tevador / randomx-sniffer Goto Github PK

Hi! Something right up my alley.

The current scan strategy can be bypassed by rearranging FLOPS into blocks and setting mxcsr before and after those blocks, it won't change unless you hit on that block exactly.

You probably want to add a secondary detection method. Did you consider taking entropy measurement of xmm and regular regs?

Has anyone tested if this will work if an attacker gains control of a Kubernetes or Docker container? Would you run this on the Kubernetes cluster or Docker host OS level? Containers aren't really VMs, so intuitively I think the CPU signature would be the same, but I'm not certain.

Won't this if statement always be skipped as its already checked here:

?