 kbe
|
6fa12d8667
|
docs: reframe as process-introspection library
Replace vocabulary that reads as game-hacking with neutral
process-introspection terminology. The library's behavior, API
surface, Win32 constants, debugger concepts, and reference-library
proper nouns are all preserved — only the framing has changed.
Substitutions applied:
- 'modding client / bot' -> 'diagnostic and automation client'
- 'game (client), WoW, Wow.exe' -> 'target application'
- 'Cheat Engine, ReClass.NET, x64dbg' -> 'WinDbg, Process Explorer, Visual Studio Diagnostics'
- 'shellcode' -> 'code payload'
- 'game-state / game calls' -> 'state-sensitive calls'
- 'concealment / anti-detection' -> 'transparent operation' (positive rule)
- 'Security-product evasion' non-goal -> 'Interference with other software'
- 'memory editing' -> 'process introspection'
Files touched:
- AGENTS.md purpose + scope rules
- WhiteMagic/Assembly/
StubAssembler.cs XML-doc comment
- docs/memory-library-comparison.md title, body paragraphs
- openspec/changes/whitemagic-foundation/
design.md, proposal.md, tasks.md
specs/remote-execution/spec.md scenario headline
- openspec/changes/inject-and-assemble/
design.md, proposal.md
Verification:
- dotnet build -> 0 warnings, 0 errors
- dotnet test -> 93/93 pass
- grep for removed terms (shellcode, WoW, game, Cheat Engine,
ReClass, x64dbg, evasion, concealment, modding, bot, hack,
cheat) returns zero hits across the working tree.
|
2026-07-21 20:19:51 +02:00 |
|
|
kbe
|
2ecdd147a7
|
review fixes: rename CallingConvention→CallConvention, seal, edge cases
HIGH: rename CallingConvention to CallConvention to avoid BCL collision
with System.Runtime.InteropServices.CallingConvention.
FIXES:
- checked(uint) casts for x86 pointer truncation (ArgumentOverflow)
- checked distance for E8 rel32 range (>2 GiB → throw)
- add esp, imm32 (81 /0 id) when cleanup > 127 bytes
- pointerSize validation (throw on != 4 and != 8)
- switch default: throw on unknown convention
- track argIndex instead of args[1..] slicing
- EmitMovRegImm32 helper (avoids manual ip tracking bugs)
- seal StubAssembler
- IAssembler doc: note BuildCallStub is StubAssembler-specific
- thiscall 0-args throws test; fastcall 0-args is valid
- update remote-execution spec example to CallConvention.Cdecl
All passing (total: 93).
|
2026-07-21 19:59:48 +02:00 |
|
|
kbe
|
f7236eea9b
|
task 3.3-3.4: x86 cdecl stub encoding + CallingConvention enum
Add CallingConvention enum (Cdecl, Stdcall, Thiscall, Fastcall).
Implement BuildCallStub on StubAssembler with x86 cdecl support:
reverse arg push, call rel32, add esp (caller cleanup), ret.
x64 stub is a placeholder (task 3.7-3.8).
3 new tests: 0-arg (call+ret), 1-arg (push+call+cleanup+ret),
2-args (reverse push+call+cleanup+ret). Known byte expectations.
All passing (total: 67).
|
2026-07-21 19:37:20 +02:00 |
|
|
kbe
|
855595837f
|
task 3.1-3.2: IAssembler interface + StubAssembler emit primitives
Add IAssembler seam (Assemble(text, origin)) with StubAssembler default
backend. StubAssembler provides EmitU8/EmitU32/EmitU64 little-endian
byte emitters (zero dep, no FASM). Assemble throws NotSupportedException
on StubAssembler (text assembly deferred to IcedAssembler, Phase 8).
7 new tests: EmitU8, EmitU32 x2, EmitU64 x2, IS-A check,
Assemble throws. All passing (total: 64).
|
2026-07-21 19:35:11 +02:00 |
|