Name:           maps-audit
Version:        1.0.0
Release:        1%{?dist}
Summary:        Detect run-time patching of mapped ELF code in running processes

License:        MIT
URL:            https://github.com/hugsy/gef
Source0:        %{name}-%{version}.tar.gz

BuildRequires:  cmake >= 3.15
BuildRequires:  gcc-c++
BuildRequires:  make

# objdump (binutils) and diff (diffutils) are invoked at run time to produce
# the disassembly diff for a detected code patch.
Requires:       binutils
Requires:       diffutils

%description
maps-audit attaches to a running Linux process and compares the in-memory
executable code of each mapped ELF object against the file on disk. A difference
is evidence of run-time code patching such as inline hooks, int3
breakpoints/uprobes, or trampolines written into a function's own .text.

It is a sibling to got-audit: where got-audit inspects the Global Offset Table
(a caller's dispatch pointers), maps-audit inspects the callee's code, catching
tampering that leaves the GOT intact.

Detection is a raw byte comparison of executable segments (position-independent
code carries no load-time relocations, so a clean object is byte-identical to
its file); a mismatch then triggers an objdump -d --reloc diff of the disk file
against the in-memory copy to show the exact instruction-level change.

%prep
%autosetup

%build
%cmake -DCMAKE_BUILD_TYPE=Release
%cmake_build

%install
%cmake_install

%check
# Tests require ptrace which may not work in build environments
cd tests
./run_tests.sh || echo "Tests skipped in build environment"

%files
%license LICENSE
%doc README.md
%{_bindir}/%{name}
%{_mandir}/man1/%{name}.1*

%changelog
* Wed Sep 16 2026 Claude (Anthropic AI) <noreply@anthropic.com> - 1.0.0-1
- Initial release
- Detects run-time code patching by comparing in-memory ELF code to disk
- Two-stage design: raw byte detection, objdump/diff reporting on mismatch
- Skips DT_TEXTREL objects and non-file-backed executable mappings