Skip to main content

extract_ssh_keys

Function extract_ssh_keys 

Source
pub fn extract_ssh_keys<P: PhysicalMemoryProvider>(
    reader: &ObjectReader<P>,
) -> Result<Vec<SshKeyInfo>>
Expand description

Extract SSH public keys from sshd process memory.

Walks the process list to find sshd processes, then scans their readable VMAs for SSH key prefix strings. When a prefix is found, extracts the full key line (up to newline/null, max 8 KiB) and parses the key type, base64 data, and optional comment.

Results are deduplicated by (pid, key_data).