DEFAULT_MAX_STRINGS, DEFAULT_MAX_STRINGS),
-                xrefs: safeLimit(options.maxXrefs, DEFAULT_MAX_XREFS, DEFAULT_MAX_XREFS)
-            }
-        };
-        await writeFile(manifestPath, JSON.stringify(manifest, null, 2), "utf8");
-        command = buildGhidraHeadlessCommand(toolchain, {
-            exe,
-            buildKey: options.buildKey,
-            projectDir,
-            projectName: options.projectName,
-            scriptPath: options.scriptPath,
-            scriptName: options.scriptName,
-            output,
-            maxFunctions: options.maxFunctions,
-            maxStrings: options.maxStrings,
-            maxXrefs: options.maxXrefs,
-            manifestPath
-        });
-        const runner = options.commandRunner ?? defaultGhidraCommandRunner;
-        let result;
-        try {
-            result = await runner(command.executable, command.args, { cwd: command.cwd, env: command.env, timeoutMs: options.timeoutMs ?? DEFAULT_TIMEOUT_MS });
-        }
-        catch (error) {
-            throw new GhidraError("failed to start Ghidra Headless", { command: shellCommand(command), cause: String(error) });
-        }
-        if (result.code !== 0) {
-            throw new GhidraError("Ghidra Headless 启动失败", {
-                command: shellCommand(command),
-                exitCode: result.code,
-                signal: result.signal,
-                timedOut: result.timedOut ?? false,
-                stdout: result.stdout.slice(-8_000),
-                stderr: result.stderr.slice(-8_000)
-            });
-        }
-        if (existsSync(output))
-            raw = await readJsonFile(output);
-        else
-            raw = extractJson(result.stdout);
-        if (raw === undefined) {
-            throw new GhidraError("Ghidra Headless completed without an exporter JSON file", {
-                command: shellCommand(command),
-                output,
-                stdout: result.stdout.slice(-8_000),
-                stderr: result.stderr.slice(-8_000)
-            });
-        }
-        if (!options.keepManifest) {
-            try {
-                await import("node:fs/promises").then(fs => fs.unlink(manifestPath));
-            }
-            catch { /* retain if locked */ }
-        }
-    }
-    const finishedAt = new Date().toISOString();
-    const evidence = normalizeGhidraExport(raw, {
-        exe,
-        buildKey: options.buildKey,
-        executableSha256: executableInfo.sha256,
-        executableSize: executableInfo.size,
-        toolchain,
-        command: command ? shellCommand(command) : [toolchain.analyzeHeadless, "<mock>"],
-        startedAt,
-        finishedAt,
-        source: options.mock === undefined ? "ghidra" : "fixture"
-    });
-    await writeFile(output, JSON.stringify(evidence, null, 2) + "\n", "utf8");
-    return evidence;
-}
-export default {
-    detectGhidraToolchain,
-    buildGhidraHeadlessCommand,
-    normalizeGhidraExport,
-    runGhidraStaticAnalysis
-};