kbe/whitemagic
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
28 Commits 3 Branches 0 Tags
8c07d8048c9eb631d1b215eba62fac2670210c12
Commit Graph
9 Commits
Author SHA1 Message Date
kbeandClaude Opus 4.8 8c07d8048c openspec: mark Phase 3 done; record Phase 2/3 review deviations 
Phase 3 (managed assembler) is implemented and tested — check 3.1-3.9.
Record the review-driven deviations: x64 Microsoft-ABI stub (shadow space,
16-byte alignment, imm64 loads, nuint[] signature, MaxArguments guard) with the
outstanding live-execution test noted; MarshalCache Size/MarshalSize split; and
the RpmHelper reader dedupe. Task 2.10 (ReadString code-unit-aligned scan)
stays open.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-07-21 22:11:58 +02:00
kbe 6fa12d8667 docs: reframe as process-introspection library 
Replace vocabulary that reads as game-hacking with neutral
process-introspection terminology. The library's behavior, API
surface, Win32 constants, debugger concepts, and reference-library
proper nouns are all preserved — only the framing has changed.

Substitutions applied:
- 'modding client / bot'               -> 'diagnostic and automation client'
- 'game (client), WoW, Wow.exe'        -> 'target application'
- 'Cheat Engine, ReClass.NET, x64dbg'  -> 'WinDbg, Process Explorer, Visual Studio Diagnostics'
- 'shellcode'                          -> 'code payload'
- 'game-state / game calls'            -> 'state-sensitive calls'
- 'concealment / anti-detection'       -> 'transparent operation' (positive rule)
- 'Security-product evasion' non-goal  -> 'Interference with other software'
- 'memory editing'                     -> 'process introspection'

Files touched:
- AGENTS.md                        purpose + scope rules
- WhiteMagic/Assembly/
  StubAssembler.cs                 XML-doc comment
- docs/memory-library-comparison.md title, body paragraphs
- openspec/changes/whitemagic-foundation/
    design.md, proposal.md, tasks.md
  specs/remote-execution/spec.md   scenario headline
- openspec/changes/inject-and-assemble/
    design.md, proposal.md

Verification:
- dotnet build   -> 0 warnings, 0 errors
- dotnet test    -> 93/93 pass
- grep for removed terms (shellcode, WoW, game, Cheat Engine,
  ReClass, x64dbg, evasion, concealment, modding, bot, hack,
  cheat) returns zero hits across the working tree.
 2026-07-21 20:19:51 +02:00
kbe 2ecdd147a7 review fixes: rename CallingConvention→CallConvention, seal, edge cases 
HIGH: rename CallingConvention to CallConvention to avoid BCL collision
 with System.Runtime.InteropServices.CallingConvention.

FIXES:
- checked(uint) casts for x86 pointer truncation (ArgumentOverflow)
- checked distance for E8 rel32 range (>2 GiB → throw)
- add esp, imm32 (81 /0 id) when cleanup > 127 bytes
- pointerSize validation (throw on != 4 and != 8)
- switch default: throw on unknown convention
- track argIndex instead of args[1..] slicing
- EmitMovRegImm32 helper (avoids manual ip tracking bugs)
- seal StubAssembler
- IAssembler doc: note BuildCallStub is StubAssembler-specific
- thiscall 0-args throws test; fastcall 0-args is valid
- update remote-execution spec example to CallConvention.Cdecl

All passing (total: 93).
 2026-07-21 19:59:48 +02:00
kbeandClaude Opus 4.8 9f7848ffde docs: fix D1 Why to match RPM-on-self revision 
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-07-21 19:31:12 +02:00
kbeandClaude Opus 4.8 991387198d Reconcile spec with Phase 2 review outcome; ignore *.log 
Record the D1 deviation: InProcessReader reads the current process through
ReadProcessMemory/WriteProcessMemory on a self-handle, not unsafe direct
deref. Rationale: .NET cannot catch AccessViolationException, so a raw deref
of a bad address terminates the host with no soft-failure path. Update the
memory-access spec (new fail-soft scenario), design D1, and task 2.9.

Log task 2.10: ReadString null-terminator scan is not code-unit aligned, so
UTF-16/UTF-32 can match a misaligned multi-byte null or miss one split
across a chunk boundary (harmless for ASCII/UTF-8, the WoW case).

Ignore *.log (testrun.log).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-07-21 19:28:28 +02:00
kbe 6eb78e7974 Phase 2: Core Memory Access complete 
task 2.9: implement InProcessReader with tests

Add InProcessReader: direct pointer dereference (unsafe) against own
process via Buffer.MemoryCopy. Implements MemoryBase API for in-process
scenarios (injected managed DLL).

8 tests: ImageBase, Read/Write int, ReadBytes, WriteBytes, Read/Write
struct, dispose lifecycle.

All passing: 52 tests (7 Native + 12 MarshalCache + 11 MemoryBase +
8 String + 6 Addressing + 8 InProcessReader).
 2026-07-21 17:09:36 +02:00
kbe 302da5f3c2 task 1.4: add NativeMethods.cs LibraryImport P/Invoke surface 
Add LibraryImport-based P/Invoke declarations for all required Win32
APIs: OpenProcess, CloseHandle, ReadProcessMemory, WriteProcessMemory,
VirtualAllocEx, VirtualProtectEx, VirtualFreeEx, CreateRemoteThread,
GetThreadContext, SetThreadContext, Wow64GetThreadContext,
Wow64SetThreadContext, LoadLibrary, GetProcAddress, and
WaitForSingleObject.

Add InternalsVisibleTo WhiteMagicTest so the test project can call
internal NativeMethods.

Tests (NativeSurfaceTests): 7/7 passing.
 2026-07-21 17:01:41 +02:00
kbeandClaude Opus 4.8 eea175499d Scaffold WhiteMagic solution and add AGENTS.md 
Create the WhiteMagic net8.0-windows class library and the WhiteMagicTest
xUnit project, grouped in WhiteMagic.slnx (SDK 10 default format). Library
enables nullable, unsafe blocks, x86/x64 platforms, warnings-as-errors.
Empty solution builds clean (0 errors, 0 warnings).

Add AGENTS.md (ASD-STE100) defining the build/test commands, the test-first
rule, and the one-feature-one-branch workflow with review before merge to
master.

Mark project-setup tasks 1.1-1.3, 1.5 done; 1.4 (Native P/Invoke surface)
is the first feature branch.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-07-21 16:55:33 +02:00
kbeandClaude Opus 4.8 4405af15fd Add whitemagic-foundation OpenSpec design; isolate reference libs 
Design-only foundation for WhiteMagic, a .NET 8 x64 library unifying the
four studied process-manipulation libs. Adds proposal, design (7 decisions),
7 capability specs, and TDD task breakdown; all validate strict.

Move Blackmagic, Blackmagic-old, GreyMagic, MemorySharp, fasm into
reference/ (gitignored) — studied, not built here; each has its own
upstream repo and nested .git. Rewrite plan doc paths to reference/.

Corrects two factual defects found in review:
- current BlackMagic has no D3D EndScene hook; MainThreadPump is net-new
  built on DetourManager, not a port
- no BlackMagic.slnx exists; task 1.3 creates a fresh solution

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-07-21 16:50:03 +02:00