Add memory obfuscation and ps-hidden process detection

enodia_sentinel/system.py

@@ -86,6 +86,10 @@ class Process:
                 continue
         return out
 
+    @cached_property
+    def memory_maps(self) -> list["MemoryMap"]:
+        return parse_memory_maps(self._read("maps"))
+
     @cached_property
     def status(self) -> dict[str, str]:
         out: dict[str, str] = {}
@@ -118,6 +122,34 @@ class Process:
         return None
 
 
+@dataclass(frozen=True)
+class MemoryMap:
+    start: int
+    end: int
+    perms: str
+    path: str = ""
+
+
+def parse_memory_maps(text: str) -> list[MemoryMap]:
+    maps: list[MemoryMap] = []
+    for line in text.splitlines():
+        parts = line.split(maxsplit=5)
+        if len(parts) < 5:
+            continue
+        addr, perms = parts[0], parts[1]
+        start_s, sep, end_s = addr.partition("-")
+        if not sep:
+            continue
+        try:
+            start = int(start_s, 16)
+            end = int(end_s, 16)
+        except ValueError:
+            continue
+        path = parts[5] if len(parts) == 6 else ""
+        maps.append(MemoryMap(start=start, end=end, perms=perms, path=path))
+    return maps
+
+
 @dataclass(frozen=True)
 class Socket:
     state: str