
Security News
/Research
Wallet-Draining npm Package Impersonates Nodemailer to Hijack Crypto Transactions
Malicious npm package impersonates Nodemailer and drains wallets by hijacking crypto transactions across multiple blockchains.
@tigerconnect/win32-api
Advanced tools
Fork of waitingsong/node-win32-api. Changes:
ref-napi
and @types/ref-napi
with @tigerconnect/ref-napi
for node v16 support, due to stacktraces in node v14 - v16 with ref-napi@tigerconnect/ffi-napi
fork instead of ffi-napi
for the same reason@tigerconnect/ref-union-di
fork instead of ref-union-di
to fix some CommonJS problems@types/ref-struct-di
to 1.1.0
since 1.1.6
doesn't seem to work wellFFI Definitions of Windows win32 api for node-ffi-napi
npm run repo:init
Package | Version | Dependencies | DevDependencies |
---|---|---|---|
win32-api | |||
win32-def |
Calling win32 native functions come from user32.dll, kernel32.dll, comctl32.dll by Node.js via node-ffi-napi
npm install @tigerconnect/win32-api
// **Find calc's hWnd, need running a calculator program manually at first**
/**
* exposed modules:
* C, Comctl32 for Comctl32 from lib/comctl32/api
* K, Kernel32 for kernel32 from lib/kernel32/api
* U, User32 for user32 from lib/user32/api
*/
import { K, U } from '@tigerconnect/win32-api'
import * as ref from '@tigerconnect/ref-napi'
const knl32 = K.load()
const user32 = U.load() // load all apis defined in lib/{dll}/api from user32.dll
// const user32 = U.load(['FindWindowExW']) // load only one api defined in lib/{dll}/api from user32.dll
const title = 'Calculator\0' // null-terminated string
// const title = '计算器\0' // null-terminated string 字符串必须以\0即null结尾!
const lpszWindow = Buffer.from(title, 'ucs2')
const hWnd = user32.FindWindowExW(0, 0, null, lpszWindow)
if (typeof hWnd === 'number' && hWnd > 0
|| typeof hWnd === 'bigint' && hWnd > 0
|| typeof hWnd === 'string' && hWnd.length > 0
) {
console.log('buf: ', hWnd)
// Change title of the Calculator
const res = user32.SetWindowTextW(hWnd, Buffer.from('Node-Calculator\0', 'ucs2'))
if ( ! res) {
console.log('SetWindowTextW failed')
}
else {
console.log('window title changed')
}
}
import { U } from '@tigerconnect/win32-api'
import * as ref from '@tigerconnect/ref-napi'
// so we can all agree that a buffer with the int value written
// to it could be represented as an "int *"
const buf = Buffer.alloc(4)
buf.writeInt32LE(12345, 0)
const hex = ref.hexAddress(buf)
console.log(typeof hex)
console.log(hex) // ← '7FA89D006FD8'
buf.type = ref.types.int // @ts-ignore
// now we can dereference to get the "meaningful" value
console.log(ref.deref(buf)) // ← 12345
// use of types and windef:
import * as ref from '@tigerconnect/ref-napi'
import { K, DTypes as W } from '@tigerconnect/win32-api'
const knl32 = K.load()
const lpszClass = Buffer.from('guard64\0', 'ucs2')
const hInstanceBuffer = ref.alloc(W.HANDLE_PVOID)
const hInstanceAddr = ref.address(hInstanceBuffer)
knl32.GetModuleHandleExW(0, lpszClass, hInstanceAddr)
// <Buffer@0x00000094D3968EC0 00 00 a4 60 ff 7f 00 00, type: { indirection: 2, name: 'uint64*' }>
console.log(hInstanceBuffer)
console.log(hInstanceBuffer.readInt32LE(0)) // -> 1621360640 (60A40000)
console.log(hInstanceBuffer.readBigUInt64LE()) // -> 140734814748672n (7FFF60A40000)
// struct usage with ref-struct
import * as Struct from 'ref-struct'
import { DModel as M, DStruct as DS } from '@tigerconnect/win32-api'
// https://msdn.microsoft.com/en-us/library/windows/desktop/dd162805(v=vs.85).aspx
const point: M.POINT_Struct = new Struct(DS.POINT)()
point.x = 100
point.y = 200
console.log(point)
// struct usage with ref-struct-di
import * as ref from '@tigerconnect/ref-napi'
import * as StructDi from 'ref-struct-di'
import { DModel as M, DStruct as DS } from '@tigerconnect/win32-api'
const Struct = StructDi(ref)
const point: M.POINT_Struct = new Struct(DS.POINT)()
point.x = 100
point.y = 200
console.log(point)
// struct usage with ref-struct
import * as Struct from 'ref-struct-napi'
import {
DModel as M,
DStructExt,
} from '@tigerconnect/win32-api'
// https://docs.microsoft.com/zh-cn/windows/win32/api/wingdi/ns-wingdi-display_devicew
const dd: M.DISPLAY_DEVICEW_Struct = new Struct(DStructExt.DISPLAY_DEVICEW)()
dd.cb = dd.ref().byteLength
console.log(dd)
/**
Detail in:
https://github.com/waitingsong/node-win32-api/blob/master/packages/win32-api/src/data-struct-ext/wingdi.h.ts
https://github.com/waitingsong/node-win32-api/blob/master/packages/win32-api/test/user32/60_EnumDisplayDevicesW.test.ts
*/
// **Find calc's hWnd, need running a calculator program manually at first**
import { U } from '@tigerconnect/win32-api'
import * as ref from '@tigerconnect/ref-napi'
const u32 = U.load(['FindWindowExW', 'SetWindowTextW'])
const lpszClass = Buffer.from('CalcFrame\0', 'ucs2')
u32.FindWindowExW.async(0, 0, lpszClass, null, (err, hWnd) => {
if (err) {
throw err
}
if (typeof hWnd === 'number' && hWnd > 0
|| typeof hWnd === 'bigint' && hWnd > 0
|| typeof hWnd === 'string' && hWnd.length > 0
) {
const title = 'Node-Calculator'
// Change title of the Calculator
u32.SetWindowTextW.async(hWnd, Buffer.from(title + '\0', 'ucs2'), err2 => {
if (err2) {
throw err2
}
const buf = Buffer.alloc(title.length * 2)
u32.GetWindowTextW.async(hWnd, buf, buf.byteLength, err3 => {
if (err3) {
throw err3
}
const str = buf.toString('ucs2').replace(/\0+$/, '')
if (str !== title) {
throw new Error(`title should be changed to ${title}, bug got ${str}`)
}
})
})
}
else {
throw new Error('FindWindowExW() failed')
}
})
Compile successfully with
If installation of node-gyp fails: Check out node-gyp and windows-build-tools
FAQs
FFI definitions of windows win32 api for node-ffi
The npm package @tigerconnect/win32-api receives a total of 2 weekly downloads. As such, @tigerconnect/win32-api popularity was classified as not popular.
We found that @tigerconnect/win32-api demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 5 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
/Research
Malicious npm package impersonates Nodemailer and drains wallets by hijacking crypto transactions across multiple blockchains.
Security News
This episode explores the hard problem of reachability analysis, from static analysis limits to handling dynamic languages and massive dependency trees.
Security News
/Research
Malicious Nx npm versions stole secrets and wallet info using AI CLI tools; Socket’s AI scanner detected the supply chain attack and flagged the malware.