luna/enodia-sentinal
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(go): port memory-map detector tranche

Browse source
This commit is contained in:
Luna 2026-07-11 01:19:56 -07:00
parent c6f7219de8
commit 6a27e6e770
No known key found for this signature in database
13 changed files with 377 additions and 41 deletions
Download patch file Download diff file Expand all files Collapse all files

69
go-agent/internal/detectors/memory_obfuscation_test.go Normal file
View file

@ -0,0 +1,69 @@
// SPDX-License-Identifier: GPL-3.0-or-later
package detectors
import (
"testing"
"codeberg.org/anassaeneroi/enodia-sentinal/go-agent/internal/config"
"codeberg.org/anassaeneroi/enodia-sentinal/go-agent/internal/model"
)
func TestMemoryObfuscationMatchesPythonShapes(t *testing.T) {
cases := []struct {
name string
process model.Process
signature string
severity string
sid int
}{
{"memfd", model.Process{PID: 350, Comm: "hoxha", MemoryMaps: []model.MemoryMap{{
Start: 0x1000, End: 0x2000, Perms: "r-xp", Path: "/memfd:stage (deleted)",
}}}, "memory_obfuscation", "CRITICAL", SIDMemoryObfuscation},
{"anonymous-rwx", model.Process{PID: 351, Comm: "packer", MemoryMaps: []model.MemoryMap{{
Start: 0x3000, End: 0x4000, Perms: "rwxp",
}}}, "memory_obfuscation", "HIGH", SIDMemoryObfuscation},
{"hide-library", model.Process{PID: 352, Comm: "bash", MemoryMaps: []model.MemoryMap{{
Start: 0x5000, End: 0x6000, Perms: "r-xp", Path: "/usr/lib/libhide.so",
}}}, "process_hiding_library", "CRITICAL", SIDProcessHidingLibrary},
{"injection-library", model.Process{PID: 355, Comm: "sshd", MemoryMaps: []model.MemoryMap{{
Start: 0xb000, End: 0xc000, Perms: "r-xp", Path: "/tmp/libinject.so",
}}}, "process_injection_library", "HIGH", SIDProcessInjectionLibrary},
}
for _, tc := range cases {
t.Run(tc.name, func(t *testing.T) {
alerts := MemoryObfuscation(model.State{Processes: []model.Process{tc.process}}, config.Default())
if len(alerts) != 1 {
t.Fatalf("expected one alert, got %#v", alerts)
}
if alerts[0].Signature != tc.signature || alerts[0].Severity != tc.severity || alerts[0].SID != tc.sid {
t.Fatalf("unexpected alert: %#v", alerts[0])
}
})
}
}
func TestMemoryObfuscationAllowlistsMatchPython(t *testing.T) {
cfg := config.Default()
if len(MemoryObfuscation(model.State{Processes: []model.Process{{
PID: 353, Comm: "node", MemoryMaps: []model.MemoryMap{{Perms: "rwxp"}},
}}}, cfg)) != 0 {
t.Fatal("generic executable mapping should honor the runtime allowlist")
}
cfg.MemoryObfuscationAllowPaths = []string{"/tmp/known-profiler/"}
if len(MemoryObfuscation(model.State{Processes: []model.Process{{
PID: 356, Comm: "python3", MemoryMaps: []model.MemoryMap{{
Perms: "r-xp", Path: "/tmp/known-profiler/libhook.so",
}},
}}}, cfg)) != 0 {
t.Fatal("configured mapping path should be silent")
}
alerts := MemoryObfuscation(model.State{Processes: []model.Process{{
PID: 354, Comm: "node", MemoryMaps: []model.MemoryMap{{
Perms: "r-xp", Path: "/tmp/libhide.so",
}},
}}}, config.Default())
if len(alerts) != 1 || alerts[0].Signature != "process_hiding_library" {
t.Fatalf("hide-library evidence must survive comm allowlist: %#v", alerts)
}
}