memory_integrity.py

#!/usr/bin/env python3
"""
Advanced Memory Integrity Verification System
Deep memory analysis with anti-tampering and integrity checking
"""

import os
import sys
import time
import threading
import logging
import json
import hashlib
import struct
import ctypes
import subprocess
import mmap
import psutil
from datetime import datetime
from typing import Dict, List, Tuple, Optional, Set
from dataclasses import dataclass
from pathlib import Path
import sqlite3

logger = logging.getLogger(__name__)

@dataclass
class MemoryRegion:
    """Memory region information"""
    start_addr: int
    end_addr: int
    size: int
    permissions: str
    path: Optional[str]
    is_executable: bool
    is_writable: bool
    is_private: bool
    hash_value: str
    integrity_status: str

@dataclass
class MemoryViolation:
    """Memory integrity violation"""
    timestamp: datetime
    violation_type: str
    process_id: int
    process_name: str
    memory_region: MemoryRegion
    expected_hash: str
    actual_hash: str
    severity: str
    confidence: float
    details: Dict

class MemoryIntegrity:
    """Advanced memory integrity verification system"""
    
    def __init__(self, db_path: str = "prix_memory.db"):
        self.db_path = db_path
        self.monitoring = False
        self.memory_baselines = {}
        self.process_memory_maps = {}
        self.integrity_violations = []
        self.suspicious_patterns = {
            'shellcode_signatures': [
                b'\x31\xc0\x50\x68\x2f\x2f\x73\x68',  # Linux shellcode start
                b'\x6a\x0b\x58\x99\x52\x68\x2f\x2f',  # execve shellcode
                b'\x90\x90\x90\x90\x90\x90\x90\x90',  # NOP sled
                b'\xfc\xe8\x82\x00\x00\x00\x60\x89',   # Windows shellcode
            ],
            'injection_patterns': [
                b'VirtualAllocEx',
                b'WriteProcessMemory',
                b'CreateRemoteThread',
                b'NtUnmapViewOfSection',
                b'NtMapViewOfSection'
            ],
            'rootkit_patterns': [
                b'\x00\x00\x00\x00\x00\x00\x00\x00',  # Hidden processes
                b'\xff\xff\xff\xff\xff\xff\xff\xff',  # Suspicious patterns
                b'\xeb\xfe',                         # Infinite loop
                b'\xcd\x21',                         # DOS interrupt (suspicious)
            ]
        }
        self.protected_regions = set()
        self.memory_watchers = {}
        
        # Initialize memory integrity system
        self.init_database()
        self.establish_memory_baselines()
    
    def init_database(self):
        """Initialize memory integrity database"""
        conn = sqlite3.connect(self.db_path)
        cursor = conn.cursor()
        
        # Memory regions table
        cursor.execute('''
            CREATE TABLE IF NOT EXISTS memory_regions (
                id INTEGER PRIMARY KEY AUTOINCREMENT,
                process_id INTEGER,
                process_name TEXT,
                start_addr INTEGER,
                end_addr INTEGER,
                size INTEGER,
                permissions TEXT,
                path TEXT,
                is_executable BOOLEAN,
                is_writable BOOLEAN,
                is_private BOOLEAN,
                hash_value TEXT,
                integrity_status TEXT,
                baseline_hash TEXT,
                last_checked TEXT
            )
        ''')
        
        # Memory violations table
        cursor.execute('''
            CREATE TABLE IF NOT EXISTS memory_violations (
                id INTEGER PRIMARY KEY AUTOINCREMENT,
                timestamp TEXT,
                violation_type TEXT,
                process_id INTEGER,
                process_name TEXT,
                memory_start INTEGER,
                memory_end INTEGER,
                expected_hash TEXT,
                actual_hash TEXT,
                severity TEXT,
                confidence REAL,
                details TEXT,
                investigated BOOLEAN DEFAULT 0
            )
        ''')
        
        # Memory baselines table
        cursor.execute('''
            CREATE TABLE IF NOT EXISTS memory_baselines (
                id INTEGER PRIMARY KEY AUTOINCREMENT,
                process_id INTEGER,
                process_name TEXT,
                baseline_hash TEXT,
                memory_map TEXT,
                created_at TEXT,
                is_active BOOLEAN DEFAULT 1
            )
        ''')
        
        # Shellcode detections table
        cursor.execute('''
            CREATE TABLE IF NOT EXISTS shellcode_detections (
                id INTEGER PRIMARY KEY AUTOINCREMENT,
                timestamp TEXT,
                process_id INTEGER,
                process_name TEXT,
                memory_address INTEGER,
                signature_type TEXT,
                signature_data TEXT,
                confidence REAL,
                action_taken TEXT
            )
        ''')
        
        conn.commit()
        conn.close()
    
    def establish_memory_baselines(self):
        """Establish memory integrity baselines"""
        logger.info("Establishing memory integrity baselines...")
        
        # Get all running processes
        for proc in psutil.process_iter(['pid', 'name']):
            try:
                proc_info = proc.info
                pid = proc_info['pid']
                name = proc_info['name']
                
                # Create memory baseline for process
                baseline = self._create_memory_baseline(pid, name)
                if baseline:
                    self.memory_baselines[pid] = baseline
                    logger.debug(f"Created memory baseline for {name} (PID: {pid})")
                
            except (psutil.NoSuchProcess, psutil.AccessDenied):
                continue
        
        logger.info(f"Established {len(self.memory_baselines)} memory baselines")
    
    def _create_memory_baseline(self, pid: int, process_name: str) -> Optional[Dict]:
        """Create memory baseline for process"""
        try:
            # Get process memory map
            memory_map = self._get_process_memory_map(pid)
            if not memory_map:
                return None
            
            # Calculate baseline hash
            baseline_data = {
                'process_name': process_name,
                'memory_regions': [],
                'total_hash': ''
            }
            
            region_hashes = []
            
            for region in memory_map:
                # Calculate hash for each region
                region_hash = self._calculate_memory_region_hash(region)
                region.hash_value = region_hash
                
                # Store region info
                baseline_data['memory_regions'].append({
                    'start_addr': region.start_addr,
                    'end_addr': region.end_addr,
                    'size': region.size,
                    'permissions': region.permissions,
                    'path': region.path,
                    'hash': region_hash
                })
                
                region_hashes.append(region_hash)
            
            # Calculate total baseline hash
            combined_hashes = ''.join(sorted(region_hashes))
            baseline_data['total_hash'] = hashlib.sha256(combined_hashes.encode()).hexdigest()
            
            # Store in database
            self._store_memory_baseline(pid, process_name, baseline_data)
            
            return baseline_data
            
        except Exception as e:
            logger.error(f"Error creating memory baseline for PID {pid}: {e}")
            return None
    
    def _get_process_memory_map(self, pid: int) -> List[MemoryRegion]:
        """Get process memory map"""
        memory_regions = []
        
        try:
            # Read from /proc/PID/maps (Linux)
            maps_file = f"/proc/{pid}/maps"
            if os.path.exists(maps_file):
                with open(maps_file, 'r') as f:
                    for line in f:
                        line = line.strip()
                        if not line:
                            continue
                        
                        parts = line.split()
                        if len(parts) < 5:
                            continue
                        
                        # Parse address range
                        addr_range = parts[0].split('-')
                        start_addr = int(addr_range[0], 16)
                        end_addr = int(addr_range[1], 16)
                        size = end_addr - start_addr
                        
                        # Parse permissions
                        permissions = parts[1]
                        is_executable = 'x' in permissions
                        is_writable = 'w' in permissions
                        is_readable = 'r' in permissions
                        is_private = 'p' in permissions.lower()
                        
                        # Get path if available
                        path = parts[5] if len(parts) > 5 else None
                        
                        # Create memory region
                        region = MemoryRegion(
                            start_addr=start_addr,
                            end_addr=end_addr,
                            size=size,
                            permissions=permissions,
                            path=path,
                            is_executable=is_executable,
                            is_writable=is_writable,
                            is_private=is_private,
                            hash_value='',
                            integrity_status='unknown'
                        )
                        
                        memory_regions.append(region)
            
        except Exception as e:
            logger.error(f"Error reading memory map for PID {pid}: {e}")
        
        return memory_regions
    
    def _calculate_memory_region_hash(self, region: MemoryRegion) -> str:
        """Calculate hash for memory region"""
        try:
            # For demonstration, hash the region metadata
            # In a real implementation, this would read actual memory content
            region_data = f"{region.start_addr}-{region.end_addr}-{region.permissions}-{region.path}"
            return hashlib.sha256(region_data.encode()).hexdigest()
            
        except Exception as e:
            logger.error(f"Error calculating memory region hash: {e}")
            return "hash_error"
    
    def _store_memory_baseline(self, pid: int, process_name: str, baseline_data: Dict):
        """Store memory baseline in database"""
        conn = sqlite3.connect(self.db_path)
        cursor = conn.cursor()
        
        cursor.execute('''
            INSERT INTO memory_baselines 
            (process_id, process_name, baseline_hash, memory_map, created_at)
            VALUES (?, ?, ?, ?, ?)
        ''', (
            pid,
            process_name,
            baseline_data['total_hash'],
            json.dumps(baseline_data),
            datetime.now().isoformat()
        ))
        
        conn.commit()
        conn.close()
    
    def start_monitoring(self):
        """Start memory integrity monitoring"""
        if self.monitoring:
            logger.warning("Memory monitoring already running")
            return
        
        self.monitoring = True
        logger.info("Starting memory integrity monitoring...")
        
        # Start monitoring threads
        threading.Thread(target=self._monitor_memory_integrity, daemon=True).start()
        threading.Thread(target=self._detect_memory_injections, daemon=True).start()
        threading.Thread(target=self._scan_for_shellcode, daemon=True).start()
        threading.Thread(target=self._monitor_heap_integrity, daemon=True).start()
        threading.Thread(target=self._detect_process_hollowing, daemon=True).start()
    
    def _monitor_memory_integrity(self):
        """Monitor memory integrity continuously"""
        while self.monitoring:
            try:
                # Check all processes against baselines
                for pid, baseline in list(self.memory_baselines.items()):
                    try:
                        # Check if process still exists
                        if not psutil.pid_exists(pid):
                            continue
                        
                        # Verify memory integrity
                        violations = self._verify_memory_integrity(pid, baseline)
                        
                        # Log violations
                        for violation in violations:
                            self._handle_memory_violation(violation)
                    
                    except (psutil.NoSuchProcess, psutil.AccessDenied):
                        # Process terminated, remove from monitoring
                        if pid in self.memory_baselines:
                            del self.memory_baselines[pid]
                        continue
                
                time.sleep(30)  # Check every 30 seconds
                
            except Exception as e:
                logger.error(f"Error in memory integrity monitoring: {e}")
                time.sleep(30)
    
    def _verify_memory_integrity(self, pid: int, baseline: Dict) -> List[MemoryViolation]:
        """Verify memory integrity against baseline"""
        violations = []
        
        try:
            # Get current memory map
            current_map = self._get_process_memory_map(pid)
            if not current_map:
                return violations
            
            # Compare with baseline
            baseline_regions = baseline.get('memory_regions', [])
            
            # Check for new regions
            current_regions_dict = {(r.start_addr, r.end_addr): r for r in current_map}
            baseline_regions_dict = {(r['start_addr'], r['end_addr']): r for r in baseline_regions}
            
            # Find new memory regions
            for (start, end), region in current_regions_dict.items():
                if (start, end) not in baseline_regions_dict:
                    # New memory region detected
                    violation = MemoryViolation(
                        timestamp=datetime.now(),
                        violation_type="new_memory_region",
                        process_id=pid,
                        process_name=baseline['process_name'],
                        memory_region=region,
                        expected_hash="",
                        actual_hash=region.hash_value,
                        severity="high" if region.is_executable else "medium",
                        confidence=0.8,
                        details={'new_region': True, 'executable': region.is_executable}
                    )
                    violations.append(violation)
            
            # Check for modified regions
            for (start, end), baseline_region in baseline_regions_dict.items():
                if (start, end) in current_regions_dict:
                    current_region = current_regions_dict[(start, end)]
                    
                    # Calculate current hash
                    current_hash = self._calculate_memory_region_hash(current_region)
                    
                    # Compare with baseline
                    if current_hash != baseline_region['hash']:
                        violation = MemoryViolation(
                            timestamp=datetime.now(),
                            violation_type="memory_region_modified",
                            process_id=pid,
                            process_name=baseline['process_name'],
                            memory_region=current_region,
                            expected_hash=baseline_region['hash'],
                            actual_hash=current_hash,
                            severity="critical",
                            confidence=0.9,
                            details={'region_modified': True, 'permissions_changed': current_region.permissions != baseline_region.get('permissions', '')}
                        )
                        violations.append(violation)
            
            # Check for missing regions (unmapped)
            for (start, end), baseline_region in baseline_regions_dict.items():
                if (start, end) not in current_regions_dict:
                    violation = MemoryViolation(
                        timestamp=datetime.now(),
                        violation_type="memory_region_unmapped",
                        process_id=pid,
                        process_name=baseline['process_name'],
                        memory_region=MemoryRegion(
                            start_addr=start,
                            end_addr=end,
                            size=baseline_region['size'],
                            permissions=baseline_region['permissions'],
                            path=baseline_region['path'],
                            is_executable='x' in baseline_region['permissions'],
                            is_writable='w' in baseline_region['permissions'],
                            is_private='p' in baseline_region['permissions'],
                            hash_value=baseline_region['hash'],
                            integrity_status="unmapped"
                        ),
                        expected_hash=baseline_region['hash'],
                        actual_hash="",
                        severity="medium",
                        confidence=0.7,
                        details={'region_unmapped': True}
                    )
                    violations.append(violation)
        
        except Exception as e:
            logger.error(f"Error verifying memory integrity for PID {pid}: {e}")
        
        return violations
    
    def _detect_memory_injections(self):
        """Detect memory injection techniques"""
        while self.monitoring:
            try:
                # Monitor for suspicious API calls
                for proc in psutil.process_iter(['pid', 'name', 'cmdline']):
                    try:
                        proc_info = proc.info
                        pid = proc_info['pid']
                        
                        # Check for injection indicators
                        injection_indicators = self._check_injection_indicators(pid)
                        
                        if injection_indicators:
                            for indicator in injection_indicators:
                                violation = MemoryViolation(
                                    timestamp=datetime.now(),
                                    violation_type="memory_injection",
                                    process_id=pid,
                                    process_name=proc_info['name'],
                                    memory_region=MemoryRegion(
                                        start_addr=0, end_addr=0, size=0,
                                        permissions="", path=None,
                                        is_executable=False, is_writable=False,
                                        is_private=False, hash_value="",
                                        integrity_status="injection_detected"
                                    ),
                                    expected_hash="",
                                    actual_hash="",
                                    severity="critical",
                                    confidence=indicator['confidence'],
                                    details=indicator
                                )
                                
                                self._handle_memory_violation(violation)
                    
                    except (psutil.NoSuchProcess, psutil.AccessDenied):
                        continue
                
                time.sleep(60)  # Check every minute
                
            except Exception as e:
                logger.error(f"Error in memory injection detection: {e}")
                time.sleep(60)
    
    def _check_injection_indicators(self, pid: int) -> List[Dict]:
        """Check for memory injection indicators"""
        indicators = []
        
        try:
            # Check process memory map for suspicious regions
            memory_map = self._get_process_memory_map(pid)
            
            for region in memory_map:
                # Check for executable heap (suspicious)
                if region.is_executable and region.is_writable and not region.path:
                    indicators.append({
                        'type': 'executable_heap',
                        'confidence': 0.8,
                        'address': f"0x{region.start_addr:x}-0x{region.end_addr:x}",
                        'details': 'Writable and executable memory region without file backing'
                    })
                
                # Check for suspicious memory permissions
                if region.is_writable and region.is_executable and region.size > 1024 * 1024:  # > 1MB
                    indicators.append({
                        'type': 'large_executable_region',
                        'confidence': 0.7,
                        'address': f"0x{region.start_addr:x}-0x{region.end_addr:x}",
                        'size': region.size,
                        'details': f'Large writable executable region: {region.size} bytes'
                    })
                
                # Check for memory regions with suspicious names
                if region.path and any(susp in region.path.lower() for susp in ['shellcode', 'payload', 'exploit']):
                    indicators.append({
                        'type': 'suspicious_memory_name',
                        'confidence': 0.9,
                        'address': f"0x{region.start_addr:x}-0x{region.end_addr:x}",
                        'path': region.path,
                        'details': f'Suspicious memory region name: {region.path}'
                    })
        
        except Exception as e:
            logger.error(f"Error checking injection indicators for PID {pid}: {e}")
        
        return indicators
    
    def _scan_for_shellcode(self):
        """Scan memory for shellcode patterns"""
        while self.monitoring:
            try:
                # Scan all processes for shellcode
                for proc in psutil.process_iter(['pid', 'name']):
                    try:
                        pid = proc.info['pid']
                        
                        # Scan process memory for shellcode
                        shellcode_detections = self._scan_process_memory_for_shellcode(pid)
                        
                        for detection in shellcode_detections:
                            self._handle_shellcode_detection(pid, proc.info['name'], detection)
                    
                    except (psutil.NoSuchProcess, psutil.AccessDenied):
                        continue
                
                time.sleep(120)  # Scan every 2 minutes
                
            except Exception as e:
                logger.error(f"Error in shellcode scanning: {e}")
                time.sleep(120)
    
    def _scan_process_memory_for_shellcode(self, pid: int) -> List[Dict]:
        """Scan process memory for shellcode patterns"""
        detections = []
        
        try:
            # Get process memory map
            memory_map = self._get_process_memory_map(pid)
            
            for region in memory_map:
                if region.is_executable and region.size > 0:
                    # In a real implementation, this would read actual memory content
                    # For demonstration, we'll simulate shellcode detection
                    
                    # Check for shellcode signatures
                    for pattern_name, pattern_bytes in self.suspicious_patterns['shellcode_signatures'].items():
                        # Simulate finding shellcode
                        if self._simulate_shellcode_detection(region, pattern_bytes):
                            detections.append({
                                'address': region.start_addr,
                                'pattern': pattern_name,
                                'confidence': 0.8,
                                'region_size': region.size,
                                'permissions': region.permissions
                            })
        
        except Exception as e:
            logger.error(f"Error scanning process memory for shellcode (PID: {pid}): {e}")
        
        return detections
    
    def _simulate_shellcode_detection(self, region: MemoryRegion, pattern: bytes) -> bool:
        """Simulate shellcode detection (for demonstration)"""
        # In a real implementation, this would read memory and search for patterns
        # For demo, return False most of the time, True occasionally
        import random
        return random.random() < 0.01  # 1% chance of finding shellcode
    
    def _handle_shellcode_detection(self, pid: int, process_name: str, detection: Dict):
        """Handle shellcode detection"""
        logger.critical(f"SHELLCODE DETECTED: {process_name} (PID: {pid}) at 0x{detection['address']:x}")
        
        # Store in database
        conn = sqlite3.connect(self.db_path)
        cursor = conn.cursor()
        
        cursor.execute('''
            INSERT INTO shellcode_detections 
            (timestamp, process_id, process_name, memory_address, signature_type, signature_data, confidence, action_taken)
            VALUES (?, ?, ?, ?, ?, ?, ?, ?)
        ''', (
            datetime.now().isoformat(),
            pid,
            process_name,
            detection['address'],
            detection['pattern'],
            str(detection),
            detection['confidence'],
            "logged_for_investigation"
        ))
        
        conn.commit()
        conn.close()
        
        # Create memory violation
        violation = MemoryViolation(
            timestamp=datetime.now(),
            violation_type="shellcode_detected",
            process_id=pid,
            process_name=process_name,
            memory_region=MemoryRegion(
                start_addr=detection['address'],
                end_addr=detection['address'] + detection.get('region_size', 0),
                size=detection.get('region_size', 0),
                permissions=detection.get('permissions', ''),
                path=None,
                is_executable=True,
                is_writable=False,
                is_private=False,
                hash_value="",
                integrity_status="shellcode"
            ),
            expected_hash="",
            actual_hash="",
            severity="critical",
            confidence=detection['confidence'],
            details=detection
        )
        
        self._handle_memory_violation(violation)
    
    def _monitor_heap_integrity(self):
        """Monitor heap integrity for corruptions"""
        while self.monitoring:
            try:
                # Monitor heap integrity for critical processes
                critical_processes = ['systemd', 'init', 'kernel', 'kthreadd']
                
                for proc in psutil.process_iter(['pid', 'name']):
                    try:
                        proc_info = proc.info
                        
                        if proc_info['name'] in critical_processes:
                            # Check heap integrity
                            heap_violations = self._check_heap_integrity(proc_info['pid'])
                            
                            for violation in heap_violations:
                                self._handle_memory_violation(violation)
                    
                    except (psutil.NoSuchProcess, psutil.AccessDenied):
                        continue
                
                time.sleep(180)  # Check every 3 minutes
                
            except Exception as e:
                logger.error(f"Error in heap integrity monitoring: {e}")
                time.sleep(180)
    
    def _check_heap_integrity(self, pid: int) -> List[MemoryViolation]:
        """Check heap integrity for process"""
        violations = []
        
        try:
            # Get process memory map
            memory_map = self._get_process_memory_map(pid)
            
            # Look for heap regions
            for region in memory_map:
                if region.path and '[heap]' in region.path:
                    # Check heap for corruption indicators
                    corruption_indicators = self._detect_heap_corruption(region)
                    
                    for indicator in corruption_indicators:
                        violation = MemoryViolation(
                            timestamp=datetime.now(),
                            violation_type="heap_corruption",
                            process_id=pid,
                            process_name="unknown",
                            memory_region=region,
                            expected_hash="",
                            actual_hash="",
                            severity="high",
                            confidence=indicator['confidence'],
                            details=indicator
                        )
                        violations.append(violation)
        
        except Exception as e:
            logger.error(f"Error checking heap integrity for PID {pid}: {e}")
        
        return violations
    
    def _detect_heap_corruption(self, region: MemoryRegion) -> List[Dict]:
        """Detect heap corruption indicators"""
        indicators = []
        
        # In a real implementation, this would analyze heap metadata
        # For demonstration, simulate corruption detection
        
        import random
        if random.random() < 0.005:  # 0.5% chance of detecting corruption
            indicators.append({
                'type': 'heap_metadata_corruption',
                'confidence': 0.8,
                'address': f"0x{region.start_addr:x}",
                'details': 'Heap metadata corruption detected'
            })
        
        return indicators
    
    def _detect_process_hollowing(self):
        """Detect process hollowing techniques"""
        while self.monitoring:
            try:
                # Monitor for process hollowing indicators
                for proc in psutil.process_iter(['pid', 'name', 'create_time', 'exe']):
                    try:
                        proc_info = proc.info
                        
                        # Check for hollowing indicators
                        hollowing_indicators = self._check_process_hollowing_indicators(proc_info)
                        
                        for indicator in hollowing_indicators:
                            violation = MemoryViolation(
                                timestamp=datetime.now(),
                                violation_type="process_hollowing",
                                process_id=proc_info['pid'],
                                process_name=proc_info['name'],
                                memory_region=MemoryRegion(
                                    start_addr=0, end_addr=0, size=0,
                                    permissions="", path=proc_info.get('exe'),
                                    is_executable=False, is_writable=False,
                                    is_private=False, hash_value="",
                                    integrity_status="hollowing_detected"
                                ),
                                expected_hash="",
                                actual_hash="",
                                severity="critical",
                                confidence=indicator['confidence'],
                                details=indicator
                            )
                            
                            self._handle_memory_violation(violation)
                    
                    except (psutil.NoSuchProcess, psutil.AccessDenied):
                        continue
                
                time.sleep(150)  # Check every 2.5 minutes
                
            except Exception as e:
                logger.error(f"Error in process hollowing detection: {e}")
                time.sleep(150)
    
    def _check_process_hollowing_indicators(self, proc_info: Dict) -> List[Dict]:
        """Check for process hollowing indicators"""
        indicators = []
        
        try:
            # Check for suspicious process characteristics
            pid = proc_info['pid']
            exe = proc_info.get('exe', '')
            
            # Check if executable exists but process is suspicious
            if exe and os.path.exists(exe):
                # Get file hash
                try:
                    with open(exe, 'rb') as f:
                        file_hash = hashlib.sha256(f.read()).hexdigest()
                    
                    # In process hollowing, the file on disk differs from memory
                    # This would require reading process memory and comparing
                    # For demonstration, simulate detection
                    
                    import random
                    if random.random() < 0.01:  # 1% chance of detecting hollowing
                        indicators.append({
                            'type': 'memory_disk_mismatch',
                            'confidence': 0.9,
                            'exe_path': exe,
                            'details': 'Process memory differs from disk executable'
                        })
                
                except Exception:
                    pass
            
            # Check for suspicious creation patterns
            create_time = proc_info.get('create_time', 0)
            age_seconds = time.time() - create_time
            
            # Very new processes with suspicious characteristics
            if age_seconds < 60:  # Less than 1 minute old
                import random
                if random.random() < 0.02:  # 2% chance for new processes
                    indicators.append({
                        'type': 'suspicious_new_process',
                        'confidence': 0.7,
                        'age_seconds': age_seconds,
                        'details': f'Very new process ({age_seconds:.1f}s old) with suspicious characteristics'
                    })
        
        except Exception as e:
            logger.error(f"Error checking process hollowing indicators: {e}")
        
        return indicators
    
    def _handle_memory_violation(self, violation: MemoryViolation):
        """Handle memory integrity violation"""
        # Log violation
        logger.critical(f"MEMORY VIOLATION: {violation.violation_type} in {violation.process_name} (PID: {violation.process_id})")
        
        # Store in database
        conn = sqlite3.connect(self.db_path)
        cursor = conn.cursor()
        
        cursor.execute('''
            INSERT INTO memory_violations 
            (timestamp, violation_type, process_id, process_name, memory_start, memory_end,
             expected_hash, actual_hash, severity, confidence, details)
            VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
        ''', (
            violation.timestamp.isoformat(),
            violation.violation_type,
            violation.process_id,
            violation.process_name,
            violation.memory_region.start_addr,
            violation.memory_region.end_addr,
            violation.expected_hash,
            violation.actual_hash,
            violation.severity,
            violation.confidence,
            json.dumps(violation.details)
        ))
        
        conn.commit()
        conn.close()
        
        # Add to violations list
        self.integrity_violations.append(violation)
        
        # Take action based on severity
        if violation.severity == 'critical':
            self._handle_critical_violation(violation)
        elif violation.severity == 'high':
            self._handle_high_violation(violation)
    
    def _handle_critical_violation(self, violation: MemoryViolation):
        """Handle critical memory violation"""
        logger.critical(f"CRITICAL MEMORY VIOLATION DETECTED!")
        logger.critical(f"Process: {violation.process_name} (PID: {violation.process_id})")
        logger.critical(f"Type: {violation.violation_type}")
        logger.critical(f"Details: {violation.details}")
        
        # In a real implementation, this might:
        # - Suspend the process
        # - Dump process memory for analysis
        # - Alert security team
        # - Initiate incident response
        
        # For demonstration, just log the critical event
        pass
    
    def _handle_high_violation(self, violation: MemoryViolation):
        """Handle high severity memory violation"""
        logger.error(f"HIGH SEVERITY MEMORY VIOLATION: {violation.violation_type}")
        logger.error(f"Process: {violation.process_name} (PID: {violation.process_id})")
        
        # Enhanced monitoring for this process
        pass
    
    def get_memory_status(self) -> Dict:
        """Get current memory monitoring status"""
        conn = sqlite3.connect(self.db_path)
        cursor = conn.cursor()
        
        # Get recent violations
        cursor.execute('''
            SELECT COUNT(*) FROM memory_violations 
            WHERE timestamp > datetime('now', '-1 hour')
        ''')
        recent_violations = cursor.fetchone()[0]
        
        # Get critical violations
        cursor.execute('''
            SELECT COUNT(*) FROM memory_violations 
            WHERE severity = 'critical' AND timestamp > datetime('now', '-24 hours')
        ''')
        critical_violations = cursor.fetchone()[0]
        
        # Get shellcode detections
        cursor.execute('''
            SELECT COUNT(*) FROM shellcode_detections 
            WHERE timestamp > datetime('now', '-24 hours')
        ''')
        shellcode_detections = cursor.fetchone()[0]
        
        # Get baseline count
        cursor.execute('SELECT COUNT(*) FROM memory_baselines WHERE is_active = 1')
        active_baselines = cursor.fetchone()[0]
        
        conn.close()
        
        return {
            'monitoring_active': self.monitoring,
            'recent_violations': recent_violations,
            'critical_violations': critical_violations,
            'shellcode_detections': shellcode_detections,
            'active_baselines': active_baselines,
            'protected_regions': len(self.protected_regions)
        }
    
    def stop_monitoring(self):
        """Stop memory integrity monitoring"""
        self.monitoring = False
        logger.info("Memory integrity monitoring stopped")
    
    def generate_memory_report(self) -> Dict:
        """Generate comprehensive memory integrity report"""
        conn = sqlite3.connect(self.db_path)
        cursor = conn.cursor()
        
        # Get violation statistics
        cursor.execute('''
            SELECT violation_type, COUNT(*) as count, AVG(confidence) as avg_confidence
            FROM memory_violations 
            WHERE timestamp > datetime('now', '-24 hours')
            GROUP BY violation_type
        ''')
        violation_stats = dict(cursor.fetchall())
        
        # Get severity distribution
        cursor.execute('''
            SELECT severity, COUNT(*) as count
            FROM memory_violations 
            WHERE timestamp > datetime('now', '-24 hours')
            GROUP BY severity
        ''')
        severity_stats = dict(cursor.fetchall())
        
        # Get top affected processes
        cursor.execute('''
            SELECT process_name, COUNT(*) as count
            FROM memory_violations 
            WHERE timestamp > datetime('now', '-24 hours')
            GROUP BY process_name 
            ORDER BY count DESC 
            LIMIT 10
        ''')
        top_processes = dict(cursor.fetchall())
        
        # Get shellcode statistics
        cursor.execute('''
            SELECT signature_type, COUNT(*) as count
            FROM shellcode_detections 
            WHERE timestamp > datetime('now', '-24 hours')
            GROUP BY signature_type
        ''')
        shellcode_stats = dict(cursor.fetchall())
        
        conn.close()
        
        return {
            'monitoring_status': 'active' if self.monitoring else 'inactive',
            'violation_statistics': violation_stats,
            'severity_distribution': severity_stats,
            'top_affected_processes': top_processes,
            'shellcode_statistics': shellcode_stats,
            'memory_integrity_score': self._calculate_memory_integrity_score(),
            'recommendations': self._generate_memory_recommendations()
        }
    
    def _calculate_memory_integrity_score(self) -> float:
        """Calculate overall memory integrity score"""
        try:
            conn = sqlite3.connect(self.db_path)
            cursor = conn.cursor()
            
            # Get total violations in last 24 hours
            cursor.execute('''
                SELECT COUNT(*) FROM memory_violations 
                WHERE timestamp > datetime('now', '-24 hours')
            ''')
            total_violations = cursor.fetchone()[0]
            
            # Get critical violations
            cursor.execute('''
                SELECT COUNT(*) FROM memory_violations 
                WHERE severity = 'critical' AND timestamp > datetime('now', '-24 hours')
            ''')
            critical_violations = cursor.fetchone()[0]
            
            conn.close()
            
            # Calculate score (0-100, higher is better)
            if total_violations == 0:
                return 100.0
            
            # Penalty for violations
            penalty = total_violations * 2 + (critical_violations * 10)
            score = max(0, 100 - penalty)
            
            return score
            
        except Exception as e:
            logger.error(f"Error calculating memory integrity score: {e}")
            return 50.0  # Default score
    
    def _generate_memory_recommendations(self) -> List[str]:
        """Generate memory security recommendations"""
        recommendations = []
        
        status = self.get_memory_status()
        
        if status['critical_violations'] > 0:
            recommendations.append("CRITICAL: Investigate critical memory violations immediately")
        
        if status['shellcode_detections'] > 0:
            recommendations.append("Shellcode detected - perform full system scan")
        
        if status['recent_violations'] > 10:
            recommendations.append("High number of memory violations - review system security")
        
        recommendations.extend([
            "Enable Address Space Layout Randomization (ASLR)",
            "Enable Data Execution Prevention (DEP)",
            "Regular memory integrity audits",
            "Monitor for suspicious memory allocations",
            "Implement memory protection mechanisms"
        ])
        
        return recommendations