wowdump 0.3.3 → 0.3.5

package/README.md

@@ -14,19 +14,26 @@ wowdump init
 ## 基本流程
 
 ```powershell
-# 1. 导出运行时模块段
+# 1. 发现目标并创建/复用 build 数据库
+wowdump targets
+wowdump database status --build "retail@VERSION"
+
+# 2. 导出运行时模块段
 wowdump analyze runtime --pid 1234 --build "retail@VERSION" --kind dump --confirm
 
-# 2. 用 IDA Pro MCP（若可用）或 iced-x86 分析 dump-<id>\manifest.json，保存字段候选和证据
-# 3. 将候选证据交给 profile 生成步骤，再用 reader 验证
+# 3. 用 IDA Pro MCP（若可用）或 iced-x86 分析 session dump manifest，保存字段候选和证据
+# 4. 将候选证据交给 verify，再用 Reader 验证
 
-# 4. 用户确认后，把 profile 保存到当前 build 的 profile 目录，再读取
+# 5. 用户确认后，把 profile 保存到当前 build 的 profile 目录，再读取
 wowdump memory read --pid 1234 --profile "$HOME\.wowdump\retail@VERSION\profile\player-state.json" --field playerAuras
+
+# 枚举已提交虚拟内存区（复用同一个管理员 broker）
+wowdump memory regions --pid 1234 --start 0x15000000000 --end 0x15400000000 --max-regions 20000
 ```
 
 Windows reader 首次使用时由 Node 请求 UAC 启动 broker，后续调用复用同一 broker，空闲 20 分钟后退出。Frida 运行时导出需要显式 `--confirm`；高开销 Stalker 默认关闭。
 
-`analyze runtime --kind dump` 会把 `.text`、`.rdata`、`.data` 和 `.pdata` 导出为二进制文件，并写入 `manifest.json`；manifest 供 IDA Pro MCP 或 iced-x86 使用。`analyze runtime --kind verify --profile <file>` 只验证已有 profile 的 RVA。当前 build 的持久化 profile 放在 `~/.wowdump/<buildKey>/profile/`；动态导出、静态候选和验证报告放在 runtime 会话临时目录。完整字段和 JSON 约定见 `~/.agents/skills/wowdump/references/commands.md`、`references/request-schema.md` 与 `references/profiles.md`；短时 Hook 示例见 `~/.agents/skills/wowdump/scripts/dynamic-session.js`。
+`targets` 会写入 `~/.wowdump/<buildKey>/build.json` 和 `database/database.json`；同一 build 的 IDA 数据库只创建一份。`analyze runtime --kind dump` 默认把 `.text`、`.rdata`、`.pdata` 流式写入当前 session，`.data` 需通过 `--sections` 显式加入。`analyze runtime --kind verify --profile <file>` 只验证已有 profile 的 RVA。Reader 只读取 `~/.wowdump/<buildKey>/profile/`，不读取 IDA 数据库和 dump 二进制。完整字段和 JSON 约定见 `~/.agents/skills/wowdump/references/commands.md`、`references/request-schema.md` 与 `references/profiles.md`；短时 Hook 示例见 `~/.agents/skills/wowdump/scripts/dynamic-session.js`。
 
 ## 开发验证
 

package/dist/analysis/frida-runtime.js

@@ -281,6 +281,32 @@ export class FridaCommandRuntime {
             await this.detachSession(sessionId).catch(() => undefined);
         }
     }
+    /**
+     * Run a caller-supplied export while forwarding Frida binary messages to a
+     * consumer. Runtime dump uses this path so ArrayBuffers never become JSON.
+     */
+    async streamScriptCall(request, context, handler, callArgs = []) {
+        const record = await this.session(request, context);
+        const source = this.source(request.source);
+        const script = await record.session.createScript(buildPrelude(context ?? record.context) + "\n" + source, request.options);
+        let pending = Promise.resolve();
+        script.message?.connect((message, data) => {
+            pending = pending.then(() => handler(message, data));
+        });
+        await script.load();
+        try {
+            const name = requireString(request.exportName ?? request.method, "exportName");
+            const value = await exportFunction(script, name)(...callArgs.map(item => decodeHostArg(item)));
+            await pending;
+            return { sessionId: record.id, value: normalize(value), ...sessionContext(record) };
+        }
+        finally {
+            try {
+                await script.unload();
+            }
+            catch { /* cleanup is best effort */ }
+        }
+    }
     async api() {
         if (this.apiOverride)
             return this.apiOverride;

package/dist/analysis/runtime-dump.js

@@ -0,0 +1,93 @@
+import { createHash } from "node:crypto";
+import { mkdir, open, rm, writeFile } from "node:fs/promises";
+import { join, resolve } from "node:path";
+function safeName(name) {
+    const value = String(name ?? "section");
+    return /^[A-Za-z0-9_.-]+$/.test(value) ? value : "section";
+}
+/** Streams Frida ArrayBuffer messages into section files without Base64 JSON. */
+export class RuntimeDumpWriter {
+    outputDirectory;
+    options;
+    sections = new Map();
+    aborted = false;
+    constructor(options) {
+        this.options = options;
+        this.outputDirectory = resolve(options.outputDirectory);
+    }
+    async initialize() {
+        await mkdir(this.outputDirectory, { recursive: true });
+    }
+    async writeChunk(meta, data) {
+        if (this.aborted)
+            throw new Error("runtime dump writer is aborted");
+        if (!data)
+            throw new Error("runtime dump chunk has no binary payload");
+        const name = safeName(meta.section);
+        const offset = Number(meta.offset);
+        if (!Number.isSafeInteger(offset) || offset < 0)
+            throw new Error(`invalid ${name} chunk offset`);
+        let state = this.sections.get(name);
+        if (!state) {
+            const file = join(this.outputDirectory, `${name}.bin`);
+            state = { name, file, handle: await open(file, "w"), hash: createHash("sha256"), offset: 0, bytes: 0 };
+            this.sections.set(name, state);
+        }
+        if (offset !== state.offset)
+            throw new Error(`${name} chunk offset ${offset} does not follow ${state.offset}`);
+        const bytes = Buffer.from(data);
+        await state.handle.write(bytes, 0, bytes.length, state.offset);
+        state.hash.update(bytes);
+        state.offset += bytes.length;
+        state.bytes += bytes.length;
+    }
+    async finalize(value) {
+        if (this.aborted)
+            throw new Error("runtime dump writer is aborted");
+        for (const state of this.sections.values())
+            await state.handle.close();
+        const rawSections = Array.isArray(value.sections) ? value.sections : [];
+        for (const section of rawSections) {
+            const name = safeName(section.name);
+            if (!this.sections.has(name))
+                await writeFile(join(this.outputDirectory, `${name}.bin`), Buffer.alloc(0));
+        }
+        const sections = rawSections.map((section) => {
+            const name = safeName(section.name);
+            const state = this.sections.get(name);
+            return {
+                ...section,
+                ...(state ? { file: state.file, bytes: state.bytes, sha256: state.hash.digest("hex") } : { file: join(this.outputDirectory, `${name}.bin`), bytes: 0, sha256: null })
+            };
+        });
+        const manifest = {
+            schema: "wowdump.runtime-dump.v2",
+            kind: "dump",
+            buildKey: this.options.buildKey,
+            pid: this.options.pid,
+            executableSha256: this.options.executableSha256 ?? null,
+            preferredImageBase: this.options.preferredImageBase ?? null,
+            moduleBase: typeof value.module?.moduleBase === "string"
+                ? value.module.moduleBase
+                : typeof value.module?.base === "string" ? value.module.base : null,
+            moduleSize: this.options.moduleSize ?? (typeof value.module?.moduleSize === "number" ? value.module.moduleSize : null),
+            module: value.module ?? null,
+            totalBytes: sections.reduce((sum, section) => sum + Number(section.bytes ?? 0), 0),
+            truncated: value.truncated === true || sections.some(section => section.truncated === true),
+            limits: value.limits ?? null,
+            dumpParameters: this.options.dumpParameters ?? null,
+            sections,
+            evidence: value.evidence ?? [],
+            generatedAt: new Date().toISOString()
+        };
+        const manifestFile = join(this.outputDirectory, "manifest.json");
+        await writeFile(manifestFile, `${JSON.stringify(manifest, null, 2)}\n`, "utf8");
+        return { ok: true, kind: "dump", manifestFile, outputDirectory: this.outputDirectory, manifest, sections: sections.map(section => ({ name: section.name, bytes: section.bytes, sha256: section.sha256 })) };
+    }
+    async abort() {
+        this.aborted = true;
+        for (const state of this.sections.values())
+            await state.handle.close().catch(() => undefined);
+        await rm(this.outputDirectory, { recursive: true, force: true }).catch(() => undefined);
+    }
+}

package/dist/analysis/runtime-script.js

@@ -16,7 +16,6 @@ const maxSectionBytes = Math.min(Math.max(Number(input.maxSectionBytes || 128 *
 const maxTotalBytes = Math.min(Math.max(Number(input.maxTotalBytes || 256 * 1024 * 1024), 1), 768 * 1024 * 1024);
 const chunkSize = Math.min(Math.max(Number(input.chunkSize || 1024 * 1024), 4096), 4 * 1024 * 1024);
 const maxVerifyBytes = Math.min(Math.max(Number(input.maxVerifyBytes || 256), 1), 4096);
-const BASE64 = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
 
 function readBytes(address, size) {
   const value = address.readByteArray(size);
@@ -31,21 +30,6 @@ function bytesHex(address, size) {
   return output;
 }
 
-function base64(bytes) {
-  let output = "";
-  for (let index = 0; index < bytes.length; index += 3) {
-    const first = bytes[index];
-    const second = index + 1 < bytes.length ? bytes[index + 1] : 0;
-    const third = index + 2 < bytes.length ? bytes[index + 2] : 0;
-    const value = (first << 16) | (second << 8) | third;
-    output += BASE64[(value >>> 18) & 63];
-    output += BASE64[(value >>> 12) & 63];
-    output += index + 1 < bytes.length ? BASE64[(value >>> 6) & 63] : "=";
-    output += index + 2 < bytes.length ? BASE64[value & 63] : "=";
-  }
-  return output;
-}
-
 function ascii(address, size) {
   const bytes = readBytes(address, size);
   if (!bytes) return "";
@@ -111,18 +95,17 @@ function dumpSection(section, totalState) {
   const requestedSize = Math.min(section.size, maxSectionBytes);
   const available = Math.max(0, maxTotalBytes - totalState.bytes);
   const readSize = Math.min(requestedSize, available);
-  const chunks = [];
   let offset = 0;
   while (offset < readSize) {
     const size = Math.min(chunkSize, readSize - offset);
     const bytes = readBytes(module.base.add(parseInt(section.rva, 16)).add(offset), size);
     if (!bytes) break;
-    chunks.push({ offset, size: bytes.length, dataBase64: base64(bytes) });
+    send({ type: "wowdump.dump.chunk", section: section.name, offset, size: bytes.length }, bytes.buffer);
     offset += bytes.length;
     if (bytes.length !== size) break;
   }
   totalState.bytes += offset;
-  return { ...section, requestedSize, readSize: offset, truncated: offset < section.size, chunks };
+  return { ...section, requestedSize, readSize: offset, truncated: offset < section.size };
 }
 
 function candidateEntries(profile) {
@@ -146,7 +129,10 @@ function collect() {
   if (input.kind === "dump") {
     const parsed = parseSections();
     if (parsed.error) return { ok: false, kind: "dump", module: { name: module.name, moduleBase: module.base.toString(), moduleSize: module.size }, sections: [], records: [], evidence: [{ source: "frida", kind: "pe-parse-failed", error: parsed.error }] };
-    const selected = parsed.sections.filter(section => [".text", ".rdata", ".data", ".pdata"].includes(section.name.toLowerCase()));
+    const requestedSections = Array.isArray(input.sections) && input.sections.length > 0
+      ? input.sections.map(value => String(value).toLowerCase())
+      : [".text", ".rdata", ".pdata"];
+    const selected = parsed.sections.filter(section => requestedSections.includes(section.name.toLowerCase()));
     const totalState = { bytes: 0 };
     const sections = selected.map(section => dumpSection(section, totalState));
     return { ok: true, kind: "dump", module: { name: module.name, moduleBase: module.base.toString(), moduleSize: module.size, path: module.path }, sections, totalBytes: totalState.bytes, limits: { maxSectionBytes, maxTotalBytes, chunkSize }, truncated: sections.some(section => section.truncated), evidence: [{ source: "frida", kind: "frida-runtime-pe-sections", sections: sections.map(section => section.name), totalBytes: totalState.bytes }] };

package/dist/cli.js

@@ -1,14 +1,14 @@
 #!/usr/bin/env node
 import { spawn } from "node:child_process";
-import { createHash } from "node:crypto";
+import { randomUUID } from "node:crypto";
 import { existsSync, realpathSync, readFileSync } from "node:fs";
-import { mkdir, readFile, readdir, writeFile } from "node:fs/promises";
+import { mkdir, open, readFile, readdir, writeFile } from "node:fs/promises";
 import { basename, dirname, extname, isAbsolute, join, resolve } from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";
 import { Command } from "commander";
 import { WindowsBrokerManager } from "./reader/launcher.js";
-import { initializeWowdumpHome, bootstrapToolchain, resolveToolchain, resolveWowdumpHome } from "./toolchain.js";
-import { runDisassembly } from "./analysis/disassemble.js";
+import { initializeWowdumpHome, bootstrapToolchain, resolveToolchain } from "./toolchain.js";
+import { buildPaths, databaseStatus, ensureBuild, findReusableDump, readBuild, resolveWowdumpHome, safeBuildKey, sha256File } from "./core/build-store.js";
 import { RUNTIME_EXPORT_SCRIPT } from "./analysis/runtime-script.js";
 import { ProfileEngine } from "./core/profile-engine.js";
 import { ReaderProfileAdapter } from "./adapters/reader.js";
@@ -86,6 +86,64 @@ async function discoverWowTargets(selectedPid, elevatedModules) {
     }
     return targets;
 }
+async function preferredImageBase(file) {
+    let handle;
+    try {
+        handle = await open(file, "r");
+        const header = Buffer.alloc(64 * 1024);
+        await handle.read(header, 0, header.length, 0);
+        if (header.length < 0x40 || header.readUInt16LE(0) !== 0x5a4d)
+            return null;
+        const peOffset = header.readUInt32LE(0x3c);
+        if (peOffset + 0x58 > header.length || header.readUInt32LE(peOffset) !== 0x00004550)
+            return null;
+        const optional = peOffset + 24;
+        const magic = header.readUInt16LE(optional);
+        if (magic === 0x20b)
+            return `0x${header.readBigUInt64LE(optional + 24).toString(16)}`;
+        if (magic === 0x10b)
+            return `0x${BigInt(header.readUInt32LE(optional + 28)).toString(16)}`;
+        return null;
+    }
+    catch {
+        return null;
+    }
+    finally {
+        if (handle)
+            await handle.close().catch(() => undefined);
+    }
+}
+async function persistDiscoveredBuilds(home, targets) {
+    for (const target of targets) {
+        const path = typeof target.path === "string" ? target.path : null;
+        const buildKey = typeof target.buildKey === "string" ? target.buildKey : null;
+        if (!path || !buildKey)
+            continue;
+        try {
+            const executableSha256 = await sha256File(path);
+            const imageBase = await preferredImageBase(path);
+            const result = await ensureBuild(home, {
+                buildKey: safeBuildKey(buildKey),
+                executablePath: path,
+                executableSha256,
+                preferredImageBase: imageBase,
+                moduleSize: Number.isSafeInteger(Number(target.moduleSize)) ? Number(target.moduleSize) : null
+            });
+            target.executableSha256 = executableSha256;
+            target.preferredImageBase = imageBase;
+            target.database = {
+                directory: buildPaths(home, buildKey).database,
+                path: buildPaths(home, buildKey).databaseFile,
+                status: result.database.status,
+                reused: result.reused
+            };
+        }
+        catch (error) {
+            target.diagnostics = { ...(target.diagnostics && typeof target.diagnostics === "object" ? target.diagnostics : {}), buildStore: error instanceof Error ? error.message : String(error) };
+        }
+    }
+    return targets;
+}
 function packageVersion() {
     const override = process.env.WOWDUMP_VERSION?.trim();
     if (override)
@@ -260,61 +318,36 @@ function requireRuntimeConfirmation(options) {
         cleanupDeadlineMs: options.cleanupDeadlineMs
     });
 }
-function safeBuildDirectory(buildKey) {
-    const value = buildKey.trim();
-    if (!value || !/^[A-Za-z0-9_.@-]+$/.test(value))
-        throw new CliError("ARGUMENT_INVALID", "build key contains unsupported path characters");
-    return value;
+function profileDirectoryFor(home, buildKey) {
+    if (!buildKey)
+        throw new CliError("BUILD_REQUIRED", "a build key is required to resolve the profile directory");
+    return buildPaths(home, safeBuildDirectory(buildKey)).profile;
 }
-function decodeBase64(value, expectedSize, label) {
-    if (typeof value !== "string" || !/^[A-Za-z0-9+/]*={0,2}$/.test(value))
-        throw new CliError("RUNTIME_DUMP_INVALID", `${label} is not valid base64`);
-    const data = Buffer.from(value, "base64");
-    if (data.length !== expectedSize)
-        throw new CliError("RUNTIME_DUMP_INVALID", `${label} size does not match metadata`);
-    return data;
+async function validateProfileIdentity(home, buildKey, profile, file) {
+    if (!buildKey)
+        return;
+    if (typeof profile.buildKey === "string" && profile.buildKey !== buildKey) {
+        throw new CliError("BUILD_MISMATCH", `profile build ${profile.buildKey} does not match ${buildKey}`, { profileFile: file });
+    }
+    const build = await readBuild(home, buildKey);
+    if (!build)
+        return;
+    const profileHash = typeof profile.executableSha256 === "string"
+        ? profile.executableSha256
+        : profile.executable && typeof profile.executable === "object" && !Array.isArray(profile.executable)
+            ? String(profile.executable.sha256 ?? "")
+            : "";
+    if (profileHash && profileHash !== build.executableSha256) {
+        throw new CliError("EXECUTABLE_MISMATCH", "profile executable hash does not match the selected build", { expected: build.executableSha256, actual: profileHash, profileFile: file });
+    }
 }
-export async function persistRuntimeDump(value, outputDirectory) {
-    const sections = Array.isArray(value.sections) ? value.sections : [];
-    if (value.ok !== true || sections.length === 0)
-        return value;
-    const directory = resolve(outputDirectory);
-    await mkdir(directory, { recursive: true });
-    const summaries = [];
-    for (const raw of sections) {
-        const section = jsonRecord(JSON.stringify(raw), "runtime section");
-        const name = typeof section.name === "string" && /^[A-Za-z0-9_.-]+$/.test(section.name) ? section.name : "section";
-        const file = join(directory, `${name}.bin`);
-        const chunks = Array.isArray(section.chunks) ? section.chunks : [];
-        const buffers = chunks.map((chunk, index) => {
-            const item = jsonRecord(JSON.stringify(chunk), `runtime section ${name} chunk ${index}`);
-            return decodeBase64(item.dataBase64, Number(item.size), `${name} chunk ${index}`);
-        });
-        const data = Buffer.concat(buffers);
-        await writeFile(file, data);
-        summaries.push({
-            ...selected(section, ["name", "rva", "runtimeAddress", "virtualSize", "rawSize", "characteristics", "protection", "requestedSize", "readSize", "truncated"]),
-            file,
-            bytes: data.length,
-            sha256: createHash("sha256").update(data).digest("hex")
-        });
+function safeBuildDirectory(buildKey) {
+    try {
+        return safeBuildKey(buildKey);
+    }
+    catch {
+        throw new CliError("ARGUMENT_INVALID", "build key contains unsupported path characters");
     }
-    const manifest = {
-        schema: "wowdump.runtime-dump.v1",
-        kind: "dump",
-        buildKey: value.buildKey ?? null,
-        pid: value.pid ?? null,
-        module: value.module ?? null,
-        totalBytes: value.totalBytes ?? summaries.reduce((total, item) => total + Number(item.bytes ?? 0), 0),
-        truncated: value.truncated === true || summaries.some(item => item.truncated === true),
-        limits: value.limits ?? null,
-        sections: summaries,
-        evidence: value.evidence ?? [],
-        generatedAt: new Date().toISOString()
-    };
-    const manifestFile = join(directory, "manifest.json");
-    await writeFile(manifestFile, `${JSON.stringify(manifest, null, 2)}\n`, "utf8");
-    return { ...value, sections: summaries, outputDirectory: directory, manifestFile, manifest };
 }
 export function createWowdumpCli(dependencies = {}) {
     const io = dependencies.io ?? { stdout: process.stdout, stderr: process.stderr };
@@ -345,7 +378,7 @@ export function createWowdumpCli(dependencies = {}) {
         .option("--pid <pid>", "select one process ID")
         .action(async (options) => {
         const selectedPid = options.pid ? positiveInteger(options.pid, "pid") : undefined;
-        const targets = await discoverWowTargets(selectedPid, async (pid) => broker({ command: "modules", payload: { pid } }));
+        const targets = await persistDiscoveredBuilds(home, await discoverWowTargets(selectedPid, async (pid) => broker({ command: "modules", payload: { pid } })));
         if (selectedPid !== undefined && targets.length === 0)
             throw new CliError("TARGET_NOT_FOUND", `Wow.exe process ${selectedPid} was not found`);
         writeJson(io, {
@@ -356,6 +389,14 @@ export function createWowdumpCli(dependencies = {}) {
             targets
         });
     });
+    program.command("database")
+        .description("Show the persistent static database state for a build")
+        .command("status")
+        .description("Show database path, lock and freshness")
+        .requiredOption("--build <buildKey>", "build key")
+        .action(async (options) => {
+        writeJson(io, { ...await databaseStatus(home, options.build), command: "database.status" });
+    });
     program.command("target")
         .description("Show target, reader broker, profile, monitor, and Frida state")
         .option("--pid <pid>", "target process ID")
@@ -371,9 +412,10 @@ export function createWowdumpCli(dependencies = {}) {
     program.command("profiles")
         .description("List profiles or describe one profile")
         .argument("[id-or-file]", "profile ID or absolute JSON file")
-        .option("--directory <path>", "profile directory", join(home, "profiles"))
+        .option("--build <buildKey>", "build key used for the default profile directory")
+        .option("--directory <path>", "profile directory")
         .action(async (idOrFile, options) => {
-        const directory = resolve(options.directory);
+        const directory = resolve(options.directory ?? profileDirectoryFor(home, options.build));
         if (idOrFile) {
             const file = profileFile(directory, idOrFile);
             const profile = jsonRecord(await readFile(file, "utf8"), file);
@@ -404,13 +446,27 @@ export function createWowdumpCli(dependencies = {}) {
             ...(options.size ? { size: positiveInteger(options.size, "size") } : {})
         };
         const pid = positiveInteger(String(payload.pid ?? options.pid), "pid");
-        const profileId = typeof payload.profileId === "string" ? payload.profileId : (typeof options.profile === "string" ? options.profile : undefined);
+        let profileId = typeof payload.profileId === "string" ? payload.profileId : (typeof options.profile === "string" ? options.profile : undefined);
+        const requestedBuild = typeof payload.buildKey === "string" ? payload.buildKey : (typeof options.build === "string" ? options.build : undefined);
+        if (!profileId && payload.address === undefined && requestedBuild) {
+            const available = await listProfileFiles(profileDirectoryFor(home, requestedBuild));
+            if (available.length === 1)
+                profileId = basename(available[0], extname(available[0]));
+            else if (available.length === 0)
+                throw new CliError("PROFILE_NOT_FOUND", `no profile exists for build ${requestedBuild}`, { directory: profileDirectoryFor(home, requestedBuild) });
+            else
+                throw new CliError("PROFILE_SELECTION_REQUIRED", `more than one profile exists for build ${requestedBuild}`, { profiles: available });
+        }
         if (profileId && payload.address === undefined) {
-            const profileFilePath = profileFile(join(home, "profiles"), profileId);
+            const buildKey = requestedBuild;
+            const profileFilePath = profileFile(isAbsolute(profileId) ? dirname(profileId) : profileDirectoryFor(home, buildKey), profileId);
             const profile = jsonRecord(await readFile(profileFilePath, "utf8"), profileFilePath);
+            await validateProfileIdentity(home, buildKey, profile, profileFilePath);
+            const buildRecord = buildKey ? await readBuild(home, buildKey) : null;
             const result = await profileEngine.read({
                 pid,
-                buildKey: typeof payload.buildKey === "string" ? payload.buildKey : undefined,
+                buildKey,
+                ...(buildRecord?.executableSha256 ? { executableSha256: buildRecord.executableSha256 } : {}),
                 profile,
                 fields: Array.isArray(payload.fields) ? payload.fields.map(String) : undefined
             }, profileAdapter);
@@ -419,6 +475,20 @@ export function createWowdumpCli(dependencies = {}) {
         }
         writeJson(io, await broker({ command: "read", payload }));
     });
+    memory.command("regions")
+        .description("Enumerate committed virtual memory regions through VirtualQueryEx")
+        .requiredOption("--pid <pid>", "target process ID")
+        .option("--start <hex>", "query start address", "0x0")
+        .option("--end <hex>", "query end address")
+        .option("--max-regions <count>", "maximum returned regions", "4096")
+        .option("--include-free", "include free and reserved regions")
+        .action(async (options) => writeJson(io, await broker({ command: "regions", payload: {
+            pid: positiveInteger(options.pid, "pid"),
+            start: options.start,
+            ...(options.end ? { end: options.end } : {}),
+            maxRegions: positiveInteger(options.maxRegions, "max-regions"),
+            includeFree: options.includeFree === true
+        } })));
     const watch = memory.command("watch").description("Manage broker-owned memory monitors");
     watch.command("start")
         .description("Start a monitor")
@@ -458,25 +528,7 @@ export function createWowdumpCli(dependencies = {}) {
         .description("Stop a monitor and release its resources")
         .requiredOption("--id <watchId>", "monitor ID")
         .action(async (options) => writeJson(io, await broker({ command: "watch.stop", payload: { watchId: options.id } })));
-    const analyze = program.command("analyze").description("Run Frida evidence export and runtime-guided disassembly");
-    analyze.command("disassemble")
-        .description("Decode Frida text evidence and produce a Reader profile")
-        .requiredOption("--exe <path>", "path to Wow.exe")
-        .requiredOption("--build <buildKey>", "build key")
-        .requiredOption("--runtime-export <file>", "runtime evidence JSON")
-        .option("--ida-evidence <file>", "JSON produced by an IDA Pro MCP analysis")
-        .option("--output <file>", "profile output JSON")
-        .option("--max-instructions <count>", "maximum decoded instructions", "256")
-        .option("--dry-run", "validate inputs without writing a profile")
-        .action(async (options) => writeJson(io, await runDisassembly({
-        exe: options.exe,
-        buildKey: options.build,
-        runtimeExport: options.runtimeExport,
-        ...(options.idaEvidence ? { idaEvidence: options.idaEvidence } : {}),
-        ...(options.output ? { output: options.output } : {}),
-        maxInstructions: positiveInteger(options.maxInstructions, "max-instructions"),
-        dryRun: options.dryRun === true
-    })));
+    const analyze = program.command("analyze").description("Run Frida evidence export and bounded runtime operations");
     analyze.command("runtime")
         .description("Dump runtime PE sections or verify profile candidates through the elevated Frida broker")
         .requiredOption("--pid <pid>", "target process ID")
@@ -486,6 +538,8 @@ export function createWowdumpCli(dependencies = {}) {
         .option("--worker <path>", "Frida worker entry")
         .option("--profile <path>", "reader profile containing candidate RVAs (verify only)")
         .option("--output-dir <path>", "directory for dump manifest and section binaries")
+        .option("--sections <names...>", "sections to dump (default: .text .rdata .pdata)")
+        .option("--no-progress", "disable dump progress on stderr")
         .option("--max-section-bytes <bytes>", "per-section dump limit", "134217728")
         .option("--max-total-bytes <bytes>", "total dump limit", "268435456")
         .option("--chunk-size <bytes>", "dump chunk size", "1048576")
@@ -521,12 +575,41 @@ export function createWowdumpCli(dependencies = {}) {
         const profile = options.profile
             ? jsonRecord(await readFile(resolve(options.profile), "utf8"), options.profile)
             : undefined;
+        const buildRecord = await readBuild(home, normalized.build);
+        if (profile)
+            await validateProfileIdentity(home, normalized.build, profile, resolve(options.profile));
+        const sections = Array.isArray(options.sections) && options.sections.length > 0
+            ? options.sections.map((value) => String(value).toLowerCase())
+            : [".text", ".rdata", ".pdata"];
+        if (normalized.kind === "dump") {
+            const reusable = buildRecord?.executableSha256
+                ? await findReusableDump(home, normalized.build, {
+                    executableSha256: buildRecord.executableSha256,
+                    sections,
+                    maxSectionBytes: normalized.maxSectionBytes,
+                    maxTotalBytes: normalized.maxTotalBytes,
+                    chunkSize: normalized.chunkSize
+                })
+                : null;
+            if (reusable) {
+                writeJson(io, { ok: true, command: "analyze.runtime.dump", reused: true, manifestFile: String(reusable.manifestFile ?? ""), manifest: reusable });
+                return;
+            }
+        }
+        const sessionId = randomUUID();
+        const sessionDirectory = options.outputDir
+            ? resolve(options.outputDir, "..")
+            : join(buildPaths(home, normalized.build).runtime, sessionId);
+        const outputDirectory = resolve(options.outputDir ?? join(sessionDirectory, "dump"));
+        await mkdir(sessionDirectory, { recursive: true });
+        await writeFile(join(sessionDirectory, "target.json"), `${JSON.stringify({ schema: "wowdump.runtime-target.v1", pid: normalized.pid, buildKey: normalized.build, executableSha256: buildRecord?.executableSha256 ?? null, sessionId, createdAt: new Date().toISOString() }, null, 2)}\n`, "utf8");
         const request = {
-            command: "dynamic-script",
+            command: normalized.kind === "dump" ? "runtime-dump" : "dynamic-script",
             pid: normalized.pid,
             build: normalized.build,
             source: RUNTIME_EXPORT_SCRIPT,
             exportName: "collect",
+            ...(normalized.kind === "dump" ? { outputDir: outputDirectory, progress: options.progress !== false, executableSha256: buildRecord?.executableSha256 ?? null, preferredImageBase: buildRecord?.preferredImageBase ?? null, moduleSize: buildRecord?.moduleSize ?? null, dumpParameters: { executableSha256: buildRecord?.executableSha256 ?? null, sections, maxSectionBytes: normalized.maxSectionBytes, maxTotalBytes: normalized.maxTotalBytes, chunkSize: normalized.chunkSize } } : {}),
             args: {
                 kind: normalized.kind,
                 maxHooks: normalized.maxHooks,
@@ -537,22 +620,29 @@ export function createWowdumpCli(dependencies = {}) {
                 maxTotalBytes: normalized.maxTotalBytes,
                 chunkSize: normalized.chunkSize,
                 maxVerifyBytes: normalized.maxVerifyBytes,
+                ...(normalized.kind === "dump" ? { sections } : {}),
                 ...(profile ? { profile } : {})
             },
             callArgs: [],
             durationMs: normalized.durationMs
         };
         const result = await sidecar(process.execPath, [worker], `${JSON.stringify(request)}\n`);
+        if (result.stderr && options.progress !== false)
+            io.stderr.write(result.stderr);
         if (result.exitCode !== 0)
             throw new CliError("FRIDA_WORKER_FAILED", result.stderr.trim() || `Frida worker exited with ${result.exitCode}`);
         const line = result.stdout.split(/\r?\n/).find(value => value.trim());
         const value = line ? jsonRecord(line, "runtime result") : { ok: true, stdout: result.stdout };
         if (normalized.kind === "dump" && value.ok === true) {
-            const defaultDirectory = join(home, safeBuildDirectory(normalized.build), "runtime", `dump-${Date.now()}`);
-            const persisted = await persistRuntimeDump(value, options.outputDir ?? defaultDirectory);
-            writeJson(io, { ...persisted, command: "analyze.runtime.dump" });
+            if (typeof value.manifestFile === "string") {
+                await writeFile(join(sessionDirectory, "dynamic.json"), `${JSON.stringify(value.manifest ?? value, null, 2)}\n`, "utf8").catch(() => undefined);
+                writeJson(io, { ...value, command: "analyze.runtime.dump", sessionDirectory });
+            }
+            else
+                throw new CliError("RUNTIME_DUMP_INVALID", "runtime dump worker returned no manifest");
         }
         else {
+            await writeFile(join(sessionDirectory, "verify.json"), `${JSON.stringify(value, null, 2)}\n`, "utf8").catch(() => undefined);
             writeJson(io, { ...value, command: "analyze.runtime.verify" });
         }
     });
@@ -586,11 +676,17 @@ export function createWowdumpCli(dependencies = {}) {
         if (!existsSync(worker))
             throw new CliError("FRIDA_WORKER_NOT_FOUND", `Frida worker was not found: ${worker}`);
         const request = { command: "dynamic-script", ...selected(normalized, ["pid", "build", "script", "exportName", "args", "callArgs", "durationMs"]) };
+        const sessionId = randomUUID();
+        const sessionDirectory = join(buildPaths(home, normalized.build).runtime, sessionId);
+        await mkdir(sessionDirectory, { recursive: true });
+        await writeFile(join(sessionDirectory, "target.json"), `${JSON.stringify({ schema: "wowdump.runtime-target.v1", pid: normalized.pid, buildKey: normalized.build, sessionId, createdAt: new Date().toISOString() }, null, 2)}\n`, "utf8");
         const result = await sidecar(process.execPath, [worker], `${JSON.stringify(request)}\n`);
         if (result.exitCode !== 0)
             throw new CliError("FRIDA_WORKER_FAILED", result.stderr.trim() || `Frida worker exited with ${result.exitCode}`);
         const line = result.stdout.split(/\r?\n/).find(value => value.trim());
-        writeJson(io, line ? JSON.parse(line) : { ok: true, command: "analyze.dynamic", stdout: result.stdout });
+        const value = line ? JSON.parse(line) : { ok: true, command: "analyze.dynamic", stdout: result.stdout };
+        await writeFile(join(sessionDirectory, "dynamic.json"), `${JSON.stringify(value, null, 2)}\n`, "utf8");
+        writeJson(io, { ...value, command: "analyze.dynamic", sessionDirectory });
     });
     program.command("init")
         .description("Initialize WOWDUMP_HOME without overwriting existing files")