wowdump 0.3.4 → 0.3.7

package/README.md

@@ -1,6 +1,6 @@
 # wowdump
 
-WoW 原生内存分析 CLI。用 Frida 运行时证据和 IDA Pro/iced-x86 局部反汇编定位字段，生成可复核的 Reader profile。
+WoW 原生内存分析 CLI。用 WinDbg CDB 运行时证据和 IDA Pro/iced-x86 局部反汇编定位字段，生成可复核的 Reader profile。
 
 ## 安装
 
@@ -18,19 +18,24 @@ wowdump init
 wowdump targets
 wowdump database status --build "retail@VERSION"
 
-# 2. 导出运行时模块段
+# 2. 用 CDB 导出运行时模块段
 wowdump analyze runtime --pid 1234 --build "retail@VERSION" --kind dump --confirm
 
 # 3. 用 IDA Pro MCP（若可用）或 iced-x86 分析 session dump manifest，保存字段候选和证据
-# 4. 将候选证据交给 verify，再用 Reader 验证
+# 4. 需要函数调用参数时，用 CDB 硬件断点
+wowdump analyze debug --pid 1234 --build "retail@VERSION" --rva 0x... --kind breakpoint --confirm
+# 5. 将候选证据交给 verify，再用 Reader 验证
 
-# 5. 用户确认后，把 profile 保存到当前 build 的 profile 目录，再读取
+# 6. 用户确认后，把 profile 保存到当前 build 的 profile 目录，再读取
 wowdump memory read --pid 1234 --profile "$HOME\.wowdump\retail@VERSION\profile\player-state.json" --field playerAuras
+
+# 枚举已提交虚拟内存区（复用同一个管理员 broker）
+wowdump memory regions --pid 1234 --start 0x15000000000 --end 0x15400000000 --max-regions 20000
 ```
 
-Windows reader 首次使用时由 Node 请求 UAC 启动 broker，后续调用复用同一 broker，空闲 20 分钟后退出。Frida 运行时导出需要显式 `--confirm`；高开销 Stalker 默认关闭。
+Windows reader 首次使用时由 Node 请求 UAC 启动 broker，后续内存读取和 CDB 调试请求复用同一 broker，空闲 20 分钟后退出。CDB 路径探测不会下载或修改环境变量；所有调试请求都需要显式 `--confirm`。
 
-`targets` 会写入 `~/.wowdump/<buildKey>/build.json` 和 `database/database.json`；同一 build 的 IDA 数据库只创建一份。`analyze runtime --kind dump` 默认把 `.text`、`.rdata`、`.pdata` 流式写入当前 session，`.data` 需通过 `--sections` 显式加入。`analyze runtime --kind verify --profile <file>` 只验证已有 profile 的 RVA。Reader 只读取 `~/.wowdump/<buildKey>/profile/`，不读取 IDA 数据库和 dump 二进制。完整字段和 JSON 约定见 `~/.agents/skills/wowdump/references/commands.md`、`references/request-schema.md` 与 `references/profiles.md`；短时 Hook 示例见 `~/.agents/skills/wowdump/scripts/dynamic-session.js`。
+`targets` 会写入 `~/.wowdump/<buildKey>/build.json` 和 `database/database.json`；同一 build 的 IDA 数据库只创建一份。`analyze runtime --kind dump` 默认把 `.text`、`.rdata`、`.pdata` 写入当前 session，`.data` 需通过 `--sections` 显式加入。`analyze runtime --kind verify --profile <file>` 只验证已有 profile 的 RVA。Reader 只读取 `~/.wowdump/<buildKey>/profile/`，不读取 IDA 数据库和 dump 二进制。完整字段和 JSON 约定见 `~/.agents/skills/wowdump/references/commands.md`、`references/request-schema.md`、`references/windbg.md` 与 `references/profiles.md`。
 
 ## 开发验证
 

package/dist/analysis/runtime-dump.js

@@ -5,7 +5,7 @@ function safeName(name) {
     const value = String(name ?? "section");
     return /^[A-Za-z0-9_.-]+$/.test(value) ? value : "section";
 }
-/** Streams Frida ArrayBuffer messages into section files without Base64 JSON. */
+/** Streams section bytes into files and writes a compact runtime manifest. */
 export class RuntimeDumpWriter {
     outputDirectory;
     options;
@@ -61,7 +61,7 @@ export class RuntimeDumpWriter {
             };
         });
         const manifest = {
-            schema: "wowdump.runtime-dump.v2",
+            schema: "wowdump.runtime-dump.v3",
             kind: "dump",
             buildKey: this.options.buildKey,
             pid: this.options.pid,

package/dist/cli.js

@@ -9,7 +9,7 @@ import { Command } from "commander";
 import { WindowsBrokerManager } from "./reader/launcher.js";
 import { initializeWowdumpHome, bootstrapToolchain, resolveToolchain } from "./toolchain.js";
 import { buildPaths, databaseStatus, ensureBuild, findReusableDump, readBuild, resolveWowdumpHome, safeBuildKey, sha256File } from "./core/build-store.js";
-import { RUNTIME_EXPORT_SCRIPT } from "./analysis/runtime-script.js";
+import { readPeLayout } from "./debug/cdb.js";
 import { ProfileEngine } from "./core/profile-engine.js";
 import { ReaderProfileAdapter } from "./adapters/reader.js";
 import { enumerateWindowsProcesses } from "./reader/windows.js";
@@ -82,7 +82,7 @@ async function discoverWowTargets(selectedPid, elevatedModules) {
                 catch { /* try the next parent directory */ }
             }
         }
-        targets.push({ pid, name, path, moduleBase, moduleSize, fileVersion, product, buildKey: fileVersion ? `retail@${fileVersion}` : null, ...(buildInfoFile ? { buildInfoFile } : {}), ...(diagnostic ? { diagnostics: { frida: diagnostic } } : {}) });
+        targets.push({ pid, name, path, moduleBase, moduleSize, fileVersion, product, buildKey: fileVersion ? `retail@${fileVersion}` : null, ...(buildInfoFile ? { buildInfoFile } : {}), ...(diagnostic ? { diagnostics: { modules: diagnostic } } : {}) });
     }
     return targets;
 }
@@ -198,23 +198,6 @@ function jsonRecord(value, field) {
 function writeJson(io, value) {
     io.stdout.write(`${JSON.stringify(value, null, 2)}\n`);
 }
-async function defaultSidecar(file, args, input) {
-    return new Promise(resolveResult => {
-        const child = spawn(file, args, { windowsHide: true, stdio: ["pipe", "pipe", "pipe"] });
-        let stdout = "";
-        let stderr = "";
-        child.stdout.setEncoding("utf8");
-        child.stderr.setEncoding("utf8");
-        child.stdout.on("data", value => { stdout += value; });
-        child.stderr.on("data", value => { stderr += value; });
-        child.once("error", error => resolveResult({ exitCode: 1, stdout, stderr: `${stderr}${error.message}` }));
-        child.once("exit", code => resolveResult({ exitCode: code ?? 1, stdout, stderr }));
-        if (input !== undefined)
-            child.stdin.end(input);
-        else
-            child.stdin.end();
-    });
-}
 function brokerCommandLine(env, packageDist) {
     const configured = env.WOWDUMP_READER_COMMAND?.trim();
     if (configured)
@@ -222,12 +205,23 @@ function brokerCommandLine(env, packageDist) {
     const candidate = join(packageDist, "reader-main.js");
     return existsSync(candidate) ? { file: process.execPath, args: [candidate, "--request-stdio"] } : null;
 }
-async function defaultBroker(invocation, env, packageDist, sidecar) {
+async function defaultBroker(invocation, env, packageDist) {
     const command = brokerCommandLine(env, packageDist);
     if (!command) {
         throw new CliError("BROKER_NOT_CONFIGURED", "reader broker entry was not found", { expected: join(packageDist, "reader-main.js"), environment: "WOWDUMP_READER_COMMAND" });
     }
-    const result = await (sidecar ?? defaultSidecar)(command.file, command.args, `${JSON.stringify(invocation)}\n`);
+    const result = await new Promise(resolveResult => {
+        const child = spawn(command.file, command.args, { shell: false, windowsHide: true, stdio: ["pipe", "pipe", "pipe"] });
+        let stdout = "";
+        let stderr = "";
+        child.stdout?.setEncoding("utf8");
+        child.stderr?.setEncoding("utf8");
+        child.stdout?.on("data", value => { stdout += String(value); });
+        child.stderr?.on("data", value => { stderr += String(value); });
+        child.once("error", error => resolveResult({ exitCode: 1, stdout, stderr: `${stderr}${error.message}` }));
+        child.once("exit", code => resolveResult({ exitCode: code ?? 1, stdout, stderr }));
+        child.stdin?.end(`${JSON.stringify(invocation)}\n`);
+    });
     if (result.exitCode !== 0)
         throw new CliError("BROKER_FAILED", result.stderr.trim() || `reader broker exited with ${result.exitCode}`);
     const line = result.stdout.split(/\r?\n/).find(value => value.trim());
@@ -240,22 +234,6 @@ async function defaultBroker(invocation, env, packageDist, sidecar) {
         throw new CliError("BROKER_PROTOCOL_ERROR", "reader broker returned invalid JSON", { stdout: result.stdout });
     }
 }
-async function runFridaWorker(worker, input, timeoutMs, broker) {
-    if (process.platform !== "win32") {
-        throw new CliError("PLATFORM_UNSUPPORTED", "elevated Frida broker is currently supported on Windows only");
-    }
-    const raw = await broker({ command: "frida", payload: { worker, input, timeoutMs } });
-    const response = raw && typeof raw === "object" ? raw : {};
-    if (response.ok === false) {
-        const error = response.error && typeof response.error === "object" ? response.error : {};
-        throw new CliError("BROKER_FAILED", String(error.message ?? "elevated Frida worker failed"), { response });
-    }
-    return {
-        exitCode: Number.isSafeInteger(Number(response.exitCode)) ? Number(response.exitCode) : 1,
-        stdout: typeof response.stdout === "string" ? response.stdout : "",
-        stderr: typeof response.stderr === "string" ? response.stderr : ""
-    };
-}
 const windowsBrokerManagers = new Map();
 function persistentWindowsBroker(home, packageDist) {
     const key = resolve(home).toLowerCase();
@@ -307,15 +285,13 @@ function selected(source, keys) {
 function requireRuntimeConfirmation(options) {
     if (options.confirm === true)
         return;
-    throw new CliError("CONFIRMATION_REQUIRED", "runtime analysis requires --confirm", {
+    throw new CliError("CONFIRMATION_REQUIRED", "debug analysis requires --confirm", {
         pid: options.pid,
         buildKey: options.build,
         operation: "runtime",
         kind: options.kind,
-        maxHooks: options.maxHooks,
         durationMs: options.durationMs,
-        maxEvents: options.maxEvents,
-        cleanupDeadlineMs: options.cleanupDeadlineMs
+        maxHits: options.maxHits
     });
 }
 function profileDirectoryFor(home, buildKey) {
@@ -355,16 +331,9 @@ export function createWowdumpCli(dependencies = {}) {
     const cwd = resolve(dependencies.cwd ?? process.cwd());
     const packageDist = installedDistDirectory();
     const home = resolveWowdumpHome(env);
-    const broker = dependencies.broker ?? (process.platform === "win32" && !dependencies.sidecar
+    const broker = dependencies.broker ?? (process.platform === "win32"
         ? (invocation => persistentWindowsBroker(home, packageDist).request(invocation))
-        : (invocation => defaultBroker(invocation, env, packageDist, dependencies.sidecar)));
-    const baseSidecar = dependencies.sidecar ?? defaultSidecar;
-    const sidecar = async (file, args, input) => {
-        const worker = args.length === 1 && /\.m?js$/i.test(args[0] ?? "") ? args[0] : undefined;
-        if (worker && input !== undefined)
-            return runFridaWorker(worker, input, 120_000, broker);
-        return baseSidecar(file, args, input);
-    };
+        : (invocation => defaultBroker(invocation, env, packageDist)));
     const profileEngine = new ProfileEngine();
     const profileAdapter = new ReaderProfileAdapter(broker);
     const program = new Command()
@@ -398,7 +367,7 @@ export function createWowdumpCli(dependencies = {}) {
         writeJson(io, { ...await databaseStatus(home, options.build), command: "database.status" });
     });
     program.command("target")
-        .description("Show target, reader broker, profile, monitor, and Frida state")
+        .description("Show target, reader broker, profile, monitor, and debugger state")
         .option("--pid <pid>", "target process ID")
         .option("--build <buildKey>", "expected build key")
         .action(async (options) => {
@@ -475,6 +444,20 @@ export function createWowdumpCli(dependencies = {}) {
         }
         writeJson(io, await broker({ command: "read", payload }));
     });
+    memory.command("regions")
+        .description("Enumerate committed virtual memory regions through VirtualQueryEx")
+        .requiredOption("--pid <pid>", "target process ID")
+        .option("--start <hex>", "query start address", "0x10000")
+        .option("--end <hex>", "query end address")
+        .option("--max-regions <count>", "maximum returned regions", "4096")
+        .option("--include-free", "include free and reserved regions")
+        .action(async (options) => writeJson(io, await broker({ command: "regions", payload: {
+            pid: positiveInteger(options.pid, "pid"),
+            start: options.start,
+            ...(options.end ? { end: options.end } : {}),
+            maxRegions: positiveInteger(options.maxRegions, "max-regions"),
+            includeFree: options.includeFree === true
+        } })));
     const watch = memory.command("watch").description("Manage broker-owned memory monitors");
     watch.command("start")
         .description("Start a monitor")
@@ -514,165 +497,140 @@ export function createWowdumpCli(dependencies = {}) {
         .description("Stop a monitor and release its resources")
         .requiredOption("--id <watchId>", "monitor ID")
         .action(async (options) => writeJson(io, await broker({ command: "watch.stop", payload: { watchId: options.id } })));
-    const analyze = program.command("analyze").description("Run Frida evidence export and bounded runtime operations");
+    const analyze = program.command("analyze").description("Run bounded WinDbg/CDB evidence operations");
     analyze.command("runtime")
-        .description("Dump runtime PE sections or verify profile candidates through the elevated Frida broker")
+        .description("Dump PE sections with CDB or verify a profile through the reader broker")
         .requiredOption("--pid <pid>", "target process ID")
         .requiredOption("--build <buildKey>", "build key")
         .option("--build-key <buildKey>", "alias for --build")
         .option("--kind <kind>", "dump or verify", "dump")
-        .option("--worker <path>", "Frida worker entry")
         .option("--profile <path>", "reader profile containing candidate RVAs (verify only)")
         .option("--output-dir <path>", "directory for dump manifest and section binaries")
         .option("--sections <names...>", "sections to dump (default: .text .rdata .pdata)")
-        .option("--no-progress", "disable dump progress on stderr")
         .option("--max-section-bytes <bytes>", "per-section dump limit", "134217728")
         .option("--max-total-bytes <bytes>", "total dump limit", "268435456")
-        .option("--chunk-size <bytes>", "dump chunk size", "1048576")
-        .option("--max-verify-bytes <bytes>", "maximum bytes read per candidate", "256")
-        .option("--max-hooks <count>", "reserved compatibility limit", "1")
-        .option("--duration-ms <ms>", "maximum duration", "5000")
-        .option("--max-events <count>", "maximum events", "100")
-        .option("--cleanup-deadline-ms <ms>", "cleanup deadline", "2000")
-        .option("--confirm", "confirm the exact bounded Frida operation")
+        .option("--duration-ms <ms>", "CDB timeout", "30000")
+        .option("--cdb-args <json>", "JSON array of extra CDB arguments", "[]")
+        .option("--cdb-commands <json>", "JSON array of extra CDB commands", "[]")
+        .option("--confirm", "confirm the bounded debugger operation")
         .action(async (options) => {
         const normalized = {
             pid: positiveInteger(options.pid, "pid"),
             build: options.build ?? options.buildKey,
-            kind: options.kind,
-            maxHooks: positiveInteger(options.maxHooks, "max-hooks"),
-            durationMs: positiveInteger(options.durationMs, "duration-ms"),
-            maxEvents: positiveInteger(options.maxEvents, "max-events"),
-            cleanupDeadlineMs: positiveInteger(options.cleanupDeadlineMs, "cleanup-deadline-ms"),
+            kind: String(options.kind),
             maxSectionBytes: positiveInteger(options.maxSectionBytes, "max-section-bytes"),
             maxTotalBytes: positiveInteger(options.maxTotalBytes, "max-total-bytes"),
-            chunkSize: positiveInteger(options.chunkSize, "chunk-size"),
-            maxVerifyBytes: positiveInteger(options.maxVerifyBytes, "max-verify-bytes"),
+            durationMs: positiveInteger(options.durationMs, "duration-ms"),
             confirm: options.confirm === true
         };
         if (!["dump", "verify"].includes(normalized.kind))
             throw new CliError("ARGUMENT_INVALID", "kind must be dump or verify");
         requireRuntimeConfirmation(normalized);
-        if (normalized.kind === "verify" && !options.profile)
-            throw new CliError("PROFILE_REQUIRED", "verify requires --profile <file>");
-        const worker = resolve(options.worker ?? env.WOWDUMP_FRIDA_WORKER ?? join(packageDist, "frida-worker.js"));
-        if (!existsSync(worker))
-            throw new CliError("FRIDA_WORKER_NOT_FOUND", `Frida worker was not found: ${worker}`);
-        const profile = options.profile
-            ? jsonRecord(await readFile(resolve(options.profile), "utf8"), options.profile)
-            : undefined;
         const buildRecord = await readBuild(home, normalized.build);
+        if (!buildRecord)
+            throw new CliError("BUILD_NOT_FOUND", `build ${normalized.build} has not been discovered`);
+        const profile = options.profile ? jsonRecord(await readFile(resolve(options.profile), "utf8"), options.profile) : undefined;
         if (profile)
             await validateProfileIdentity(home, normalized.build, profile, resolve(options.profile));
-        const sections = Array.isArray(options.sections) && options.sections.length > 0
+        if (normalized.kind === "verify") {
+            if (!profile)
+                throw new CliError("PROFILE_REQUIRED", "verify requires --profile <file>");
+            const result = await profileEngine.read({ pid: normalized.pid, buildKey: normalized.build, executableSha256: buildRecord.executableSha256, profile, fields: undefined }, profileAdapter);
+            writeJson(io, { ...result, command: "analyze.runtime.verify", verified: true });
+            return;
+        }
+        const requestedSections = Array.isArray(options.sections) && options.sections.length > 0
             ? options.sections.map((value) => String(value).toLowerCase())
             : [".text", ".rdata", ".pdata"];
-        if (normalized.kind === "dump") {
-            const reusable = buildRecord?.executableSha256
-                ? await findReusableDump(home, normalized.build, {
-                    executableSha256: buildRecord.executableSha256,
-                    sections,
-                    maxSectionBytes: normalized.maxSectionBytes,
-                    maxTotalBytes: normalized.maxTotalBytes,
-                    chunkSize: normalized.chunkSize
-                })
-                : null;
-            if (reusable) {
-                writeJson(io, { ok: true, command: "analyze.runtime.dump", reused: true, manifestFile: String(reusable.manifestFile ?? ""), manifest: reusable });
-                return;
-            }
+        const cdbArgs = JSON.parse(options.cdbArgs);
+        const cdbCommands = JSON.parse(options.cdbCommands);
+        if (!Array.isArray(cdbArgs) || !Array.isArray(cdbCommands))
+            throw new CliError("ARGUMENT_INVALID", "cdb-args and cdb-commands must be JSON arrays");
+        const reusable = requestedSections.includes(".data")
+            ? null
+            : await findReusableDump(home, normalized.build, { executableSha256: buildRecord.executableSha256, sections: requestedSections, maxSectionBytes: normalized.maxSectionBytes, maxTotalBytes: normalized.maxTotalBytes, cdbArgs, commands: cdbCommands });
+        if (reusable) {
+            writeJson(io, { ok: true, command: "analyze.runtime.dump", reused: true, manifestFile: String(reusable.manifestFile ?? ""), manifest: reusable });
+            return;
         }
+        const moduleResponse = await broker({ command: "modules", payload: { pid: normalized.pid } });
+        const modules = moduleResponse && typeof moduleResponse === "object" && Array.isArray(moduleResponse.modules) ? moduleResponse.modules : [];
+        const module = modules.find(item => /^Wow\.exe$/i.test(String(item.name ?? ""))) ?? modules[0];
+        if (!module || typeof module.base !== "string")
+            throw new CliError("MODULE_NOT_FOUND", "Wow.exe module was not found", { modules });
+        const moduleBase = module.base;
+        const layout = await readPeLayout(buildRecord.executablePath);
         const sessionId = randomUUID();
-        const sessionDirectory = options.outputDir
-            ? resolve(options.outputDir, "..")
-            : join(buildPaths(home, normalized.build).runtime, sessionId);
+        const sessionDirectory = join(buildPaths(home, normalized.build).runtime, sessionId);
         const outputDirectory = resolve(options.outputDir ?? join(sessionDirectory, "dump"));
         await mkdir(sessionDirectory, { recursive: true });
-        await writeFile(join(sessionDirectory, "target.json"), `${JSON.stringify({ schema: "wowdump.runtime-target.v1", pid: normalized.pid, buildKey: normalized.build, executableSha256: buildRecord?.executableSha256 ?? null, sessionId, createdAt: new Date().toISOString() }, null, 2)}\n`, "utf8");
-        const request = {
-            command: normalized.kind === "dump" ? "runtime-dump" : "dynamic-script",
-            pid: normalized.pid,
-            build: normalized.build,
-            source: RUNTIME_EXPORT_SCRIPT,
-            exportName: "collect",
-            ...(normalized.kind === "dump" ? { outputDir: outputDirectory, progress: options.progress !== false, executableSha256: buildRecord?.executableSha256 ?? null, preferredImageBase: buildRecord?.preferredImageBase ?? null, moduleSize: buildRecord?.moduleSize ?? null, dumpParameters: { executableSha256: buildRecord?.executableSha256 ?? null, sections, maxSectionBytes: normalized.maxSectionBytes, maxTotalBytes: normalized.maxTotalBytes, chunkSize: normalized.chunkSize } } : {}),
-            args: {
-                kind: normalized.kind,
-                maxHooks: normalized.maxHooks,
-                durationMs: normalized.durationMs,
-                maxEvents: normalized.maxEvents,
-                cleanupDeadlineMs: normalized.cleanupDeadlineMs,
-                maxSectionBytes: normalized.maxSectionBytes,
-                maxTotalBytes: normalized.maxTotalBytes,
-                chunkSize: normalized.chunkSize,
-                maxVerifyBytes: normalized.maxVerifyBytes,
-                ...(normalized.kind === "dump" ? { sections } : {}),
-                ...(profile ? { profile } : {})
-            },
-            callArgs: [],
-            durationMs: normalized.durationMs
-        };
-        const result = await sidecar(process.execPath, [worker], `${JSON.stringify(request)}\n`);
-        if (result.stderr && options.progress !== false)
-            io.stderr.write(result.stderr);
-        if (result.exitCode !== 0)
-            throw new CliError("FRIDA_WORKER_FAILED", result.stderr.trim() || `Frida worker exited with ${result.exitCode}`);
-        const line = result.stdout.split(/\r?\n/).find(value => value.trim());
-        const value = line ? jsonRecord(line, "runtime result") : { ok: true, stdout: result.stdout };
-        if (normalized.kind === "dump" && value.ok === true) {
-            if (typeof value.manifestFile === "string") {
-                await writeFile(join(sessionDirectory, "dynamic.json"), `${JSON.stringify(value.manifest ?? value, null, 2)}\n`, "utf8").catch(() => undefined);
-                writeJson(io, { ...value, command: "analyze.runtime.dump", sessionDirectory });
-            }
-            else
-                throw new CliError("RUNTIME_DUMP_INVALID", "runtime dump worker returned no manifest");
-        }
-        else {
-            await writeFile(join(sessionDirectory, "verify.json"), `${JSON.stringify(value, null, 2)}\n`, "utf8").catch(() => undefined);
-            writeJson(io, { ...value, command: "analyze.runtime.verify" });
-        }
+        await writeFile(join(sessionDirectory, "target.json"), `${JSON.stringify({ schema: "wowdump.runtime-target.v2", pid: normalized.pid, buildKey: normalized.build, executableSha256: buildRecord.executableSha256, sessionId, createdAt: new Date().toISOString() }, null, 2)}\n`, "utf8");
+        let total = 0;
+        const selectedSections = requestedSections.flatMap((name) => layout.sections.find((section) => section.name.toLowerCase() === name) ?? []);
+        const sections = selectedSections.map((section) => {
+            const requested = Math.min(Math.max(section.virtualSize, section.rawSize), normalized.maxSectionBytes, Math.max(0, normalized.maxTotalBytes - total));
+            total += requested;
+            return { ...section, runtimeAddress: `0x${(BigInt(moduleBase) + BigInt(section.rva)).toString(16)}`, readSize: requested, file: join(outputDirectory, `${section.name}.bin`) };
+        });
+        if (sections.length === 0)
+            throw new CliError("SECTION_NOT_FOUND", "no requested PE sections were found", { requestedSections, available: layout.sections.map(section => section.name) });
+        const raw = await broker({ command: "debug", payload: {
+                kind: "dump", pid: normalized.pid, buildKey: normalized.build, executablePath: buildRecord.executablePath,
+                executableSha256: buildRecord.executableSha256, moduleBase, preferredImageBase: buildRecord.preferredImageBase,
+                moduleSize: Number(module.size ?? buildRecord.moduleSize ?? layout.moduleSize), outputDir: outputDirectory, sections,
+                maxSectionBytes: normalized.maxSectionBytes, maxTotalBytes: normalized.maxTotalBytes, timeoutMs: normalized.durationMs,
+                cdbArgs, commands: cdbCommands
+            } });
+        const value = raw && typeof raw === "object" ? raw : {};
+        if (value.ok !== true)
+            throw new CliError(String(value.error?.code ?? "CDB_FAILED"), String(value.error?.message ?? "CDB dump failed"), value.error);
+        writeJson(io, { ...value, command: "analyze.runtime.dump", sessionDirectory });
     });
-    analyze.command("dynamic")
-        .description("Run a caller-supplied GumJS script through Frida")
+    analyze.command("debug")
+        .description("Run a bounded WinDbg/CDB command, breakpoint, or diagnostic session")
         .requiredOption("--pid <pid>", "target process ID")
         .requiredOption("--build <buildKey>", "build key")
-        .requiredOption("--script <path>", "GumJS script file")
-        .option("--export <name>", "rpc.exports function to call")
-        .option("--args <json>", "JSON object exposed as __WOWDUMP_INPUT__", "{}")
-        .option("--call-args <json>", "JSON array passed to the exported function", "[]")
-        .option("--duration-ms <ms>", "maximum script duration", "5000")
-        .option("--confirm", "confirm the exact Frida operation")
+        .option("--kind <kind>", "breakpoint or command", "breakpoint")
+        .option("--rva <rva>", "single statically-confirmed RVA")
+        .option("--max-hits <count>", "breakpoint hit limit", "3")
+        .option("--duration-ms <ms>", "CDB timeout", "3000")
+        .option("--cdb-args <json>", "JSON array of extra CDB arguments", "[]")
+        .option("--cdb-commands <json>", "JSON array of explicit CDB commands", "[]")
+        .option("--output <path>", "debug evidence JSON path")
+        .option("--confirm", "confirm the bounded debugger operation")
         .action(async (options) => {
-        const normalized = {
-            pid: positiveInteger(options.pid, "pid"),
-            build: options.build,
-            script: resolve(options.script),
-            ...(options.export ? { exportName: options.export } : {}),
-            args: jsonRecord(options.args, "args"),
-            callArgs: JSON.parse(options.callArgs),
-            durationMs: positiveInteger(options.durationMs, "duration-ms"),
-            confirm: options.confirm === true
-        };
-        if (!Array.isArray(normalized.callArgs))
-            throw new CliError("ARGUMENT_INVALID", "call-args must be a JSON array");
-        requireRuntimeConfirmation(normalized);
-        if (!existsSync(normalized.script))
-            throw new CliError("FRIDA_SCRIPT_NOT_FOUND", `Frida script was not found: ${normalized.script}`);
-        const worker = resolve(env.WOWDUMP_FRIDA_WORKER ?? join(packageDist, "frida-worker.js"));
-        if (!existsSync(worker))
-            throw new CliError("FRIDA_WORKER_NOT_FOUND", `Frida worker was not found: ${worker}`);
-        const request = { command: "dynamic-script", ...selected(normalized, ["pid", "build", "script", "exportName", "args", "callArgs", "durationMs"]) };
-        const sessionId = randomUUID();
-        const sessionDirectory = join(buildPaths(home, normalized.build).runtime, sessionId);
+        const pid = positiveInteger(options.pid, "pid");
+        const build = String(options.build);
+        const durationMs = positiveInteger(options.durationMs, "duration-ms");
+        const kind = String(options.kind);
+        if (!["breakpoint", "command"].includes(kind))
+            throw new CliError("ARGUMENT_INVALID", "kind must be breakpoint or command");
+        requireRuntimeConfirmation({ pid, build, kind, durationMs, maxHits: options.maxHits, confirm: options.confirm === true });
+        const buildRecord = await readBuild(home, build);
+        if (!buildRecord)
+            throw new CliError("BUILD_NOT_FOUND", `build ${build} has not been discovered`);
+        const moduleResponse = await broker({ command: "modules", payload: { pid } });
+        const modules = moduleResponse && typeof moduleResponse === "object" && Array.isArray(moduleResponse.modules) ? moduleResponse.modules : [];
+        const module = modules.find(item => /^Wow\.exe$/i.test(String(item.name ?? ""))) ?? modules[0];
+        if (!module || typeof module.base !== "string")
+            throw new CliError("MODULE_NOT_FOUND", "Wow.exe module was not found");
+        const sessionDirectory = join(buildPaths(home, build).runtime, randomUUID());
         await mkdir(sessionDirectory, { recursive: true });
-        await writeFile(join(sessionDirectory, "target.json"), `${JSON.stringify({ schema: "wowdump.runtime-target.v1", pid: normalized.pid, buildKey: normalized.build, sessionId, createdAt: new Date().toISOString() }, null, 2)}\n`, "utf8");
-        const result = await sidecar(process.execPath, [worker], `${JSON.stringify(request)}\n`);
-        if (result.exitCode !== 0)
-            throw new CliError("FRIDA_WORKER_FAILED", result.stderr.trim() || `Frida worker exited with ${result.exitCode}`);
-        const line = result.stdout.split(/\r?\n/).find(value => value.trim());
-        const value = line ? JSON.parse(line) : { ok: true, command: "analyze.dynamic", stdout: result.stdout };
-        await writeFile(join(sessionDirectory, "dynamic.json"), `${JSON.stringify(value, null, 2)}\n`, "utf8");
-        writeJson(io, { ...value, command: "analyze.dynamic", sessionDirectory });
+        const output = resolve(options.output ?? join(sessionDirectory, "debug.json"));
+        const parsedArgs = JSON.parse(options.cdbArgs);
+        const parsedCommands = JSON.parse(options.cdbCommands);
+        if (!Array.isArray(parsedArgs) || !Array.isArray(parsedCommands))
+            throw new CliError("ARGUMENT_INVALID", "cdb-args and cdb-commands must be JSON arrays");
+        const payload = kind === "command"
+            ? { kind, pid, buildKey: build, durationMs, outputFile: output, cdbArgs: parsedArgs, commands: parsedCommands }
+            : { kind: "breakpoint", pid, buildKey: build, rva: options.rva, moduleBase: module.base, maxHits: positiveInteger(options.maxHits, "max-hits"), durationMs, outputFile: output, cdbArgs: parsedArgs, commands: parsedCommands };
+        if (kind !== "command" && !options.rva)
+            throw new CliError("RVA_REQUIRED", "breakpoint requires --rva");
+        const raw = await broker({ command: "debug", payload });
+        const value = raw && typeof raw === "object" ? raw : {};
+        if (value.ok !== true)
+            throw new CliError(String(value.error?.code ?? "CDB_FAILED"), String(value.error?.message ?? "CDB debug failed"), value.error);
+        writeJson(io, { ...value, command: "analyze.debug", sessionDirectory });
     });
     program.command("init")
         .description("Initialize WOWDUMP_HOME without overwriting existing files")

package/dist/core/build-adapters.js

@@ -30,14 +30,6 @@ function assertAdapter(adapter) {
     if (typeof adapter.verification !== "string" || !adapter.verification.trim()) {
         throw new TypeError("adapter.verification must identify the verification proof");
     }
-    if (adapter.fridaPrelude !== undefined) {
-        if (typeof adapter.fridaPrelude !== "string") {
-            throw new TypeError("adapter.fridaPrelude must be a string when provided");
-        }
-        if (Buffer.byteLength(adapter.fridaPrelude, "utf8") > 1024 * 1024) {
-            throw new TypeError("adapter.fridaPrelude exceeds the 1 MiB limit");
-        }
-    }
     const capabilities = adapter.capabilities;
     if (!capabilities || typeof capabilities !== "object") {
         throw new TypeError("adapter.capabilities must be provided");