Melonity native, script, kernel, and launcher audit

This repository is a provenance-bound reverse-engineering record of one captured x64 Melonity build. It documents the JavaScript-to-native bridge, per-handler native listings, the recovered script inventory, two injection engines present in Kernel.dll, the launcher-to-kernel bridge, local launcher storage, and the limits of the available authentication evidence.

Architecture at a glance

flowchart TB
    subgraph UI["JavaScript layer (V8 11.9.169.6)"]
        MENU["Menu tree<br/>9 tabs · 2,829 option paths"]
        SCRIPTS["Recovered scripts<br/>5,380 functions · byte-for-byte proven"]
    end

    subgraph BRIDGE["Native bridge (Kernel.dll user-mode PE)"]
        HANDLERS["240 bridge handlers<br/>151 by name · 89 by slot"]
        FFI["FFI_Call dispatch<br/>MS x64 ABI · 32-arg cap"]
        MEM["Memory primitives<br/>Read · Patch · Nop · ReadCString"]
        INJ["Injection engines<br/>LoadLibraryW remote-thread<br/>WOW64 mapper/bootstrap"]
    end

    subgraph HOST["Target process"]
        NATIVE["Arbitrary native call<br/>call RBX"]
    end

    subgraph LAUNCH["Launcher"]
        LB["Launcher→Kernel bridge<br/>LoadLibraryExW / GetProcAddress"]
        CACHE["Local AES-256-GCM cache<br/>format validated, secrets withheld"]
    end

    MENU --> SCRIPTS --> HANDLERS
    HANDLERS --> FFI --> NATIVE
    HANDLERS --> MEM
    HANDLERS --> INJ
    LB --> BRIDGE
    LB --> CACHE

    classDef proven fill:#0d3b2e,stroke:#1f9d6b,color:#e8fff5;
    classDef partial fill:#3b2f0d,stroke:#c79a1f,color:#fff8e8;
    class MENU,SCRIPTS,HANDLERS,FFI,MEM,LB,CACHE proven;
    class INJ,NATIVE partial;

Loading

Green = independently confirmed. Amber = present but with an explicitly unproved edge (e.g. which export selects which injection engine).

Evidence classes are kept separate

flowchart LR
    ID["Identity<br/>who the function is"] --- BND["Byte boundary<br/>where it starts/ends"]
    BND --- SRC["Source path<br/>what file it maps to"]
    SRC --- SEM["Semantic meaning<br/>what it does"]

    classDef c fill:#12263a,stroke:#4a90d9,color:#eaf3ff;
    class ID,BND,SRC,SEM c;

Loading

A claim in one class never silently implies another. A matched name does not imply verified behavior; a byte boundary does not imply a decoded body.

Verified results

• 240 unique native bridge handlers: 151 registered by name and 89 by slot.
• 205 identities independently matched between reconstructed and fresh runtime registration data; 35 additional identities come from a preserved runtime vector and are marked separately.
• 240 textual assembly dumps with unique start RVAs.
• 223 exception-directory boundaries, one explicitly corrected linear boundary, and 16 clearly marked heuristic leaf boundaries.
• A complete Microsoft x64 FFI dispatch path, including its 32-argument cap and the final indirect native call.
• A menu inventory containing nine top-level tabs, 567 folder/tab keys, and 2,829 exact unique option paths (2,827 case-insensitive identities).
• A current generated script bundle containing 381 exact webpack modules, reconciled with 547 historical modules into a 552-module union.
• A complete V8 script recovery for the captured build (11.9.169.6): a 5,380-function catalog, all 5,380 live BytecodeArray blobs, the compileable source, and a byte-for-byte recompilation proof (identical multiset, zero divergence). Human-readable bytecode disassembly is provided for five selected functions only.
• A decoded source map that binds 377 semantic TypeScript paths one-to-one with current generated module bodies.
• A claim-by-claim audit of the reported feature systems, including explicit partial, contradicted, and not-established results.
• A static evidence catalog for the packed Kernel.dll: 6,539 valid exception-directory ranges, 1,045 direct imported-call edges, and 28 selected textual dumps.
• Two independently confirmed injection implementations: a classic LoadLibraryW remote-thread loader and a WOW64 mapper/bootstrap. The protected export-to-engine selection remains unproved.
• A launcher catalog with 34,860 valid exception-directory ranges, 1,246 direct imported-call edges, and 14 selected textual dumps.
• A proved LoadLibraryExW/GetProcAddress path for Inject2 and CancelInject.
• An authenticated offline validation of the local AES-256-GCM cache format, recorded without publishing account, token, nonce, or ciphertext values.

The package does not claim that all 240 handlers have complete human-verified behavioral specifications or that the recovered generated scripts are original TypeScript/C++. Identity, byte boundaries, source paths, and semantic interpretation are separate evidence classes.

Coverage

Evidence class	Recovered	Textual / decompiled
Native handlers	240 / 240 assembly	240 / 240 .asm
V8 functions	5,380 / 5,380 bytecode + catalog	5 selected disasm
Kernel ranges	6,539 valid	28 selected dumps
Launcher ranges	34,860 valid	14 selected dumps
Menu paths	2,829 exact	full inventory

pie showData title V8 function catalog (5,380 total)
    "Named" : 1612
    "Anonymous" : 3768

Loading

Repository layout

• docs/PROVENANCE.md - hashes, evidence sources, and confidence rules.
• docs/BRIDGE_COVERAGE.md - registration and boundary reconciliation.
• docs/SCRIPT_RECOVERY.md - exact script counts, hashes, and recovery limits.
• docs/V8_BYTECODE_RECOVERY.md - V8 bytecode/catalog recovery and the byte-for-byte recompilation proof.
• docs/FEATURE_CLAIM_AUDIT.md - verified feature-by-feature claim matrix.
• docs/MENU_INVENTORY.md - exact menu counts and reconstruction limits.
• docs/FFI_SECURITY_MODEL.md - verified native-call and memory-access paths.
• docs/AUTH_SCOPE.md - what the captures do and do not prove about auth.
• docs/KERNEL_ANALYSIS.md - confirmed kernel engines, subsystems, and limits.
• docs/LAUNCHER_PROTECTION.md - launcher bridge, mitigations, and cache model.
• docs/ASSET_AND_RESEARCH_VECTORS.md - evidence assets and bounded next steps.
• docs/SECURITY_FINDINGS.md - defensive findings and mitigations.
• docs/VERIFICATION.md - completed structural and release-boundary checks.
• docs/REVIEW_RESPONSE.md - measured answer to the "linear-disasm garbage" and "hallucinated from names" objections.
• docs/HANDLER_CATALOG.md - all 240 handler names, RVAs, sizes, and bounds.
• data/handler_catalog.json - machine-readable native handler catalog.
• data/script_source_catalog.json - 377 source-path-to-module mappings.
• data/script_module_catalog.json - metadata for all 552 complete modules.
• data/script_sources.txt - all recovered semantic TypeScript paths.
• data/menu_summary.json and data/menu_paths.txt - exact menu inventory.
• data/kernel_evidence.json and data/launcher_evidence.json - normalized findings, input identities, section metadata, and selected-dump records.
• data/kernel_import_calls.json and data/launcher_import_calls.json - direct imported-call edge catalogs.
• data/kernel_launcher_dump_index.json - integrity records for all 42 new textual dumps.
• data/kernel_ghidra_body_ranges.json - function-body provenance for five expanded kernel listings.
• data/launcher_storage_verification.json - secret-free cryptographic validation metadata.
• v8/catalog_sfi.json - 5,380-function V8 SFI/bytecode catalog.
• v8/bytecode/ - all 5,380 live BytecodeArray blobs.
• v8/disasm/ - textual bytecode disassembly for five selected functions.
• v8/minority-scripts.compileable.v28.js - the recovered compileable source.
• v8/evidence_manifest.json and v8/reproducibility_proof.json - V8 provenance and the byte-for-byte recompilation record.
• dumps/native/ - the 240 textual assembly dumps.
• dumps/helpers/ - five supporting evidence listings.
• dumps/kernel/ and dumps/launcher/ - 28 and 14 selected evidence listings.
• MANIFEST.sha256 - integrity manifest for every other publication file.

Publication boundary

This bundle intentionally excludes raw memory captures, decoded source-map content, DLL/EXE files, session material, request/response logs, credentials, account data, and local analysis tooling. No authorization-bypass patch is included or claimed.

The V8 recovery (v8/) is the deliberate exception to the "no generated bodies" boundary: the compileable script source and the live bytecode set are published because their equivalence to the captured build is proven by byte-for-byte recompilation (v8/reproducibility_proof.json). The identifiers in that source are obfuscated; it is not the original authored TypeScript.

The exact auth/entitlement predicate was not recovered. The package also does not claim a direct native edge from Inject or Inject2 to either visible injection engine, or a proved launcher-side runtime signature check.

The assembly listings are derived textual evidence. Source-image hashes in docs/PROVENANCE.md bind every RVA to the exact analyzed build, while MANIFEST.sha256 binds every published file.

License

Released under the MIT License.