fixes regarding the latest changes in the specification; add now the possibility to change the blake3 hash

Author: monkeywave

README.md

@@ -1,7 +1,7 @@
 # MemSlicer
 
 [![Python](https://img.shields.io/badge/python-%3E%3D3.10-blue)](https://www.python.org/)
-[![Version](https://img.shields.io/badge/version-0.2.6-green)](pyproject.toml)
+[![Version](https://img.shields.io/badge/version-0.2.7-green)](pyproject.toml)
 
 A memory acquisition tool that captures process memory snapshots into the MSL (Memory Slice) binary format. Supports multiple debugger backends (Frida, GDB, LLDB) and targets across Windows, Linux, macOS, Android, and iOS. Designed for forensic analysis, reverse engineering, and security research.
 
@@ -37,7 +37,7 @@ This installs memslicer with all backends (Frida, GDB, LLDB).
 ### From Source
 
 ```bash
-git clone https://github.com/danielbaier/memslicer.git
+git clone git@github.com:MemorySlice/memslicer.git
 cd memslicer
 pip install -e .
 ```
@@ -318,7 +318,7 @@ src/memslicer/
 ### Setup
 
 ```bash
-git clone https://github.com/danielbaier/memslicer.git
+git clone git@github.com:MemorySlice/memslicer.git
 cd memslicer
 pip install -e ".[dev]"
 ```

pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "memslicer"
-version = "0.2.6"
+version = "0.2.7"
 description = "MSL memory dump tool with pluggable debugger backends (Frida, GDB, LLDB)"
 requires-python = ">= 3.10"
 license = "Apache-2.0"

src/memslicer/acquirer/build_id_post.py

@@ -21,12 +21,12 @@
 """
 from __future__ import annotations
 
-import hashlib
 import logging
 from typing import Iterable, Protocol
 
 from memslicer.acquirer.elf_notes import extract_build_id
-from memslicer.msl.constants import PageState
+from memslicer.msl.constants import HashAlgo, PageState
+from memslicer.msl.integrity import make_hasher
 from memslicer.msl.types import MemoryRegion, ModuleEntry
 
 
@@ -110,6 +110,7 @@ def populate_from_bridge(
     entries: list[ModuleEntry],
     bridge: BridgeProtocol,
     logger: logging.Logger | None = None,
+    hash_algo: HashAlgo = HashAlgo.BLAKE3,
 ) -> list[ModuleEntry]:
     """Path A: live extraction via ``bridge.read_memory``.
 
@@ -139,7 +140,7 @@ def populate_from_bridge(
                 entry.path, entry.base_addr,
             )
             continue
-        _apply_extraction(entry, data, source_id=SOURCE_BRIDGE, log=log)
+        _apply_extraction(entry, data, source_id=SOURCE_BRIDGE, log=log, hash_algo=hash_algo)
     return entries
 
 
@@ -148,6 +149,7 @@ def populate_from_regions(
     captured_regions: Iterable[MemoryRegion],
     logger: logging.Logger | None = None,
     source_id: int = SOURCE_CAPTURED_REGION,
+    hash_algo: HashAlgo = HashAlgo.BLAKE3,
 ) -> list[ModuleEntry]:
     """Paths B and C: extract from already-captured ``MemoryRegion`` data.
 
@@ -180,7 +182,7 @@ def populate_from_regions(
                 entry.path, entry.base_addr,
             )
             continue
-        _apply_extraction(entry, data, source_id=source_id, log=log)
+        _apply_extraction(entry, data, source_id=source_id, log=log, hash_algo=hash_algo)
     return entries
 
 
@@ -189,14 +191,16 @@ def _apply_extraction(
     data: bytes,
     source_id: int,
     log: logging.Logger,
+    hash_algo: HashAlgo = HashAlgo.BLAKE3,
 ) -> None:
-    """Run the ELF parser + SHA-256 and populate ``entry`` in place.
+    """Run the ELF parser and populate ``entry`` in place.
 
     ``native_blob`` always ends up set (possibly with a zero-length
     build-id when extraction failed); ``disk_hash`` is always the
-    SHA-256 of the bytes we read, regardless of whether the parser
-    recognised them. Both fields serve as collision-resistant anchors
-    for downstream symbol lookup even when the build-id is missing.
+    hash (using the file's selected ``HashAlgo``) of the bytes we
+    read, regardless of whether the parser recognised them. Both
+    fields serve as collision-resistant anchors for downstream symbol
+    lookup even when the build-id is missing.
     """
     if len(data) < 64:
         return
@@ -212,7 +216,9 @@ def _apply_extraction(
         build_id, _ = result
 
     entry.native_blob = _encode_native_blob(build_id, source_id, flags)
-    entry.disk_hash = hashlib.sha256(data).digest()
+    h = make_hasher(hash_algo)
+    h.update(data)
+    entry.disk_hash = h.digest()
 
 
 __all__ = (

src/memslicer/acquirer/engine.py

@@ -17,7 +17,7 @@
 from memslicer.acquirer.os_detail import pack_os_detail, system_info_to_fields
 from memslicer.acquirer.region_filter import RegionFilter
 from memslicer.msl.constants import (
-    CompAlgo, OSType, PageState, RegionType, CapBit,
+    CompAlgo, HashAlgo, OSType, PageState, RegionType, CapBit,
     Endianness, VERSION, HASH_SIZE, FLAG_INVESTIGATION, FLAG_ENCRYPTED,
 )
 from memslicer.msl.types import (
@@ -245,9 +245,11 @@ def __init__(
         collector: InvestigationCollector | None = None,
         *,
         attribution: AttributionConfig | None = None,
+        hash_algo: HashAlgo = HashAlgo.BLAKE3,
     ) -> None:
         self._bridge = bridge
         self._comp_algo = comp_algo
+        self._hash_algo = hash_algo
         self._filter = region_filter or RegionFilter()
         self._os_override = os_override
         self._abort = threading.Event()
@@ -349,13 +351,14 @@ def acquire(self, output_path: Path | str) -> AcquireResult:
             # ``include_module_build_ids`` — the default acquire path
             # produces lean ModuleEntry blocks without build-ids so
             # that a minimal process-centric slice does not pay for
-            # per-module bridge reads and SHA-256 work. Operators who
+            # per-module bridge reads and hash work. Operators who
             # need build-ids either pass the flag or run
             # ``memslicer-enrich`` on the finished slice (Path C).
             if module_entries and self._attribution.include_module_build_ids:
                 try:
                     populate_from_bridge(
                         module_entries, self._bridge, logger=self._log,
+                        hash_algo=self._hash_algo,
                     )
                 except Exception as exc:  # noqa: BLE001
                     self._log.warning(
@@ -392,6 +395,7 @@ def acquire(self, output_path: Path | str) -> AcquireResult:
                 os_type=os_type,
                 arch_type=arch_type,
                 pid=pid,
+                hash_algo=self._hash_algo,
             )
 
             with open(output_path, "wb") as f:

src/memslicer/cli.py

@@ -15,7 +15,7 @@
     validate_attribution,
 )
 from memslicer.acquirer.region_filter import RegionFilter, SKIP_REASON_LABELS
-from memslicer.msl.constants import CompAlgo, OSType
+from memslicer.msl.constants import CompAlgo, HashAlgo, OSType
 from memslicer.utils.protection import parse_protection
 
 
@@ -161,6 +161,7 @@ def _create_acquirer(
     investigation: bool = False,
     passphrase: str | None = None,
     attribution=None,
+    hash_algo: HashAlgo = HashAlgo.BLAKE3,
 ):
     """Factory to create the appropriate acquirer for the selected backend."""
     from memslicer.acquirer.engine import AcquisitionEngine
@@ -246,6 +247,7 @@ def _create_acquirer(
         passphrase=passphrase,
         collector=collector,
         attribution=attribution,
+        hash_algo=hash_algo,
     )
 
 
@@ -267,10 +269,11 @@ def _create_acquirer(
 @click.option("--encrypt", "-E", is_flag=True, default=False, help="Enable AEAD encryption")
 @click.option("--no-encrypt", is_flag=True, default=False, help="Disable encryption (overrides investigation default)")
 @click.option("--passphrase", default=None, help="Encryption passphrase (prompted if --encrypt and not provided)")
+@click.option("--hash-algo", "hash_algo_str", type=click.Choice(["blake3", "sha256", "sha512-256"]), default="blake3", help="Integrity hash algorithm (default: blake3)")
 @attribution_options
 def cli(target, backend, output_path, comp, usb, remote_addr, os_override, filter_prot, filter_addr,
         verbose, read_timeout, include_unreadable, max_region_size, investigation,
-        encrypt, no_encrypt, passphrase,
+        encrypt, no_encrypt, passphrase, hash_algo_str,
         examiner, case_ref, hostname_override, domain_override,
         include_serials, include_network_identity, include_fingerprint,
         include_kernel_symbols, include_kernel_modules,
@@ -340,6 +343,10 @@ def cli(target, backend, output_path, comp, usb, remote_addr, os_override, filte
     comp_map = {"none": CompAlgo.NONE, "zstd": CompAlgo.ZSTD, "lz4": CompAlgo.LZ4}
     comp_algo = comp_map[comp]
 
+    # Parse hash algorithm
+    hash_algo_map = {"blake3": HashAlgo.BLAKE3, "sha256": HashAlgo.SHA256, "sha512-256": HashAlgo.SHA512_256}
+    hash_algo = hash_algo_map[hash_algo_str]
+
     # Parse OS override
     os_map = {"windows": OSType.Windows, "linux": OSType.Linux, "macos": OSType.macOS, "android": OSType.Android, "ios": OSType.iOS}
     os_ovr = os_map.get(os_override) if os_override else None
@@ -414,6 +421,7 @@ def progress(regions_captured, total_ranges, bytes_cap, modules, regions_process
         investigation=investigation,
         passphrase=passphrase if use_encryption else None,
         attribution=attribution,
+        hash_algo=hash_algo,
     )
     acquirer.set_progress_callback(progress)
 

src/memslicer/cli_enrich.py

@@ -58,9 +58,10 @@
     HEADER_SIZE,
     BlockType,
     CompAlgo,
+    HashAlgo,
     PageState,
 )
-from memslicer.msl.iterator import iterate_blocks
+from memslicer.msl.iterator import iterate_blocks, read_hash_algo
 from memslicer.msl.types import (
     FileHeader,
     MemoryRegion,
@@ -215,10 +216,10 @@ def _extract_blob_fields(native_blob: bytes) -> tuple[int, int, int, bytes]:
 
 def _load_slice(
     slice_path: Path,
-) -> tuple[list[ModuleEntry], list[MemoryRegion], int]:
-    """Read modules, regions, and the EoC start offset from a slice.
+) -> tuple[list[ModuleEntry], list[MemoryRegion], int, HashAlgo]:
+    """Read modules, regions, the EoC start offset, and hash algo from a slice.
 
-    Returns ``(modules, regions, eoc_start_offset)``. Raises
+    Returns ``(modules, regions, eoc_start_offset, hash_algo)``. Raises
     :class:`FileNotFoundError` / :class:`ValueError` on missing or
     malformed files.
     """
@@ -227,6 +228,7 @@ def _load_slice(
     eoc_start: int | None = None
 
     with open(slice_path, "rb") as f:
+        hash_algo = read_hash_algo(f)
         for block in iterate_blocks(f):
             if block.block_type == BlockType.ModuleEntry:
                 modules.append(_parse_module_entry_minimal(block.payload))
@@ -241,7 +243,7 @@ def _load_slice(
             f"cannot determine where to append the manifest"
         )
 
-    return modules, regions, eoc_start
+    return modules, regions, eoc_start, hash_algo
 
 
 def _build_manifest_rows(modules: list[ModuleEntry]) -> list[ModuleBuildIdRow]:
@@ -359,7 +361,7 @@ def main(slice_path: Path, output: Path | None, in_place: bool) -> None:
         output = slice_path.with_suffix(slice_path.suffix + ".enriched")
 
     try:
-        modules, regions, eoc_start = _load_slice(slice_path)
+        modules, regions, eoc_start, hash_algo = _load_slice(slice_path)
     except ValueError as exc:
         click.echo(f"error: {exc}", err=True)
         sys.exit(2)
@@ -381,6 +383,7 @@ def main(slice_path: Path, output: Path | None, in_place: bool) -> None:
         regions,
         source_id=SOURCE_RETROACTIVE,
         logger=_log,
+        hash_algo=hash_algo,
     )
 
     rows = _build_manifest_rows(unpopulated)

src/memslicer/msl/constants.py

@@ -173,3 +173,17 @@ class ClockSource(IntEnum):
     QueryPerformanceCounter = 0x03
     mach_absolute_time = 0x04
     Other = 0xFF
+
+
+class HashAlgo(IntEnum):
+    """Integrity hash algorithm selector (spec Section 4.4, Table 12).
+
+    Applies to PrevHash, EoC FileHash, and Module Entry DiskHash.
+    All registered algorithms produce 32-byte output.
+    KDF always uses HKDF-BLAKE3 regardless of this setting.
+    """
+
+    BLAKE3 = 0x00       # Default.  High throughput via tree hashing and SIMD.
+    SHA256 = 0x01       # FIPS 180-4.  HW-accelerated on Intel SHA-NI / AMD Zen / ARMv8 CE.
+    SHA512_256 = 0x02   # FIPS 180-4.  Truncated SHA-512 with distinct IVs; fast on 64-bit w/o SHA-NI.
+    OTHER = 0xFF        # Non-standard; interpretation out of scope.

src/memslicer/msl/integrity.py

@@ -1,20 +1,50 @@
-"""BLAKE3-based integrity chain for MSL files."""
+"""Integrity hash chain for MSL files.
+
+Supports BLAKE3 (default), SHA-256, and SHA-512/256 as selected by
+the ``HashAlgo`` field in the file header (spec Section 4.4).
+"""
+from __future__ import annotations
+
+import hashlib
+
 import blake3
 
+from memslicer.msl.constants import HashAlgo
+
+
+def make_hasher(algo: HashAlgo):
+    """Return a new hash object for the given algorithm.
+
+    The returned object exposes ``.update(data)`` and ``.digest()``
+    (32-byte output for all registered algorithms).
+    """
+    if algo == HashAlgo.BLAKE3:
+        return blake3.blake3()
+    if algo == HashAlgo.SHA256:
+        return hashlib.sha256()
+    if algo == HashAlgo.SHA512_256:
+        return hashlib.new("sha512_256")
+    raise ValueError(f"unsupported integrity hash algorithm: {algo!r}")
+
 
 class IntegrityChain:
-    """Maintains a rolling BLAKE3 hash chain across MSL blocks.
+    """Maintains a rolling hash chain across MSL blocks.
 
     The chain works as follows:
     - feed_header(header_bytes) hashes the file header, returns digest for Block 0's PrevHash
     - feed_block(block_bytes) hashes a complete block, returns digest for next block's PrevHash
     - prev_hash property returns current PrevHash value for next block
-    - finalize() returns running BLAKE3 digest of entire file (for EoC FileHash)
+    - finalize() returns running digest of entire file (for EoC FileHash)
     """
 
-    def __init__(self) -> None:
+    def __init__(self, hash_algo: HashAlgo = HashAlgo.BLAKE3) -> None:
+        self._hash_algo = hash_algo
         self._prev_hash: bytes = b'\x00' * 32
-        self._file_hasher = blake3.blake3()
+        self._file_hasher = make_hasher(hash_algo)
+
+    def _new_hasher(self):
+        """Create a fresh per-block hasher."""
+        return make_hasher(self._hash_algo)
 
     @property
     def prev_hash(self) -> bytes:
@@ -24,24 +54,28 @@ def prev_hash(self) -> bytes:
     def feed_header(self, header_bytes: bytes) -> bytes:
         """Hash file header bytes, update chain. Returns digest for Block 0's PrevHash."""
         self._file_hasher.update(header_bytes)
-        self._prev_hash = blake3.blake3(header_bytes).digest()
+        h = self._new_hasher()
+        h.update(header_bytes)
+        self._prev_hash = h.digest()
         return self._prev_hash
 
     def feed_block(self, block_bytes: bytes) -> bytes:
         """Hash a complete block, update chain. Returns digest for next block's PrevHash."""
         self._file_hasher.update(block_bytes)
-        self._prev_hash = blake3.blake3(block_bytes).digest()
+        h = self._new_hasher()
+        h.update(block_bytes)
+        self._prev_hash = h.digest()
         return self._prev_hash
 
     def feed_block_parts(self, *parts: bytes) -> bytes:
         """Hash a block from multiple parts without concatenation."""
-        block_hasher = blake3.blake3()
+        block_hasher = self._new_hasher()
         for part in parts:
             self._file_hasher.update(part)
             block_hasher.update(part)
         self._prev_hash = block_hasher.digest()
         return self._prev_hash
 
     def finalize(self) -> bytes:
-        """Return BLAKE3 digest of the entire file so far (for EoC FileHash)."""
+        """Return digest of the entire file so far (for EoC FileHash)."""
         return self._file_hasher.digest()