Skip to content

Improve encryption detection and fix display issues#5

Open
IonTibirna wants to merge 2 commits intomainfrom
improve-encryption-detection
Open

Improve encryption detection and fix display issues#5
IonTibirna wants to merge 2 commits intomainfrom
improve-encryption-detection

Conversation

@IonTibirna
Copy link
Collaborator

Changes

Encryption Detection

  • Replace heuristic-based detection with Linux kernel banner check
  • More reliable method to determine if memory is encrypted

Bug Fixes

  • Increase chunk overlap from 1KB to 8KB (prevents missing matches at boundaries)
  • Add regex pattern validation before compilation
  • Fix table alignment with ANSI-aware padding
  • Improve progress bar cleanup in dump command

UX Improvements

  • Add clearer messaging for different attack scenarios

- Replace heuristic encryption detection with Linux kernel banner check
- Increase chunk overlap from 1KB to 8KB to prevent missing matches at boundaries
- Add regex pattern validation before compilation
- Fix table alignment with ANSI-aware padding
- Improve progress bar cleanup in dump command
- Add clearer messaging for different attack scenarios
Replace direct virsh/libvirt calls with pluggable backend system.
Add procmem backend that scans /proc/*/cmdline for QEMU processes.
This enables VM detection on systems where libvirt is not used
(e.g., Kata Containers, direct QEMU).

Changes:
- New pkg/backend/ package with Backend interface and registry
- Three backends: procmem (primary), libvirt, qemu (QMP)
- Auto-detection selects best available backend
- Memory dump via /proc/pid/mem instead of virsh dump
- SEV-SNP detection from QEMU command line flags
- Improved search output with before/after context
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant