wowdump 0.3.3 → 0.3.4

package/README.md

@@ -14,19 +14,23 @@ wowdump init
 ## 基本流程
 
 ```powershell
-# 1. 导出运行时模块段
+# 1. 发现目标并创建/复用 build 数据库
+wowdump targets
+wowdump database status --build "retail@VERSION"
+
+# 2. 导出运行时模块段
 wowdump analyze runtime --pid 1234 --build "retail@VERSION" --kind dump --confirm
 
-# 2. 用 IDA Pro MCP（若可用）或 iced-x86 分析 dump-<id>\manifest.json，保存字段候选和证据
-# 3. 将候选证据交给 profile 生成步骤，再用 reader 验证
+# 3. 用 IDA Pro MCP（若可用）或 iced-x86 分析 session dump manifest，保存字段候选和证据
+# 4. 将候选证据交给 verify，再用 Reader 验证
 
-# 4. 用户确认后，把 profile 保存到当前 build 的 profile 目录，再读取
+# 5. 用户确认后，把 profile 保存到当前 build 的 profile 目录，再读取
 wowdump memory read --pid 1234 --profile "$HOME\.wowdump\retail@VERSION\profile\player-state.json" --field playerAuras
 ```
 
 Windows reader 首次使用时由 Node 请求 UAC 启动 broker，后续调用复用同一 broker，空闲 20 分钟后退出。Frida 运行时导出需要显式 `--confirm`；高开销 Stalker 默认关闭。
 
-`analyze runtime --kind dump` 会把 `.text`、`.rdata`、`.data` 和 `.pdata` 导出为二进制文件，并写入 `manifest.json`；manifest 供 IDA Pro MCP 或 iced-x86 使用。`analyze runtime --kind verify --profile <file>` 只验证已有 profile 的 RVA。当前 build 的持久化 profile 放在 `~/.wowdump/<buildKey>/profile/`；动态导出、静态候选和验证报告放在 runtime 会话临时目录。完整字段和 JSON 约定见 `~/.agents/skills/wowdump/references/commands.md`、`references/request-schema.md` 与 `references/profiles.md`；短时 Hook 示例见 `~/.agents/skills/wowdump/scripts/dynamic-session.js`。
+`targets` 会写入 `~/.wowdump/<buildKey>/build.json` 和 `database/database.json`；同一 build 的 IDA 数据库只创建一份。`analyze runtime --kind dump` 默认把 `.text`、`.rdata`、`.pdata` 流式写入当前 session，`.data` 需通过 `--sections` 显式加入。`analyze runtime --kind verify --profile <file>` 只验证已有 profile 的 RVA。Reader 只读取 `~/.wowdump/<buildKey>/profile/`，不读取 IDA 数据库和 dump 二进制。完整字段和 JSON 约定见 `~/.agents/skills/wowdump/references/commands.md`、`references/request-schema.md` 与 `references/profiles.md`；短时 Hook 示例见 `~/.agents/skills/wowdump/scripts/dynamic-session.js`。
 
 ## 开发验证
 

package/dist/analysis/frida-runtime.js

@@ -281,6 +281,32 @@ export class FridaCommandRuntime {
             await this.detachSession(sessionId).catch(() => undefined);
         }
     }
+    /**
+     * Run a caller-supplied export while forwarding Frida binary messages to a
+     * consumer. Runtime dump uses this path so ArrayBuffers never become JSON.
+     */
+    async streamScriptCall(request, context, handler, callArgs = []) {
+        const record = await this.session(request, context);
+        const source = this.source(request.source);
+        const script = await record.session.createScript(buildPrelude(context ?? record.context) + "\n" + source, request.options);
+        let pending = Promise.resolve();
+        script.message?.connect((message, data) => {
+            pending = pending.then(() => handler(message, data));
+        });
+        await script.load();
+        try {
+            const name = requireString(request.exportName ?? request.method, "exportName");
+            const value = await exportFunction(script, name)(...callArgs.map(item => decodeHostArg(item)));
+            await pending;
+            return { sessionId: record.id, value: normalize(value), ...sessionContext(record) };
+        }
+        finally {
+            try {
+                await script.unload();
+            }
+            catch { /* cleanup is best effort */ }
+        }
+    }
     async api() {
         if (this.apiOverride)
             return this.apiOverride;

package/dist/analysis/runtime-dump.js

@@ -0,0 +1,93 @@
+import { createHash } from "node:crypto";
+import { mkdir, open, rm, writeFile } from "node:fs/promises";
+import { join, resolve } from "node:path";
+function safeName(name) {
+    const value = String(name ?? "section");
+    return /^[A-Za-z0-9_.-]+$/.test(value) ? value : "section";
+}
+/** Streams Frida ArrayBuffer messages into section files without Base64 JSON. */
+export class RuntimeDumpWriter {
+    outputDirectory;
+    options;
+    sections = new Map();
+    aborted = false;
+    constructor(options) {
+        this.options = options;
+        this.outputDirectory = resolve(options.outputDirectory);
+    }
+    async initialize() {
+        await mkdir(this.outputDirectory, { recursive: true });
+    }
+    async writeChunk(meta, data) {
+        if (this.aborted)
+            throw new Error("runtime dump writer is aborted");
+        if (!data)
+            throw new Error("runtime dump chunk has no binary payload");
+        const name = safeName(meta.section);
+        const offset = Number(meta.offset);
+        if (!Number.isSafeInteger(offset) || offset < 0)
+            throw new Error(`invalid ${name} chunk offset`);
+        let state = this.sections.get(name);
+        if (!state) {
+            const file = join(this.outputDirectory, `${name}.bin`);
+            state = { name, file, handle: await open(file, "w"), hash: createHash("sha256"), offset: 0, bytes: 0 };
+            this.sections.set(name, state);
+        }
+        if (offset !== state.offset)
+            throw new Error(`${name} chunk offset ${offset} does not follow ${state.offset}`);
+        const bytes = Buffer.from(data);
+        await state.handle.write(bytes, 0, bytes.length, state.offset);
+        state.hash.update(bytes);
+        state.offset += bytes.length;
+        state.bytes += bytes.length;
+    }
+    async finalize(value) {
+        if (this.aborted)
+            throw new Error("runtime dump writer is aborted");
+        for (const state of this.sections.values())
+            await state.handle.close();
+        const rawSections = Array.isArray(value.sections) ? value.sections : [];
+        for (const section of rawSections) {
+            const name = safeName(section.name);
+            if (!this.sections.has(name))
+                await writeFile(join(this.outputDirectory, `${name}.bin`), Buffer.alloc(0));
+        }
+        const sections = rawSections.map((section) => {
+            const name = safeName(section.name);
+            const state = this.sections.get(name);
+            return {
+                ...section,
+                ...(state ? { file: state.file, bytes: state.bytes, sha256: state.hash.digest("hex") } : { file: join(this.outputDirectory, `${name}.bin`), bytes: 0, sha256: null })
+            };
+        });
+        const manifest = {
+            schema: "wowdump.runtime-dump.v2",
+            kind: "dump",
+            buildKey: this.options.buildKey,
+            pid: this.options.pid,
+            executableSha256: this.options.executableSha256 ?? null,
+            preferredImageBase: this.options.preferredImageBase ?? null,
+            moduleBase: typeof value.module?.moduleBase === "string"
+                ? value.module.moduleBase
+                : typeof value.module?.base === "string" ? value.module.base : null,
+            moduleSize: this.options.moduleSize ?? (typeof value.module?.moduleSize === "number" ? value.module.moduleSize : null),
+            module: value.module ?? null,
+            totalBytes: sections.reduce((sum, section) => sum + Number(section.bytes ?? 0), 0),
+            truncated: value.truncated === true || sections.some(section => section.truncated === true),
+            limits: value.limits ?? null,
+            dumpParameters: this.options.dumpParameters ?? null,
+            sections,
+            evidence: value.evidence ?? [],
+            generatedAt: new Date().toISOString()
+        };
+        const manifestFile = join(this.outputDirectory, "manifest.json");
+        await writeFile(manifestFile, `${JSON.stringify(manifest, null, 2)}\n`, "utf8");
+        return { ok: true, kind: "dump", manifestFile, outputDirectory: this.outputDirectory, manifest, sections: sections.map(section => ({ name: section.name, bytes: section.bytes, sha256: section.sha256 })) };
+    }
+    async abort() {
+        this.aborted = true;
+        for (const state of this.sections.values())
+            await state.handle.close().catch(() => undefined);
+        await rm(this.outputDirectory, { recursive: true, force: true }).catch(() => undefined);
+    }
+}

package/dist/analysis/runtime-script.js

@@ -16,7 +16,6 @@ const maxSectionBytes = Math.min(Math.max(Number(input.maxSectionBytes || 128 *
 const maxTotalBytes = Math.min(Math.max(Number(input.maxTotalBytes || 256 * 1024 * 1024), 1), 768 * 1024 * 1024);
 const chunkSize = Math.min(Math.max(Number(input.chunkSize || 1024 * 1024), 4096), 4 * 1024 * 1024);
 const maxVerifyBytes = Math.min(Math.max(Number(input.maxVerifyBytes || 256), 1), 4096);
-const BASE64 = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
 
 function readBytes(address, size) {
   const value = address.readByteArray(size);
@@ -31,21 +30,6 @@ function bytesHex(address, size) {
   return output;
 }
 
-function base64(bytes) {
-  let output = "";
-  for (let index = 0; index < bytes.length; index += 3) {
-    const first = bytes[index];
-    const second = index + 1 < bytes.length ? bytes[index + 1] : 0;
-    const third = index + 2 < bytes.length ? bytes[index + 2] : 0;
-    const value = (first << 16) | (second << 8) | third;
-    output += BASE64[(value >>> 18) & 63];
-    output += BASE64[(value >>> 12) & 63];
-    output += index + 1 < bytes.length ? BASE64[(value >>> 6) & 63] : "=";
-    output += index + 2 < bytes.length ? BASE64[value & 63] : "=";
-  }
-  return output;
-}
-
 function ascii(address, size) {
   const bytes = readBytes(address, size);
   if (!bytes) return "";
@@ -111,18 +95,17 @@ function dumpSection(section, totalState) {
   const requestedSize = Math.min(section.size, maxSectionBytes);
   const available = Math.max(0, maxTotalBytes - totalState.bytes);
   const readSize = Math.min(requestedSize, available);
-  const chunks = [];
   let offset = 0;
   while (offset < readSize) {
     const size = Math.min(chunkSize, readSize - offset);
     const bytes = readBytes(module.base.add(parseInt(section.rva, 16)).add(offset), size);
     if (!bytes) break;
-    chunks.push({ offset, size: bytes.length, dataBase64: base64(bytes) });
+    send({ type: "wowdump.dump.chunk", section: section.name, offset, size: bytes.length }, bytes.buffer);
     offset += bytes.length;
     if (bytes.length !== size) break;
   }
   totalState.bytes += offset;
-  return { ...section, requestedSize, readSize: offset, truncated: offset < section.size, chunks };
+  return { ...section, requestedSize, readSize: offset, truncated: offset < section.size };
 }
 
 function candidateEntries(profile) {
@@ -146,7 +129,10 @@ function collect() {
   if (input.kind === "dump") {
     const parsed = parseSections();
     if (parsed.error) return { ok: false, kind: "dump", module: { name: module.name, moduleBase: module.base.toString(), moduleSize: module.size }, sections: [], records: [], evidence: [{ source: "frida", kind: "pe-parse-failed", error: parsed.error }] };
-    const selected = parsed.sections.filter(section => [".text", ".rdata", ".data", ".pdata"].includes(section.name.toLowerCase()));
+    const requestedSections = Array.isArray(input.sections) && input.sections.length > 0
+      ? input.sections.map(value => String(value).toLowerCase())
+      : [".text", ".rdata", ".pdata"];
+    const selected = parsed.sections.filter(section => requestedSections.includes(section.name.toLowerCase()));
     const totalState = { bytes: 0 };
     const sections = selected.map(section => dumpSection(section, totalState));
     return { ok: true, kind: "dump", module: { name: module.name, moduleBase: module.base.toString(), moduleSize: module.size, path: module.path }, sections, totalBytes: totalState.bytes, limits: { maxSectionBytes, maxTotalBytes, chunkSize }, truncated: sections.some(section => section.truncated), evidence: [{ source: "frida", kind: "frida-runtime-pe-sections", sections: sections.map(section => section.name), totalBytes: totalState.bytes }] };

package/dist/cli.js

@@ -1,14 +1,14 @@
 #!/usr/bin/env node
 import { spawn } from "node:child_process";
-import { createHash } from "node:crypto";
+import { randomUUID } from "node:crypto";
 import { existsSync, realpathSync, readFileSync } from "node:fs";
-import { mkdir, readFile, readdir, writeFile } from "node:fs/promises";
+import { mkdir, open, readFile, readdir, writeFile } from "node:fs/promises";
 import { basename, dirname, extname, isAbsolute, join, resolve } from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";
 import { Command } from "commander";
 import { WindowsBrokerManager } from "./reader/launcher.js";
-import { initializeWowdumpHome, bootstrapToolchain, resolveToolchain, resolveWowdumpHome } from "./toolchain.js";
-import { runDisassembly } from "./analysis/disassemble.js";
+import { initializeWowdumpHome, bootstrapToolchain, resolveToolchain } from "./toolchain.js";
+import { buildPaths, databaseStatus, ensureBuild, findReusableDump, readBuild, resolveWowdumpHome, safeBuildKey, sha256File } from "./core/build-store.js";
 import { RUNTIME_EXPORT_SCRIPT } from "./analysis/runtime-script.js";
 import { ProfileEngine } from "./core/profile-engine.js";
 import { ReaderProfileAdapter } from "./adapters/reader.js";
@@ -86,6 +86,64 @@ async function discoverWowTargets(selectedPid, elevatedModules) {
     }
     return targets;
 }
+async function preferredImageBase(file) {
+    let handle;
+    try {
+        handle = await open(file, "r");
+        const header = Buffer.alloc(64 * 1024);
+        await handle.read(header, 0, header.length, 0);
+        if (header.length < 0x40 || header.readUInt16LE(0) !== 0x5a4d)
+            return null;
+        const peOffset = header.readUInt32LE(0x3c);
+        if (peOffset + 0x58 > header.length || header.readUInt32LE(peOffset) !== 0x00004550)
+            return null;
+        const optional = peOffset + 24;
+        const magic = header.readUInt16LE(optional);
+        if (magic === 0x20b)
+            return `0x${header.readBigUInt64LE(optional + 24).toString(16)}`;
+        if (magic === 0x10b)
+            return `0x${BigInt(header.readUInt32LE(optional + 28)).toString(16)}`;
+        return null;
+    }
+    catch {
+        return null;
+    }
+    finally {
+        if (handle)
+            await handle.close().catch(() => undefined);
+    }
+}
+async function persistDiscoveredBuilds(home, targets) {
+    for (const target of targets) {
+        const path = typeof target.path === "string" ? target.path : null;
+        const buildKey = typeof target.buildKey === "string" ? target.buildKey : null;
+        if (!path || !buildKey)
+            continue;
+        try {
+            const executableSha256 = await sha256File(path);
+            const imageBase = await preferredImageBase(path);
+            const result = await ensureBuild(home, {
+                buildKey: safeBuildKey(buildKey),
+                executablePath: path,
+                executableSha256,
+                preferredImageBase: imageBase,
+                moduleSize: Number.isSafeInteger(Number(target.moduleSize)) ? Number(target.moduleSize) : null
+            });
+            target.executableSha256 = executableSha256;
+            target.preferredImageBase = imageBase;
+            target.database = {
+                directory: buildPaths(home, buildKey).database,
+                path: buildPaths(home, buildKey).databaseFile,
+                status: result.database.status,
+                reused: result.reused
+            };
+        }
+        catch (error) {
+            target.diagnostics = { ...(target.diagnostics && typeof target.diagnostics === "object" ? target.diagnostics : {}), buildStore: error instanceof Error ? error.message : String(error) };
+        }
+    }
+    return targets;
+}
 function packageVersion() {
     const override = process.env.WOWDUMP_VERSION?.trim();
     if (override)
@@ -260,61 +318,36 @@ function requireRuntimeConfirmation(options) {
         cleanupDeadlineMs: options.cleanupDeadlineMs
     });
 }
-function safeBuildDirectory(buildKey) {
-    const value = buildKey.trim();
-    if (!value || !/^[A-Za-z0-9_.@-]+$/.test(value))
-        throw new CliError("ARGUMENT_INVALID", "build key contains unsupported path characters");
-    return value;
+function profileDirectoryFor(home, buildKey) {
+    if (!buildKey)
+        throw new CliError("BUILD_REQUIRED", "a build key is required to resolve the profile directory");
+    return buildPaths(home, safeBuildDirectory(buildKey)).profile;
 }
-function decodeBase64(value, expectedSize, label) {
-    if (typeof value !== "string" || !/^[A-Za-z0-9+/]*={0,2}$/.test(value))
-        throw new CliError("RUNTIME_DUMP_INVALID", `${label} is not valid base64`);
-    const data = Buffer.from(value, "base64");
-    if (data.length !== expectedSize)
-        throw new CliError("RUNTIME_DUMP_INVALID", `${label} size does not match metadata`);
-    return data;
+async function validateProfileIdentity(home, buildKey, profile, file) {
+    if (!buildKey)
+        return;
+    if (typeof profile.buildKey === "string" && profile.buildKey !== buildKey) {
+        throw new CliError("BUILD_MISMATCH", `profile build ${profile.buildKey} does not match ${buildKey}`, { profileFile: file });
+    }
+    const build = await readBuild(home, buildKey);
+    if (!build)
+        return;
+    const profileHash = typeof profile.executableSha256 === "string"
+        ? profile.executableSha256
+        : profile.executable && typeof profile.executable === "object" && !Array.isArray(profile.executable)
+            ? String(profile.executable.sha256 ?? "")
+            : "";
+    if (profileHash && profileHash !== build.executableSha256) {
+        throw new CliError("EXECUTABLE_MISMATCH", "profile executable hash does not match the selected build", { expected: build.executableSha256, actual: profileHash, profileFile: file });
+    }
 }
-export async function persistRuntimeDump(value, outputDirectory) {
-    const sections = Array.isArray(value.sections) ? value.sections : [];
-    if (value.ok !== true || sections.length === 0)
-        return value;
-    const directory = resolve(outputDirectory);
-    await mkdir(directory, { recursive: true });
-    const summaries = [];
-    for (const raw of sections) {
-        const section = jsonRecord(JSON.stringify(raw), "runtime section");
-        const name = typeof section.name === "string" && /^[A-Za-z0-9_.-]+$/.test(section.name) ? section.name : "section";
-        const file = join(directory, `${name}.bin`);
-        const chunks = Array.isArray(section.chunks) ? section.chunks : [];
-        const buffers = chunks.map((chunk, index) => {
-            const item = jsonRecord(JSON.stringify(chunk), `runtime section ${name} chunk ${index}`);
-            return decodeBase64(item.dataBase64, Number(item.size), `${name} chunk ${index}`);
-        });
-        const data = Buffer.concat(buffers);
-        await writeFile(file, data);
-        summaries.push({
-            ...selected(section, ["name", "rva", "runtimeAddress", "virtualSize", "rawSize", "characteristics", "protection", "requestedSize", "readSize", "truncated"]),
-            file,
-            bytes: data.length,
-            sha256: createHash("sha256").update(data).digest("hex")
-        });
+function safeBuildDirectory(buildKey) {
+    try {
+        return safeBuildKey(buildKey);
+    }
+    catch {
+        throw new CliError("ARGUMENT_INVALID", "build key contains unsupported path characters");
     }
-    const manifest = {
-        schema: "wowdump.runtime-dump.v1",
-        kind: "dump",
-        buildKey: value.buildKey ?? null,
-        pid: value.pid ?? null,
-        module: value.module ?? null,
-        totalBytes: value.totalBytes ?? summaries.reduce((total, item) => total + Number(item.bytes ?? 0), 0),
-        truncated: value.truncated === true || summaries.some(item => item.truncated === true),
-        limits: value.limits ?? null,
-        sections: summaries,
-        evidence: value.evidence ?? [],
-        generatedAt: new Date().toISOString()
-    };
-    const manifestFile = join(directory, "manifest.json");
-    await writeFile(manifestFile, `${JSON.stringify(manifest, null, 2)}\n`, "utf8");
-    return { ...value, sections: summaries, outputDirectory: directory, manifestFile, manifest };
 }
 export function createWowdumpCli(dependencies = {}) {
     const io = dependencies.io ?? { stdout: process.stdout, stderr: process.stderr };
@@ -345,7 +378,7 @@ export function createWowdumpCli(dependencies = {}) {
         .option("--pid <pid>", "select one process ID")
         .action(async (options) => {
         const selectedPid = options.pid ? positiveInteger(options.pid, "pid") : undefined;
-        const targets = await discoverWowTargets(selectedPid, async (pid) => broker({ command: "modules", payload: { pid } }));
+        const targets = await persistDiscoveredBuilds(home, await discoverWowTargets(selectedPid, async (pid) => broker({ command: "modules", payload: { pid } })));
         if (selectedPid !== undefined && targets.length === 0)
             throw new CliError("TARGET_NOT_FOUND", `Wow.exe process ${selectedPid} was not found`);
         writeJson(io, {
@@ -356,6 +389,14 @@ export function createWowdumpCli(dependencies = {}) {
             targets
         });
     });
+    program.command("database")
+        .description("Show the persistent static database state for a build")
+        .command("status")
+        .description("Show database path, lock and freshness")
+        .requiredOption("--build <buildKey>", "build key")
+        .action(async (options) => {
+        writeJson(io, { ...await databaseStatus(home, options.build), command: "database.status" });
+    });
     program.command("target")
         .description("Show target, reader broker, profile, monitor, and Frida state")
         .option("--pid <pid>", "target process ID")
@@ -371,9 +412,10 @@ export function createWowdumpCli(dependencies = {}) {
     program.command("profiles")
         .description("List profiles or describe one profile")
         .argument("[id-or-file]", "profile ID or absolute JSON file")
-        .option("--directory <path>", "profile directory", join(home, "profiles"))
+        .option("--build <buildKey>", "build key used for the default profile directory")
+        .option("--directory <path>", "profile directory")
         .action(async (idOrFile, options) => {
-        const directory = resolve(options.directory);
+        const directory = resolve(options.directory ?? profileDirectoryFor(home, options.build));
         if (idOrFile) {
             const file = profileFile(directory, idOrFile);
             const profile = jsonRecord(await readFile(file, "utf8"), file);
@@ -404,13 +446,27 @@ export function createWowdumpCli(dependencies = {}) {
             ...(options.size ? { size: positiveInteger(options.size, "size") } : {})
         };
         const pid = positiveInteger(String(payload.pid ?? options.pid), "pid");
-        const profileId = typeof payload.profileId === "string" ? payload.profileId : (typeof options.profile === "string" ? options.profile : undefined);
+        let profileId = typeof payload.profileId === "string" ? payload.profileId : (typeof options.profile === "string" ? options.profile : undefined);
+        const requestedBuild = typeof payload.buildKey === "string" ? payload.buildKey : (typeof options.build === "string" ? options.build : undefined);
+        if (!profileId && payload.address === undefined && requestedBuild) {
+            const available = await listProfileFiles(profileDirectoryFor(home, requestedBuild));
+            if (available.length === 1)
+                profileId = basename(available[0], extname(available[0]));
+            else if (available.length === 0)
+                throw new CliError("PROFILE_NOT_FOUND", `no profile exists for build ${requestedBuild}`, { directory: profileDirectoryFor(home, requestedBuild) });
+            else
+                throw new CliError("PROFILE_SELECTION_REQUIRED", `more than one profile exists for build ${requestedBuild}`, { profiles: available });
+        }
         if (profileId && payload.address === undefined) {
-            const profileFilePath = profileFile(join(home, "profiles"), profileId);
+            const buildKey = requestedBuild;
+            const profileFilePath = profileFile(isAbsolute(profileId) ? dirname(profileId) : profileDirectoryFor(home, buildKey), profileId);
             const profile = jsonRecord(await readFile(profileFilePath, "utf8"), profileFilePath);
+            await validateProfileIdentity(home, buildKey, profile, profileFilePath);
+            const buildRecord = buildKey ? await readBuild(home, buildKey) : null;
             const result = await profileEngine.read({
                 pid,
-                buildKey: typeof payload.buildKey === "string" ? payload.buildKey : undefined,
+                buildKey,
+                ...(buildRecord?.executableSha256 ? { executableSha256: buildRecord.executableSha256 } : {}),
                 profile,
                 fields: Array.isArray(payload.fields) ? payload.fields.map(String) : undefined
             }, profileAdapter);
@@ -458,25 +514,7 @@ export function createWowdumpCli(dependencies = {}) {
         .description("Stop a monitor and release its resources")
         .requiredOption("--id <watchId>", "monitor ID")
         .action(async (options) => writeJson(io, await broker({ command: "watch.stop", payload: { watchId: options.id } })));
-    const analyze = program.command("analyze").description("Run Frida evidence export and runtime-guided disassembly");
-    analyze.command("disassemble")
-        .description("Decode Frida text evidence and produce a Reader profile")
-        .requiredOption("--exe <path>", "path to Wow.exe")
-        .requiredOption("--build <buildKey>", "build key")
-        .requiredOption("--runtime-export <file>", "runtime evidence JSON")
-        .option("--ida-evidence <file>", "JSON produced by an IDA Pro MCP analysis")
-        .option("--output <file>", "profile output JSON")
-        .option("--max-instructions <count>", "maximum decoded instructions", "256")
-        .option("--dry-run", "validate inputs without writing a profile")
-        .action(async (options) => writeJson(io, await runDisassembly({
-        exe: options.exe,
-        buildKey: options.build,
-        runtimeExport: options.runtimeExport,
-        ...(options.idaEvidence ? { idaEvidence: options.idaEvidence } : {}),
-        ...(options.output ? { output: options.output } : {}),
-        maxInstructions: positiveInteger(options.maxInstructions, "max-instructions"),
-        dryRun: options.dryRun === true
-    })));
+    const analyze = program.command("analyze").description("Run Frida evidence export and bounded runtime operations");
     analyze.command("runtime")
         .description("Dump runtime PE sections or verify profile candidates through the elevated Frida broker")
         .requiredOption("--pid <pid>", "target process ID")
@@ -486,6 +524,8 @@ export function createWowdumpCli(dependencies = {}) {
         .option("--worker <path>", "Frida worker entry")
         .option("--profile <path>", "reader profile containing candidate RVAs (verify only)")
         .option("--output-dir <path>", "directory for dump manifest and section binaries")
+        .option("--sections <names...>", "sections to dump (default: .text .rdata .pdata)")
+        .option("--no-progress", "disable dump progress on stderr")
         .option("--max-section-bytes <bytes>", "per-section dump limit", "134217728")
         .option("--max-total-bytes <bytes>", "total dump limit", "268435456")
         .option("--chunk-size <bytes>", "dump chunk size", "1048576")
@@ -521,12 +561,41 @@ export function createWowdumpCli(dependencies = {}) {
         const profile = options.profile
             ? jsonRecord(await readFile(resolve(options.profile), "utf8"), options.profile)
             : undefined;
+        const buildRecord = await readBuild(home, normalized.build);
+        if (profile)
+            await validateProfileIdentity(home, normalized.build, profile, resolve(options.profile));
+        const sections = Array.isArray(options.sections) && options.sections.length > 0
+            ? options.sections.map((value) => String(value).toLowerCase())
+            : [".text", ".rdata", ".pdata"];
+        if (normalized.kind === "dump") {
+            const reusable = buildRecord?.executableSha256
+                ? await findReusableDump(home, normalized.build, {
+                    executableSha256: buildRecord.executableSha256,
+                    sections,
+                    maxSectionBytes: normalized.maxSectionBytes,
+                    maxTotalBytes: normalized.maxTotalBytes,
+                    chunkSize: normalized.chunkSize
+                })
+                : null;
+            if (reusable) {
+                writeJson(io, { ok: true, command: "analyze.runtime.dump", reused: true, manifestFile: String(reusable.manifestFile ?? ""), manifest: reusable });
+                return;
+            }
+        }
+        const sessionId = randomUUID();
+        const sessionDirectory = options.outputDir
+            ? resolve(options.outputDir, "..")
+            : join(buildPaths(home, normalized.build).runtime, sessionId);
+        const outputDirectory = resolve(options.outputDir ?? join(sessionDirectory, "dump"));
+        await mkdir(sessionDirectory, { recursive: true });
+        await writeFile(join(sessionDirectory, "target.json"), `${JSON.stringify({ schema: "wowdump.runtime-target.v1", pid: normalized.pid, buildKey: normalized.build, executableSha256: buildRecord?.executableSha256 ?? null, sessionId, createdAt: new Date().toISOString() }, null, 2)}\n`, "utf8");
         const request = {
-            command: "dynamic-script",
+            command: normalized.kind === "dump" ? "runtime-dump" : "dynamic-script",
             pid: normalized.pid,
             build: normalized.build,
             source: RUNTIME_EXPORT_SCRIPT,
             exportName: "collect",
+            ...(normalized.kind === "dump" ? { outputDir: outputDirectory, progress: options.progress !== false, executableSha256: buildRecord?.executableSha256 ?? null, preferredImageBase: buildRecord?.preferredImageBase ?? null, moduleSize: buildRecord?.moduleSize ?? null, dumpParameters: { executableSha256: buildRecord?.executableSha256 ?? null, sections, maxSectionBytes: normalized.maxSectionBytes, maxTotalBytes: normalized.maxTotalBytes, chunkSize: normalized.chunkSize } } : {}),
             args: {
                 kind: normalized.kind,
                 maxHooks: normalized.maxHooks,
@@ -537,22 +606,29 @@ export function createWowdumpCli(dependencies = {}) {
                 maxTotalBytes: normalized.maxTotalBytes,
                 chunkSize: normalized.chunkSize,
                 maxVerifyBytes: normalized.maxVerifyBytes,
+                ...(normalized.kind === "dump" ? { sections } : {}),
                 ...(profile ? { profile } : {})
             },
             callArgs: [],
             durationMs: normalized.durationMs
         };
         const result = await sidecar(process.execPath, [worker], `${JSON.stringify(request)}\n`);
+        if (result.stderr && options.progress !== false)
+            io.stderr.write(result.stderr);
         if (result.exitCode !== 0)
             throw new CliError("FRIDA_WORKER_FAILED", result.stderr.trim() || `Frida worker exited with ${result.exitCode}`);
         const line = result.stdout.split(/\r?\n/).find(value => value.trim());
         const value = line ? jsonRecord(line, "runtime result") : { ok: true, stdout: result.stdout };
         if (normalized.kind === "dump" && value.ok === true) {
-            const defaultDirectory = join(home, safeBuildDirectory(normalized.build), "runtime", `dump-${Date.now()}`);
-            const persisted = await persistRuntimeDump(value, options.outputDir ?? defaultDirectory);
-            writeJson(io, { ...persisted, command: "analyze.runtime.dump" });
+            if (typeof value.manifestFile === "string") {
+                await writeFile(join(sessionDirectory, "dynamic.json"), `${JSON.stringify(value.manifest ?? value, null, 2)}\n`, "utf8").catch(() => undefined);
+                writeJson(io, { ...value, command: "analyze.runtime.dump", sessionDirectory });
+            }
+            else
+                throw new CliError("RUNTIME_DUMP_INVALID", "runtime dump worker returned no manifest");
         }
         else {
+            await writeFile(join(sessionDirectory, "verify.json"), `${JSON.stringify(value, null, 2)}\n`, "utf8").catch(() => undefined);
             writeJson(io, { ...value, command: "analyze.runtime.verify" });
         }
     });
@@ -586,11 +662,17 @@ export function createWowdumpCli(dependencies = {}) {
         if (!existsSync(worker))
             throw new CliError("FRIDA_WORKER_NOT_FOUND", `Frida worker was not found: ${worker}`);
         const request = { command: "dynamic-script", ...selected(normalized, ["pid", "build", "script", "exportName", "args", "callArgs", "durationMs"]) };
+        const sessionId = randomUUID();
+        const sessionDirectory = join(buildPaths(home, normalized.build).runtime, sessionId);
+        await mkdir(sessionDirectory, { recursive: true });
+        await writeFile(join(sessionDirectory, "target.json"), `${JSON.stringify({ schema: "wowdump.runtime-target.v1", pid: normalized.pid, buildKey: normalized.build, sessionId, createdAt: new Date().toISOString() }, null, 2)}\n`, "utf8");
         const result = await sidecar(process.execPath, [worker], `${JSON.stringify(request)}\n`);
         if (result.exitCode !== 0)
             throw new CliError("FRIDA_WORKER_FAILED", result.stderr.trim() || `Frida worker exited with ${result.exitCode}`);
         const line = result.stdout.split(/\r?\n/).find(value => value.trim());
-        writeJson(io, line ? JSON.parse(line) : { ok: true, command: "analyze.dynamic", stdout: result.stdout });
+        const value = line ? JSON.parse(line) : { ok: true, command: "analyze.dynamic", stdout: result.stdout };
+        await writeFile(join(sessionDirectory, "dynamic.json"), `${JSON.stringify(value, null, 2)}\n`, "utf8");
+        writeJson(io, { ...value, command: "analyze.dynamic", sessionDirectory });
     });
     program.command("init")
         .description("Initialize WOWDUMP_HOME without overwriting existing files")

package/dist/core/build-store.js

@@ -0,0 +1,166 @@
+import { createHash } from "node:crypto";
+import { createReadStream } from "node:fs";
+import { mkdir, open, readFile, readdir, rm, stat, writeFile } from "node:fs/promises";
+import { homedir } from "node:os";
+import { join, normalize, resolve } from "node:path";
+export function resolveWowdumpHome(env = process.env, userHome = homedir()) {
+    return normalize(resolve(env.WOWDUMP_HOME || join(userHome, ".wowdump")));
+}
+export function safeBuildKey(buildKey) {
+    const value = buildKey.trim();
+    if (!value || value === "." || value === ".." || !/^[A-Za-z0-9_.@-]+$/.test(value))
+        throw new Error("build key contains unsupported path characters");
+    return value;
+}
+export function buildDirectory(home, buildKey) {
+    return join(resolve(home), safeBuildKey(buildKey));
+}
+export function buildPaths(home, buildKey) {
+    const build = buildDirectory(home, buildKey);
+    const database = join(build, "database");
+    return {
+        root: resolve(home),
+        build,
+        database,
+        databaseFile: join(database, "database.json"),
+        databaseLock: join(database, "database.lock"),
+        ida: join(database, "ida"),
+        profile: join(build, "profile"),
+        runtime: join(build, "runtime")
+    };
+}
+export async function sha256File(file) {
+    return new Promise((resolveHash, reject) => {
+        const hash = createHash("sha256");
+        const stream = createReadStream(file);
+        stream.on("data", chunk => hash.update(chunk));
+        stream.once("error", reject);
+        stream.once("end", () => resolveHash(hash.digest("hex")));
+    });
+}
+async function readJson(file) {
+    try {
+        return JSON.parse(await readFile(file, "utf8"));
+    }
+    catch (error) {
+        if (error.code === "ENOENT")
+            return null;
+        throw error;
+    }
+}
+async function writeJson(file, value) {
+    await mkdir(resolve(file, ".."), { recursive: true });
+    await writeFile(file, `${JSON.stringify(value, null, 2)}\n`, "utf8");
+}
+export async function readBuild(home, buildKey) {
+    return readJson(join(buildDirectory(home, buildKey), "build.json"));
+}
+export async function readDatabase(home, buildKey) {
+    return readJson(buildPaths(home, buildKey).databaseFile);
+}
+async function ensureBuildUnlocked(home, input) {
+    const paths = buildPaths(home, input.buildKey);
+    await mkdir(paths.profile, { recursive: true });
+    await mkdir(paths.ida, { recursive: true });
+    await mkdir(paths.runtime, { recursive: true });
+    const now = new Date().toISOString();
+    const oldBuild = await readJson(join(paths.build, "build.json"));
+    const oldDatabase = await readJson(paths.databaseFile);
+    const sameIdentity = Boolean(oldBuild && oldDatabase
+        && oldBuild.executableSha256 === input.executableSha256
+        && oldBuild.preferredImageBase === input.preferredImageBase
+        && oldBuild.moduleSize === input.moduleSize
+        && oldDatabase.executableSha256 === input.executableSha256
+        && oldDatabase.preferredImageBase === input.preferredImageBase
+        && oldDatabase.moduleSize === input.moduleSize);
+    const build = {
+        schema: "wowdump.build.v1",
+        ...input,
+        createdAt: oldBuild?.createdAt ?? now,
+        updatedAt: now
+    };
+    const database = {
+        schema: "wowdump.database.v1",
+        buildKey: input.buildKey,
+        executableSha256: input.executableSha256,
+        preferredImageBase: input.preferredImageBase,
+        moduleSize: input.moduleSize,
+        idaDatabase: join(paths.ida, "Wow.i64"),
+        idaVersion: oldDatabase?.idaVersion ?? null,
+        status: sameIdentity ? (oldDatabase?.status ?? "creating") : oldDatabase ? "stale" : "creating",
+        createdAt: oldDatabase?.createdAt ?? now,
+        updatedAt: now,
+        lastAnalysisAt: oldDatabase?.lastAnalysisAt ?? null
+    };
+    await writeJson(join(paths.build, "build.json"), build);
+    await writeJson(paths.databaseFile, database);
+    return { build, database, reused: sameIdentity && database.status === "ready" };
+}
+export async function ensureBuild(home, input) {
+    const release = await acquireDatabaseLock(home, input.buildKey);
+    try {
+        return await ensureBuildUnlocked(home, input);
+    }
+    finally {
+        await release();
+    }
+}
+export async function markDatabaseReady(home, buildKey, patch = {}) {
+    const current = await readDatabase(home, buildKey);
+    if (!current)
+        throw new Error(`database for ${buildKey} does not exist`);
+    const database = { ...current, ...patch, status: "ready", updatedAt: new Date().toISOString(), lastAnalysisAt: new Date().toISOString() };
+    await writeJson(buildPaths(home, buildKey).databaseFile, database);
+    return database;
+}
+export async function acquireDatabaseLock(home, buildKey) {
+    const paths = buildPaths(home, buildKey);
+    await mkdir(paths.database, { recursive: true });
+    let handle;
+    try {
+        handle = await open(paths.databaseLock, "wx");
+    }
+    catch (error) {
+        throw new Error(`database is locked: ${paths.databaseLock}`, { cause: error });
+    }
+    await handle.writeFile(`${JSON.stringify({ pid: process.pid, createdAt: new Date().toISOString() })}\n`, "utf8");
+    return async () => {
+        await handle.close().catch(() => undefined);
+        await rm(paths.databaseLock, { force: true }).catch(() => undefined);
+    };
+}
+export async function databaseStatus(home, buildKey) {
+    const paths = buildPaths(home, buildKey);
+    const [build, loadedDatabase, lock] = await Promise.all([
+        readJson(join(paths.build, "build.json")),
+        readJson(paths.databaseFile),
+        stat(paths.databaseLock).then(() => true).catch(() => false)
+    ]);
+    let database = loadedDatabase;
+    if (database && database.status === "creating" && await stat(database.idaDatabase).then(() => true).catch(() => false)) {
+        database = { ...database, status: "ready", updatedAt: new Date().toISOString(), lastAnalysisAt: database.lastAnalysisAt ?? new Date().toISOString() };
+        if (!lock)
+            await writeJson(paths.databaseFile, database);
+    }
+    return { ok: true, buildKey: safeBuildKey(buildKey), buildDirectory: paths.build, databasePath: paths.databaseFile, exists: Boolean(database), locked: lock, build, database };
+}
+export async function findReusableDump(home, buildKey, criteria) {
+    const runtime = buildPaths(home, buildKey).runtime;
+    let sessions;
+    try {
+        sessions = await readdir(runtime, { withFileTypes: true });
+    }
+    catch (error) {
+        if (error.code === "ENOENT")
+            return null;
+        throw error;
+    }
+    for (const session of sessions.filter(item => item.isDirectory())) {
+        const manifestFile = join(runtime, session.name, "dump", "manifest.json");
+        const manifest = await readJson(manifestFile);
+        if (!manifest || typeof manifest.moduleBase !== "string" || JSON.stringify(manifest.dumpParameters ?? null) !== JSON.stringify(criteria))
+            continue;
+        return { ...manifest, manifestFile };
+    }
+    return null;
+}

package/dist/core/profile-engine.js

@@ -143,6 +143,15 @@ export class ProfileEngine {
         if (request.buildKey && request.buildKey !== buildKey) {
             throw new ProfileEngineError("BUILD_MISMATCH", `profile build ${buildKey} does not match ${request.buildKey}`);
         }
+        if (request.executableSha256) {
+            const executable = profile.executable && typeof profile.executable === "object" && !Array.isArray(profile.executable)
+                ? profile.executable
+                : undefined;
+            const profileHash = typeof profile.executableSha256 === "string" ? profile.executableSha256 : String(executable?.sha256 ?? "");
+            if (profileHash && profileHash !== request.executableSha256) {
+                throw new ProfileEngineError("EXECUTABLE_MISMATCH", "profile executable hash does not match the target build", { expected: request.executableSha256, actual: profileHash });
+            }
+        }
         const status = String(profile.readerStatus ?? profile.status ?? (profile.confidence === "reader_ready" ? "reader_ready" : ""));
         if (status !== "reader_ready")
             throw new ProfileEngineError("PROFILE_NOT_READY", "profile is not reader_ready", { status });

package/dist/frida-worker.js

@@ -1,6 +1,8 @@
-import { readFile } from "node:fs/promises";
+import { readFile, writeFile } from "node:fs/promises";
 import { createInterface } from "node:readline";
 import { FridaCommandRuntime } from "./analysis/frida-runtime.js";
+import { RuntimeDumpWriter } from "./analysis/runtime-dump.js";
+import { isAbsolute, resolve } from "node:path";
 function record(value) {
     return value && typeof value === "object" && !Array.isArray(value) ? value : {};
 }
@@ -15,7 +17,7 @@ function positive(value, name) {
  * GumJS source; this process only attaches, loads, calls, and cleans it up.
  */
 async function run(input) {
-    if (input.command !== "dynamic-script")
+    if (input.command !== "dynamic-script" && input.command !== "runtime-dump")
         throw new Error("unsupported worker command");
     const pid = positive(input.pid, "pid");
     const buildKey = String(input.build ?? input.buildKey ?? "").trim();
@@ -29,24 +31,74 @@ async function run(input) {
     const runtime = new FridaCommandRuntime({ artifactDir: process.env.WOW_ANALYZE_DIR });
     let sessionId;
     let loaded = false;
+    const isDump = input.command === "runtime-dump";
+    const outputDirectory = isDump ? resolve(String(input.outputDir ?? "")) : undefined;
+    const outputDirectoryInput = isDump ? String(input.outputDir ?? "") : "";
+    const writer = isDump ? new RuntimeDumpWriter({
+        outputDirectory: outputDirectory,
+        buildKey,
+        pid,
+        executableSha256: typeof input.executableSha256 === "string" ? input.executableSha256 : null,
+        preferredImageBase: typeof input.preferredImageBase === "string" ? input.preferredImageBase : null,
+        moduleSize: Number.isSafeInteger(Number(input.moduleSize)) ? Number(input.moduleSize) : null,
+        dumpParameters: input.dumpParameters && typeof input.dumpParameters === "object" ? input.dumpParameters : undefined
+    }) : undefined;
+    let finalized = false;
     try {
+        if (isDump) {
+            if (!outputDirectoryInput || !isAbsolute(outputDirectoryInput))
+                throw new Error("runtime dump outputDir must be an absolute path");
+            await writer.initialize();
+        }
         const attached = await runtime.execute({ operation: "attach", pid, buildKey, allowUnmatched: true });
         sessionId = String(attached.sessionId);
         const modules = await runtime.execute({ operation: "modules", sessionId, pid, buildKey });
         const module = Array.isArray(modules.modules)
             ? modules.modules.find(item => String(item.name ?? "").toLowerCase() === "wow.exe")
             : undefined;
+        const scriptSource = `globalThis.__WOWDUMP_INPUT__ = Object.freeze(${JSON.stringify(input.args ?? {})});\n${source}`;
+        let value;
+        let messages = [];
+        if (isDump) {
+            await writeFile(resolve(outputDirectory, "..", "target.json"), `${JSON.stringify({ schema: "wowdump.runtime-target.v1", pid, buildKey, module, executableSha256: input.executableSha256 ?? null, createdAt: new Date().toISOString() }, null, 2)}\n`, "utf8").catch(() => undefined);
+            let progressBytes = 0;
+            const streamed = await runtime.streamScriptCall({
+                operation: "script_load",
+                sessionId,
+                pid,
+                buildKey,
+                source: scriptSource,
+                exportName: typeof input.exportName === "string" ? input.exportName : "collect"
+            }, undefined, async (message, data) => {
+                const envelope = message && typeof message === "object" ? message : {};
+                if (envelope.type !== "send" || !data)
+                    return;
+                const payload = envelope.payload && typeof envelope.payload === "object" ? envelope.payload : {};
+                if (payload.type !== "wowdump.dump.chunk")
+                    return;
+                await writer.writeChunk(payload, data);
+                progressBytes += data.byteLength;
+                if (input.progress !== false)
+                    process.stderr.write(`wowdump dump ${progressBytes} bytes\\n`);
+            });
+            value = streamed.value;
+            const result = value && typeof value === "object" ? value : {};
+            if (result.ok !== true)
+                throw new Error(String(result.error ?? "runtime dump failed"));
+            const persisted = await writer.finalize({ ...result, module: module ?? result.module });
+            finalized = true;
+            await writeFile(resolve(outputDirectory, "..", "dynamic.json"), `${JSON.stringify({ ...result, manifestFile: persisted.manifestFile, generatedAt: new Date().toISOString() }, null, 2)}\n`, "utf8").catch(() => undefined);
+            return { ok: true, command: "analyze.runtime.dump", pid, buildKey, manifestFile: persisted.manifestFile, outputDirectory, manifest: persisted.manifest, sections: persisted.sections };
+        }
         await runtime.execute({
             operation: "script_load",
             sessionId,
             pid,
             buildKey,
-            source: `globalThis.__WOWDUMP_INPUT__ = Object.freeze(${JSON.stringify(input.args ?? {})});\n${source}`,
+            source: scriptSource,
             scriptId: "dynamic"
         });
         loaded = true;
-        let value;
-        let messages = [];
         if (typeof input.exportName === "string" && input.exportName.trim()) {
             const called = await runtime.execute({
                 operation: "script_call",
@@ -79,6 +131,8 @@ async function run(input) {
     finally {
         if (sessionId && loaded)
             await runtime.execute({ operation: "script_unload", sessionId, scriptId: "dynamic" }).catch(() => undefined);
+        if (isDump && writer && !finalized)
+            await writer.abort().catch(() => undefined);
         await runtime.close();
     }
 }

package/dist/toolchain.js

@@ -1,29 +1,28 @@
-import { createHash } from "node:crypto";
-import { createReadStream, readdirSync, statSync } from "node:fs";
+import { readdirSync, statSync } from "node:fs";
 import { mkdir, readFile, writeFile } from "node:fs/promises";
 import { homedir } from "node:os";
 import { dirname, extname, join, resolve } from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";
-import { pipeline } from "node:stream/promises";
-export const WOWDUMP_HOME_DIRECTORIES = ["profiles", "logs", "runtime", "cache", "skills", "monitors", "toolchains"];
+import { resolveWowdumpHome } from "./core/build-store.js";
 export const DEFAULT_WOWDUMP_SKILL = `---
 name: wowdump
-description: 使用 Frida 运行时证据和 IDA/iced-x86 定位 WoW 字段，生成 Reader 可用 profile。
+description: 用 Frida 运行时证据和 IDA Pro MCP 或 iced-x86 定位 WoW 字段，生成并验证 Reader profile。
 ---
 
 # wowdump
 
-查字段时先读取 targets，再用显式 GumJS 导出运行时线索。静态定位优先交给可用的 IDA Pro MCP；没有时运行 \`wowdump analyze disassemble\`，由 Agent 根据 iced-x86 输出分析并补齐字段定义。两条路径都必须最终生成 \`wowdump.profile.v1\`，且只有地址、类型和证据齐全时才标记 \`reader_ready\`。详情见 references/workflow.md、references/dynamic.md、references/disassemble.md 和 references/profiles.md。
+先运行 \`wowdump targets\`，再复用 \`~/.wowdump/<buildKey>/database/\`。动态脚本必须由 Agent 显式提供；runtime dump 保存当前 session 的二进制证据，Reader 只读取 build profile。详情见 references/workflow.md、references/commands.md、references/dynamic.md、references/disassemble.md 和 references/profiles.md。
 `;
 export const DEFAULT_WOWDUMP_COMMANDS = `# wowdump 命令参考
 
 1. \`wowdump targets\`
-2. \`wowdump analyze runtime --pid <pid> --build <buildKey> --kind dump --confirm\`
-3. \`wowdump analyze dynamic --pid <pid> --build <buildKey> --script <GumJS> --export collect --confirm\`
-4. \`wowdump analyze disassemble --exe <Wow.exe> --build <buildKey> --runtime-export <runtime.json> --output <profile.json>\`
-5. \`wowdump memory read --pid <pid> --build <buildKey> --profile <profile.json> --field <name>\`
+2. \`wowdump database status --build <buildKey>\`
+3. \`wowdump analyze runtime --pid <pid> --build <buildKey> --kind dump --confirm\`
+4. \`wowdump analyze dynamic --pid <pid> --build <buildKey> --script <GumJS> --export collect --confirm\`
+5. \`wowdump analyze runtime --pid <pid> --build <buildKey> --kind verify --profile <profile.json> --confirm\`
+6. \`wowdump memory read --pid <pid> --build <buildKey> --profile <profile.json> --field <name>\`
 
-\`dump\` 会导出供 IDA/iced-x86 分析的 PE 段并生成 manifest；\`verify\` 需要 \`--profile\`，只验证已有候选 RVA。若 Agent 能调用 IDA Pro MCP，先用 MCP 分析 dump manifest 指向的段，再把结果保存为 JSON 并通过 \`--ida-evidence\` 交给 disassemble 命令。未确认的候选 profile 放在 runtime 目录；确认后才复制到当前 build 的 profile 目录。
+\`dump\` 默认流式导出供 IDA/iced-x86 分析的 PE 段并生成 manifest；\`verify\` 只验证已有候选 RVA。未确认的候选 profile 放在 runtime session 目录；确认后才复制到当前 build 的 profile 目录。
 `;
 function normalizePath(value) { return resolve(value.trim().replace(/^"|"$/g, "")); }
 function directoryExists(value) { try {
@@ -48,7 +47,7 @@ catch (error) {
     else
         throw error;
 } }
-export function resolveWowdumpHome(env = process.env, userHome = homedir()) { return normalizePath(env.WOWDUMP_HOME || join(userHome, ".wowdump")); }
+export { resolveWowdumpHome, sha256File } from "./core/build-store.js";
 export function resolveWowdumpSkillHome(env = process.env, userHome = homedir()) { return normalizePath(env.WOWDUMP_SKILL_HOME || join(userHome, ".agents", "skills")); }
 export async function initializeWowdumpHome(options = {}) {
     const env = options.env ?? process.env;
@@ -56,15 +55,6 @@ export async function initializeWowdumpHome(options = {}) {
     const created = [];
     const preserved = [];
     await mkdir(home, { recursive: true });
-    for (const name of WOWDUMP_HOME_DIRECTORIES) {
-        const dir = join(home, name);
-        if (directoryExists(dir))
-            preserved.push(dir);
-        else {
-            await mkdir(dir, { recursive: true });
-            created.push(dir);
-        }
-    }
     const configFile = join(home, "config.json");
     await createFileIfMissing(configFile, `${JSON.stringify({ schema: "wowdump.config.v1" }, null, 2)}\n`, created, preserved);
     const skillDirectory = join(normalizePath(options.skillHome ?? resolveWowdumpSkillHome(env, options.userHome)), "wowdump");
@@ -108,7 +98,6 @@ export async function initializeWowdumpHome(options = {}) {
 }
 export async function bootstrapToolchain(options = {}) { const home = await initializeWowdumpHome(options); return { ...home, toolchain: { ready: true, disassembler: "iced-x86" }, installed: [] }; }
 export function resolveToolchain(options = {}) { return { home: normalizePath(options.home ?? resolveWowdumpHome(options.env ?? process.env, options.userHome)), ready: true, disassembler: "iced-x86" }; }
-export async function sha256File(file) { const hash = createHash("sha256"); await pipeline(createReadStream(file), hash); return hash.digest("hex"); }
 export function inspectPeSections(buffer) { if (buffer.length < 0x40 || buffer.toString("ascii", 0, 2) !== "MZ")
     return []; const pe = buffer.readUInt32LE(0x3c); if (pe + 24 > buffer.length || buffer.toString("ascii", pe, pe + 4) !== "PE\0\0")
     return []; const count = buffer.readUInt16LE(pe + 6); const optional = buffer.readUInt16LE(pe + 20); const table = pe + 24 + optional; const out = []; for (let i = 0; i < count; i++) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "wowdump",
-  "version": "0.3.3",
+  "version": "0.3.4",
   "description": "WoW native memory analysis CLI with Frida evidence, IDA/iced-x86 disassembly, and an elevated reader broker",
   "license": "MIT",
   "repository": {

package/skills/wowdump/SKILL.md

@@ -5,20 +5,21 @@ description: 以 Frida 运行时探测为主，按证据需要交替使用 IDA P
 
 # wowdump
 
-用于读取角色属性、Buff/Debuff、技能冷却、附近单位等原生字段。优先从当前进程取得真实值；需要长期复用时，再把已验证的线索固化为带证据的 `wowdump.profile.v1`。
+用于读取角色属性、Buff/Debuff、技能冷却、附近单位等原生字段。每个 build 有一个静态数据库，运行时证据按 session 保存，Reader 只读取已验证的 profile。
 
 ## 默认策略
 
-1. 先运行 `wowdump targets`，确认 PID、Wow.exe 路径和 buildKey；多个目标时让用户选择。
-2. 在 `~/.wowdump/<buildKey>/runtime/<session>/` 保存临时证据，在 `~/.wowdump/<buildKey>/profile/` 只保存用户确认的持久化 profile。
-3. 默认编写并显式传入 GumJS，使用 `wowdump analyze dynamic --script <GumJS> --confirm` 做运行时发现、原生 Hook、快照或事件采集。
-4. 若已有 `reader_ready` profile，先用 reader 读取；若动态结果已足够回答问题，直接返回，不强行做静态分析。
-5. 动态结果需要函数 RVA、对象布局或字段类型时，先用 `wowdump analyze runtime --kind dump` 导出 `.text`、`.rdata`、`.data`、`.pdata` 和 manifest，再调用 IDA Pro MCP；没有 IDA 时才用 iced-x86 输出。静态和动态可以交替执行，每轮只扩大当前字段所需的证据范围。
-6. 将确认的 RVA、指针链、类型、边界和证据写入候选 profile。字段证据不足时保持 `candidate`，回到 dynamic 补采样或回到 IDA/iced 缩小候选。
-7. 用 `wowdump analyze runtime --kind verify --profile <profile> --confirm` 或 `wowdump memory read --profile <profile> --field <name>` 做 broker-backed 验证；只有地址、类型和实际读取都成功后才标记 `reader_ready`。经用户确认后再保存到该 build 的 `profile/`。
+1. 先运行 `wowdump targets`，确认 PID、Wow.exe 路径、哈希和 buildKey；多个目标时让用户选择。该命令会创建或复用 `~/.wowdump/<buildKey>/database/`。
+2. 先检查 `wowdump database status --build <buildKey>`。同一可执行文件哈希、首选 image base 和模块大小时复用已有 IDA 数据库；哈希变化时数据库为 `stale`。
+3. 有 `reader_ready` profile 时先用 `wowdump memory read --pid <pid> --build <buildKey> --profile <profile> --field <name>`；Reader 不读取 IDA 数据库、dump 二进制或 runtime JSON。
+4. 没有可用 profile 时，由 Agent 编写并显式传入 GumJS：`wowdump analyze dynamic --pid <pid> --build <buildKey> --script <GumJS> --confirm`。脚本可做快照、有限 Hook 和事件采集。
+5. 动态线索需要静态证据时运行 `wowdump analyze runtime --kind dump`。dump 只写当前 session 的 `.text/.rdata/.pdata`，`.data` 通过 `--sections` 按需加入；不创建新的静态数据库。
+6. 优先让 IDA Pro MCP 打开该 build 的 `database/ida/Wow.i64`，按 manifest 将 runtime overlay 映射到原始 Wow.exe，输出函数 RVA、字符串 RVA、XREF、结构偏移和字段类型。没有 IDA MCP 时，用 iced-x86 对相关范围局部反汇编。
+7. 将静态结果和动态证据合并为 runtime session 下的 `candidate.profile.json`，只保存 RVA/相对偏移，不保存绝对地址。
+8. 用 `wowdump analyze runtime --kind verify --profile <candidate> --confirm` 做 broker 实读；确认 build/hash、地址、类型、边界和读取值一致后，才把 profile 复制到 `~/.wowdump/<buildKey>/profile/`。
 
 不要把 dynamic、IDA 或 iced 固定成一次性线性流水线。选择下一步的依据是当前字段缺少什么证据：值用 dynamic，函数/布局用 IDA/iced，稳定读取用 reader。
 
-具体的交替决策见 [references/workflow.md](references/workflow.md)；动态 Hook 规则见 [references/dynamic.md](references/dynamic.md)；IDA/iced 的选择和交替策略见 [references/disassemble.md](references/disassemble.md)；请求字段和 profile 生命周期见 [references/request-schema.md](references/request-schema.md) 与 [references/profiles.md](references/profiles.md)。
+具体决策见 [references/workflow.md](references/workflow.md)；命令参数见 [references/commands.md](references/commands.md)；动态 Hook 规则见 [references/dynamic.md](references/dynamic.md)；IDA/iced 规则见 [references/disassemble.md](references/disassemble.md)；请求字段和 profile 生命周期见 [references/request-schema.md](references/request-schema.md) 与 [references/profiles.md](references/profiles.md)。
 
 IDA MCP 使用长 TTL 会话（默认 `idle_ttl_sec: 3600`）。每次查询前先做 health probe；出现 `worker not reachable` 时按 `references/disassemble.md` 重新打开并只重试一次。IDA worker 与 Windows broker 独立，broker 的 UAC 复用不会保持 IDA worker 存活。

package/skills/wowdump/references/commands.md

@@ -21,21 +21,29 @@ wowdump analyze dynamic `
   --export collect `
   --args '{"fields":["playerAuras","nearbyEnemies","cooldowns"]}' `
   --duration-ms 5000 `
-  --confirm > $HOME\.wowdump\runtime\<session-id>\state.json
+  --confirm
 ```
 
-导出供静态分析的运行时模块段：
+CLI 会把结果保存到 `~/.wowdump/<buildKey>/runtime/<session-id>/dynamic.json`，并在 stdout 返回 session 目录。
+
+导出供静态分析的运行时模块段。默认只导出 `.text/.rdata/.pdata`；需要运行时全局状态时显式加入 `.data`：
 
 ```powershell
 wowdump analyze runtime `
   --pid 33976 `
   --build "retail@12.1.0.69587" `
   --kind dump `
-  --output-dir "$HOME\.wowdump\retail@12.1.0.69587\runtime\dump-01" `
+  --sections .text .rdata .pdata `
   --confirm
 ```
 
-输出目录中包含 `manifest.json` 和 `.text`、`.rdata`、`.data`、`.pdata` 二进制段。stdout 只返回 manifest 路径和摘要，不打印整段十六进制。
+输出写入 `~/.wowdump/<buildKey>/runtime/<session-id>/dump/`，包含 `manifest.json` 和二进制段文件。Frida 按块发送，worker 直接写盘；stdout 只返回 manifest 路径、段摘要、字节数和 SHA-256，不打印 Base64 或整段十六进制。相同 build 哈希、段选择和限制参数会复用已有 manifest。
+
+查看静态数据库状态：
+
+```powershell
+wowdump database status --build "retail@12.1.0.69587"
+```
 
 验证已有候选 profile：
 
@@ -50,16 +58,12 @@ wowdump analyze runtime `
 
 `verify` 不负责发现地址；没有 profile 时会直接提示缺少验证目标。
 
-## 需要时做静态定位
+## 静态定位
 
-只有 dynamic 结果缺少函数 RVA、对象布局或字段类型时，才调用 IDA Pro MCP；没有 IDA 时使用 iced-x86 兜底：
+只有 dynamic 结果缺少函数 RVA、对象布局或字段类型时，才调用 IDA Pro MCP。优先复用 `~/.wowdump/<buildKey>/database/ida/Wow.i64`；runtime manifest 只作为 overlay 证据，不作为独立程序导入。没有 IDA MCP 时使用 iced-x86 对 manifest 指向的局部范围兜底。静态结果保存到当前 session 的 `ida-evidence.json`，候选 profile 保存到 `candidate.profile.json`。
 
 ```powershell
-wowdump analyze disassemble `
-  --exe "D:\Game\World of Warcraft\_retail_\Wow.exe" `
-  --build "retail@12.1.0.69587" `
-  --runtime-export "$HOME\.wowdump\runtime\<session-id>\state.json" `
-  --output "$HOME\.wowdump\runtime\<session-id>\retail-12.1.0.69587.profile.json"
+IDA MCP 或 iced-x86 的输出至少包含：函数 RVA、字符串 RVA、XREF、结构偏移、字段类型、调用关系和证据来源。
 ```
 
 ## 读取

package/skills/wowdump/references/disassemble.md

@@ -1,6 +1,6 @@
 # 反汇编与 IDA Pro 分支
 
-静态分析是按需使用的证据放大器，不是每个查询的必经步骤。需要静态证据时，先用 `wowdump analyze runtime --kind dump` 导出运行时 `.text`、`.rdata`、`.data`、`.pdata` 以及 manifest；运行时字节样本、Hook 调用记录或返回值也可以作为输入。先检查当前 Agent 是否能调用本机 IDA Pro MCP：
+静态分析是按需使用的证据放大器，不是每个查询的必经步骤。需要静态证据时，先用 `wowdump analyze runtime --kind dump` 导出运行时 `.text`、`.rdata`、`.pdata` 以及 manifest；`.data` 只有在字段需要运行时全局状态时才通过 `--sections` 加入。原始 Wow.exe 始终是 IDA 的主输入，runtime 二进制只是 overlay 证据。先检查当前 Agent 是否能调用本机 IDA Pro MCP：
 
 ## IDA Pro MCP 下载与安装
 
@@ -47,16 +47,6 @@ IDA 的 headless worker 不是常驻进程。`idb_list` 中仍有 session 记录
 4. 第二次仍失联时停止扩大分析范围，保存已取得的 JSON 证据并转用 iced-x86 或请求用户稍后重试。
 
 不要把 `session_id`、IDA 临时 worker PID 或 `0x140000000` 这类 IDA image base 写入持久化 profile。profile 只保存相对模块的 RVA、字段类型和可复核证据。IDA MCP 会话和 wowdump 的 Windows broker 是两条独立链路：前者负责反汇编，后者负责管理员内存读取；broker 复用不会延长 IDA worker 生命周期。
-- IDA 不可用时执行：
-
-```powershell
-wowdump analyze disassemble `
-  --exe "C:\Games\World of Warcraft\_retail_\Wow.exe" `
-  --build "retail@VERSION" `
-  --runtime-export "$HOME\.wowdump\retail@VERSION\runtime\SESSION\state.json" `
-  --output "$HOME\.wowdump\runtime\SESSION\candidate.profile.json"
-```
-
-CLI 使用 `iced-x86` 解码 runtime 样本，返回模块基址、RVA、指令文本、PE sections 和证据。Agent 负责把这些线索与运行时字段对应起来，再用 dynamic 验证 `root`、`pointerChain`、`layout/type`、计数上限和停止条件。不要把一次运行的绝对地址写进持久化 profile。
+- IDA 不可用时，Agent 使用 npm 内置的 `iced-x86` 对 manifest 指向的局部 RVA 反汇编，输出模块 RVA、指令文本、访问偏移和证据。Agent 负责把这些线索与运行时字段对应起来，再用 dynamic 验证 `root`、`pointerChain`、`layout/type`、计数上限和停止条件。不要把一次运行的绝对地址写进持久化 profile。
 
 输出中的 `readerStatus: "reader_ready"` 只适用于每个字段都有可验证 RVA/地址、类型和边界，并且 reader 实际读成功的情况；否则保持 `candidate`，回到 dynamic 或继续局部静态分析。只做一次性查询时可以不生成持久化 profile。

package/skills/wowdump/references/profiles.md

@@ -6,9 +6,20 @@
 
 ```text
 ~/.wowdump/<buildKey>/
-└── profile/                 # 只放用户确认保存的 profile
-    ├── player-state.json
-    └── combat-state.json
+├── build.json
+├── database/
+│   ├── database.json
+│   └── ida/Wow.i64
+├── profile/                 # 只放用户确认保存的 profile
+│   ├── player-state.json
+│   └── combat-state.json
+└── runtime/<session-id>/    # 当前任务证据
+    ├── target.json
+    ├── dynamic.json
+    ├── dump/manifest.json
+    ├── ida-evidence.json
+    ├── candidate.profile.json
+    └── verify.json
 ```
 
 buildKey 只能作为单层目录名使用。保留 `@`、点和连字符；拒绝路径分隔符、`..` 和其他会改变目录层级的字符。不同 build 必须使用不同目录。
@@ -18,7 +29,7 @@ buildKey 只能作为单层目录名使用。保留 `@`、点和连字符；拒
 动态导出、反汇编候选和未确认的 profile 放到本次任务的临时目录，例如：
 
 ```text
-~/.wowdump/runtime/<session-id>/
+~/.wowdump/<buildKey>/runtime/<session-id>/
 ```
 
 它们不是持久化 profile，任务结束后可以清理。不要把候选文件直接写入 `<buildKey>/profile/`。
@@ -29,6 +40,6 @@ buildKey 只能作为单层目录名使用。保留 `@`、点和连字符；拒
 2. 向用户展示候选 profile 的路径、字段和验证结果，询问是否保存为该 build 的持久化 profile。
 3. 用户确认后，将候选复制到 `~/.wowdump/<buildKey>/profile/<profile-id>.json`，保留 `buildKey`、来源和验证证据。
 4. 目标文件已存在时先询问覆盖，或使用新的 profile-id；不要静默覆盖。
-5. 后续读取优先使用这个绝对路径，或用 `wowdump profiles --directory ~/.wowdump/<buildKey>/profile` 列出它。
+5. 后续读取优先使用这个绝对路径，或用 `wowdump profiles --build <buildKey>` 列出它。Reader 只读取 profile，不读取 `database/ida` 和 `runtime/dump/*.bin`。
 
 profile 只对记录的 buildKey 和模块布局有效。发现 buildKey 不匹配时停止读取并重新走分析流程，不修改旧 profile。

package/skills/wowdump/references/request-schema.md

@@ -1,6 +1,6 @@
 # 字段请求格式
 
-先把用户要查的内容写成一个请求文件。字段名是本次任务的目标，不是地址；地址由 dynamic 和 disassemble 阶段产生。
+先把用户要查的内容写成一个请求文件。字段名是本次任务的目标，不是地址；地址由 dynamic 证据和 IDA Pro MCP/iced-x86 局部分析产生。
 
 ```json
 {

package/skills/wowdump/references/workflow.md

@@ -11,7 +11,7 @@
 | --- | --- | --- |
 | 不知道模块/进程 | `wowdump targets` | PID、路径、buildKey、模块基址明确 |
 | 不知道对象或函数是否被调用 | Dynamic GumJS 枚举、有限扫描或 Hook | 得到对象地址、候选函数或调用事件 |
-| 需要给 IDA/iced 完整模块证据 | `wowdump analyze runtime --kind dump` | 得到 `.text`、`.rdata`、`.data`、`.pdata` 和 manifest |
+| 需要给 IDA/iced 模块证据 | `wowdump analyze runtime --kind dump` | 得到默认 `.text`、`.rdata`、`.pdata` 和 manifest；`.data` 仅按需加入 |
 | 有候选函数但不知道其语义 | Dynamic Hook，配合用户触发一次相关动作 | `this`、参数、返回值与目标字段相关 |
 | 有调用但不知道字段偏移/类型 | IDA Pro MCP 局部反汇编；无 IDA 时 iced-x86 | 指令访问行为能解释对象和字段 |
 | 静态候选需要运行时确认 | 回到 Dynamic Hook 或快照 | 候选 RVA 在当前模块命中且数据变化符合预期 |
@@ -21,8 +21,8 @@
 
 1. 先检查是否已有同 build 的 `reader_ready` profile；有则直接 Reader，失败再回到 Dynamic。
 2. 没有 profile 时优先执行 Agent 编写的 GumJS。脚本可以直接 Hook 已知 RVA，也可以在限定范围内扫描候选。
-3. Dynamic 只拿到线索时，先用 `analyze runtime --kind dump` 导出相关 PE 段，再让 IDA Pro MCP 分析对应函数、字符串和交叉引用。不要把 dump 当成 profile。
-4. 没有 IDA 时使用 `analyze disassemble`/iced-x86 作为局部解码工具，得到候选后仍回到 Dynamic 验证。
+3. Dynamic 只拿到线索时，先用 `analyze runtime --kind dump` 导出当前 session 的相关 PE 段，再让 IDA Pro MCP 复用 build database 分析对应函数、字符串和交叉引用。不要把 dump 当成 profile。
+4. 没有 IDA MCP 时直接使用 iced-x86 对 manifest 指向的局部范围解码，得到候选后仍回到 Dynamic 验证。
 5. 每轮最多扩大一个维度：函数数量、扫描范围、读取字节数或采样时长。连续两轮没有新增证据时，停止扩大并请求用户触发相关游戏动作或确认字段范围。
 
 ## 证据门槛

package/dist/analysis/disassemble.js

@@ -1,77 +0,0 @@
-import { readFile, writeFile } from "node:fs/promises";
-import { access } from "node:fs/promises";
-import { constants } from "node:fs";
-import { resolve } from "node:path";
-import { Decoder, DecoderOptions, Formatter, FormatterSyntax } from "iced-x86";
-import { inspectPeSections, sha256File } from "../toolchain.js";
-function record(value) { return value && typeof value === "object" && !Array.isArray(value) ? value : {}; }
-function array(value) { return Array.isArray(value) ? value.filter(item => item && typeof item === "object" && !Array.isArray(item)) : []; }
-function hex(value) { if (typeof value === "number" && Number.isSafeInteger(value) && value >= 0)
-    return BigInt(value); if (typeof value === "string" && /^0x[0-9a-f]+$/i.test(value.trim()))
-    return BigInt(value); return undefined; }
-function hexText(value) { return `0x${value.toString(16)}`; }
-function moduleInfo(runtime) { const module = record(runtime.module); const base = hex(module.moduleBase ?? module.base ?? runtime.moduleBase) ?? 0n; const size = Number(module.moduleSize ?? module.size ?? runtime.moduleSize ?? 0); return { base, size: Number.isFinite(size) ? size : 0, name: String(module.name ?? "Wow.exe") }; }
-function sampleBytes(item) { const value = item.bytesHex ?? item.dataHex; if (typeof value !== "string" || !/^[0-9a-f]*$/i.test(value) || value.length % 2 !== 0)
-    return undefined; return Buffer.from(value, "hex"); }
-function sampleRva(item) { return hex(item.rva) ?? (hex(item.address) !== undefined ? hex(item.address) : undefined); }
-function decodeSamples(runtime, maxInstructions) {
-    const info = moduleInfo(runtime);
-    const samples = [...array(runtime.samples), ...array(runtime.records)];
-    const formatter = new Formatter(FormatterSyntax.Masm);
-    const output = [];
-    let remaining = maxInstructions;
-    for (const sample of samples) {
-        if (remaining <= 0)
-            break;
-        const bytes = sampleBytes(sample);
-        const raw = sampleRva(sample);
-        if (!bytes || raw === undefined)
-            continue;
-        const rva = raw >= info.base && info.base > 0n ? raw - info.base : raw;
-        const ip = info.base + rva;
-        const decoder = new Decoder(64, bytes, DecoderOptions.None);
-        decoder.ip = ip;
-        const instructions = [];
-        while (remaining > 0 && decoder.canDecode) {
-            const instruction = decoder.decode();
-            if (instruction.code === 0)
-                break;
-            instructions.push(formatter.format(instruction));
-            remaining--;
-        }
-        output.push({ rva: hexText(rva), address: hexText(ip), bytesHex: bytes.toString("hex"), instructions, source: "frida-text" });
-    }
-    return output;
-}
-function fieldCandidates(runtime, ida) {
-    const candidates = {};
-    const source = { ...record(runtime.fields), ...record(ida.fields) };
-    for (const [name, value] of Object.entries(source)) {
-        const item = record(value);
-        const rva = item.rva ?? record(item.root).rva;
-        const type = item.type ?? (record(item.layout).type);
-        const layout = item.layout;
-        if (rva !== undefined && (typeof type === "string" || (layout && typeof layout === "object" && !Array.isArray(layout))))
-            candidates[name] = { ...item, root: item.root ?? { rva }, ...(type ? { type } : {}), evidence: [...array(item.evidence), { source: ida && Object.keys(ida).length ? "ida-pro-mcp" : "iced-x86", kind: "runtime-guided" }] };
-    }
-    return candidates;
-}
-export async function runDisassembly(options) {
-    const executable = resolve(options.exe);
-    await access(executable, constants.R_OK);
-    if (!options.buildKey?.trim())
-        throw new Error("buildKey is required");
-    const runtime = record(JSON.parse(await readFile(resolve(options.runtimeExport), "utf8")));
-    const ida = options.idaEvidence ? record(JSON.parse(await readFile(resolve(options.idaEvidence), "utf8"))) : {};
-    const info = moduleInfo(runtime);
-    const decoded = decodeSamples(runtime, Math.min(Math.max(options.maxInstructions ?? 256, 1), 10_000));
-    const sections = inspectPeSections(await readFile(executable));
-    const fields = fieldCandidates(runtime, ida);
-    const ready = Object.keys(fields).length > 0 && Object.values(fields).every(field => { const value = record(field); return value.root !== undefined && (value.type !== undefined || value.layout !== undefined); });
-    const outputFile = resolve(options.output ?? `${executable}.${options.buildKey.replace(/[^A-Za-z0-9_.@-]+/g, "-")}.profile.json`);
-    const profile = { schema: "wowdump.profile.v1", id: `${options.buildKey}-runtime`, buildKey: options.buildKey, readerStatus: ready ? "reader_ready" : "candidate", confidence: ready ? "confirmed" : "candidate", module: { name: info.name, rvaBase: "0x0" }, executable: { path: executable, sha256: await sha256File(executable) }, sections, fields, evidence: [{ source: "frida", kind: "runtime-text", samples: decoded.length }, { source: options.idaEvidence ? "ida-pro-mcp" : "iced-x86", kind: "disassembly", instructions: decoded.length }], analysis: { engine: options.idaEvidence ? "ida-pro-mcp+iced-x86" : "iced-x86", generatedAt: new Date().toISOString() } };
-    const disassembly = { module: { name: info.name, moduleBase: hexText(info.base), moduleSize: info.size }, sections, instructions: decoded, idaEvidence: options.idaEvidence ?? null };
-    if (!options.dryRun)
-        await writeFile(outputFile, `${JSON.stringify(profile, null, 2)}\n`, "utf8");
-    return { ok: true, command: "analyze.disassemble", engine: options.idaEvidence ? "ida-pro-mcp" : "iced-x86", buildKey: options.buildKey, executable, outputFile, profile, disassembly };
-}