Implement PBKDF2 password hashing with salt for enhanced security

sys/apps/memprofile.lua

@@ -0,0 +1,200 @@
+-- Memory Profiler for CC:Tweaked / Opus OS
+-- Usage: memprofile [--watch] [--interval <seconds>]
+--
+-- Shows current Lua memory usage with breakdown estimates.
+-- Use --watch to continuously monitor.
+-- Useful for detecting memory leaks and understanding overhead.
+
+local args = { ... }
+local watch = false
+local interval = 3
+
+for i, arg in ipairs(args) do
+    if arg == '--watch' or arg == '-w' then
+        watch = true
+    elseif arg == '--interval' or arg == '-i' then
+        interval = tonumber(args[i + 1]) or 3
+    elseif arg == '--help' or arg == '-h' then
+        print('Usage: memprofile [--watch] [--interval <secs>]')
+        print('')
+        print('Options:')
+        print('  --watch, -w       Continuously monitor memory')
+        print('  --interval, -i N  Update interval in seconds (default: 3)')
+        print('  --help, -h        Show this help')
+        return
+    end
+end
+
+local term = _G.term
+local os = _G.os
+
+local function formatBytes(bytes)
+    if bytes < 1024 then
+        return string.format('%d B', bytes)
+    elseif bytes < 1024 * 1024 then
+        return string.format('%.1f KB', bytes / 1024)
+    else
+        return string.format('%.2f MB', bytes / (1024 * 1024))
+    end
+end
+
+local function countTable(t, seen)
+    if type(t) ~= 'table' or seen[t] then return 0, 0 end
+    seen[t] = true
+    local entries = 0
+    local nested = 0
+    for k, v in pairs(t) do
+        entries = entries + 1
+        if type(v) == 'table' then
+            local e, n = countTable(v, seen)
+            nested = nested + 1 + e
+            entries = entries + n
+        end
+        if type(k) == 'table' then
+            local e, n = countTable(k, seen)
+            nested = nested + 1 + e
+            entries = entries + n
+        end
+    end
+    return entries, nested
+end
+
+local function getSnapshot()
+    -- Force a full GC cycle to get accurate usage
+    collectgarbage('collect')
+    collectgarbage('collect')
+    local memKB = collectgarbage('count')  -- returns KB as float
+
+    local snapshot = {
+        totalKB = memKB,
+        totalBytes = math.floor(memKB * 1024),
+        timestamp = os.clock(),
+    }
+
+    -- Count entries in major global tables
+    local seen = {}
+    local globals = {}
+
+    local interesting = {
+        { name = '_G (globals)',  tbl = _G },
+        { name = 'kernel',       tbl = _G.kernel },
+        { name = 'network',      tbl = _G.network },
+        { name = 'device',       tbl = _G.device },
+    }
+
+    for _, item in ipairs(interesting) do
+        if type(item.tbl) == 'table' then
+            local entries, nested = countTable(item.tbl, seen)
+            table.insert(globals, {
+                name = item.name,
+                entries = entries,
+                nested = nested,
+            })
+        end
+    end
+
+    snapshot.globals = globals
+
+    -- Count routines if kernel is available
+    if _G.kernel and _G.kernel.routines then
+        snapshot.routines = #_G.kernel.routines
+    end
+
+    -- Count loaded modules
+    if package and package.loaded then
+        local count = 0
+        for _ in pairs(package.loaded) do
+            count = count + 1
+        end
+        snapshot.loadedModules = count
+    end
+
+    return snapshot
+end
+
+local function printSnapshot(snap, prev)
+    term.clear()
+    term.setCursorPos(1, 1)
+
+    local w = term.getSize()
+    local sep = string.rep('-', w)
+
+    term.setTextColor(colors.yellow)
+    print('=== Memory Profile ===')
+    term.setTextColor(colors.white)
+    print('')
+
+    -- Total memory
+    local memStr = formatBytes(snap.totalBytes)
+    local deltaStr = ''
+    if prev then
+        local delta = snap.totalBytes - prev.totalBytes
+        if delta > 0 then
+            deltaStr = string.format('  (+%s)', formatBytes(delta))
+            term.setTextColor(colors.red)
+        elseif delta < 0 then
+            deltaStr = string.format('  (-%s)', formatBytes(-delta))
+            term.setTextColor(colors.green)
+        end
+    end
+    term.setTextColor(colors.white)
+    print(string.format('Total Memory: %s%s', memStr, deltaStr))
+    print(string.format('Uptime:       %.1fs', snap.timestamp))
+    print('')
+
+    -- Table sizes
+    term.setTextColor(colors.lightBlue)
+    print('Global Tables:')
+    term.setTextColor(colors.white)
+    print(sep)
+    print(string.format('  %-20s  %8s  %8s', 'Name', 'Entries', 'Nested'))
+    print(sep)
+    for _, g in ipairs(snap.globals) do
+        print(string.format('  %-20s  %8d  %8d', g.name, g.entries, g.nested))
+    end
+    print(sep)
+    print('')
+
+    -- Kernel info
+    if snap.routines then
+        term.setTextColor(colors.lightBlue)
+        print('Kernel:')
+        term.setTextColor(colors.white)
+        print(string.format('  Active routines: %d', snap.routines))
+    end
+
+    if snap.loadedModules then
+        print(string.format('  Loaded modules:  %d', snap.loadedModules))
+    end
+
+    print('')
+
+    -- CC:Tweaked limits
+    term.setTextColor(colors.gray)
+    print('Note: CC:Tweaked default memory limit is ~128MB per computer.')
+    print('High memory usage may cause slowdowns or crashes.')
+
+    if watch then
+        print('')
+        term.setTextColor(colors.yellow)
+        print(string.format('Refreshing every %ds... (Ctrl+T to stop)', interval))
+    end
+end
+
+local function run()
+    local prev = nil
+
+    if watch then
+        while true do
+            local snap = getSnapshot()
+            printSnapshot(snap, prev)
+            prev = snap
+            os.sleep(interval)
+        end
+    else
+        local snap = getSnapshot()
+        printSnapshot(snap, nil)
+    end
+end
+
+run()

sys/apps/password.lua

@@ -1,10 +1,9 @@
 local Security = require('opus.security')
-local SHA      = require('opus.crypto.sha2')
 local Terminal = require('opus.terminal')
 
 local password = Terminal.readPassword('Enter new password: ')
 
 if password then
-	Security.updatePassword(SHA.compute(password))
+	Security.updatePassword(password)
 	print('Password updated')
 end

sys/etc/fstab

@@ -1,5 +1,5 @@
 sys/apps/pain.lua urlfs https://github.com/LDDestroier/CC/raw/master/pain.lua
-sys/apps/update.lua urlfs http://pastebin.com/raw/UzGHLbNC
+sys/apps/update.lua urlfs https://pastebin.com/raw/UzGHLbNC
 sys/apps/Enchat.lua urlfs https://raw.githubusercontent.com/LDDestroier/enchat/master/enchat3.lua
 sys/apps/cloud.lua urlfs https://cloud-catcher.squiddev.cc/cloud.lua
 rom/modules/main/opus linkfs sys/modules/opus

sys/modules/opus/crypto/chacha20.lua

@@ -5,7 +5,7 @@ local cbor = require('opus.cbor')
 local sha2 = require('opus.crypto.sha2')
 local Util = require('opus.util')
 
-local ROUNDS = 8 -- Adjust this for speed tradeoff
+local ROUNDS = 20 -- Standard ChaCha20 (was 8, upgraded for security)
 
 local bxor = bit32.bxor
 local band = bit32.band

sys/modules/opus/fs/linkfs.lua

@@ -15,7 +15,11 @@ for _,m in pairs(methods) do
 end
 
 function linkfs.resolve(node, dir)
-	return dir:gsub(node.mountPoint, node.source, 1)
+	local mp = node.mountPoint
+	if dir:sub(1, #mp) == mp then
+		return node.source .. dir:sub(#mp + 1)
+	end
+	return dir
 end
 
 function linkfs.mount(path, source)
@@ -41,8 +45,8 @@ function linkfs.mount(path, source)
 end
 
 function linkfs.copy(node, s, t)
-	s = s:gsub(node.mountPoint, node.source, 1)
-	t = t:gsub(node.mountPoint, node.source, 1)
+	s = linkfs.resolve(node, s)
+	t = linkfs.resolve(node, t)
 	return fs.copy(s, t)
 end
 
@@ -50,25 +54,29 @@ function linkfs.delete(node, dir)
 	if dir == node.mountPoint then
 		fs.unmount(node.mountPoint)
 	else
-		dir = dir:gsub(node.mountPoint, node.source, 1)
+		dir = linkfs.resolve(node, dir)
 		return fs.delete(dir)
 	end
 end
 
 function linkfs.find(node, spec)
-	spec = spec:gsub(node.mountPoint, node.source, 1)
+	spec = linkfs.resolve(node, spec)
 
 	local list = fs.find(spec)
+	local src = node.source
+	local mp = node.mountPoint
 	for k,f in ipairs(list) do
-		list[k] = f:gsub(node.source, node.mountPoint, 1)
+		if f:sub(1, #src) == src then
+			list[k] = mp .. f:sub(#src + 1)
+		end
 	end
 
 	return list
 end
 
 function linkfs.move(node, s, t)
-	s = s:gsub(node.mountPoint, node.source, 1)
-	t = t:gsub(node.mountPoint, node.source, 1)
+	s = linkfs.resolve(node, s)
+	t = linkfs.resolve(node, t)
 	return fs.move(s, t)
 end
 

sys/modules/opus/fs/netfs.lua

@@ -35,8 +35,10 @@ end
 local methods = { 'delete', 'exists', 'getFreeSpace', 'makeDir', 'list', 'listEx', 'attributes' }
 
 local function resolve(node, dir)
-	-- TODO: Wrong ! (does not support names with dashes)
-	dir = dir:gsub(node.mountPoint, '', 1)
+	local mp = node.mountPoint
+	if dir:sub(1, #mp) == mp then
+		dir = dir:sub(#mp + 1)
+	end
 	return fs.combine(node.source, dir)
 end
 
@@ -53,7 +55,7 @@ end
 
 function netfs.mount(_, id, source)
 	if not id or not tonumber(id) then
-		error('ramfs syntax: computerId [directory]')
+		error('netfs syntax: computerId [directory]')
 	end
 	return {
 		id = tonumber(id),

sys/modules/opus/git.lua

@@ -15,7 +15,7 @@ function git.list(repository)
 
 	local user = table.remove(t, 1)
 	local repo = table.remove(t, 1)
-	local branch = table.remove(t, 1) or 'master'
+	local branch = table.remove(t, 1) or 'main'
 	local path
 
 	if not Util.empty(t) then

sys/modules/opus/security.lua

@@ -1,10 +1,38 @@
 local Config = require('opus.config')
+local SHA    = require('opus.crypto.sha2')
+local Util   = require('opus.util')
+
+local PBKDF2_ITERATIONS = 100
 
 local Security = { }
 
+local function generateSalt()
+	local salt = { }
+	for _ = 1, 16 do
+		salt[#salt + 1] = math.random(0, 0xFF)
+	end
+	return setmetatable(salt, Util.byteArrayMT):toHex()
+end
+
 function Security.verifyPassword(password)
-	local current = Security.getPassword()
-	return current and password == current
+	local stored = Security.getPassword()
+	if not stored then
+		return false
+	end
+
+	-- New format: { hash = hex, salt = hex, iter = N }
+	if type(stored) == 'table' and stored.hash and stored.salt then
+		local iter = stored.iter or PBKDF2_ITERATIONS
+		local derived = SHA.pbkdf2(password, Util.hexToByteArray(stored.salt), iter)
+		return derived:toHex() == stored.hash
+	end
+
+	-- Legacy format: plain SHA-256 hex string
+	if type(stored) == 'string' then
+		return SHA.compute(password) == stored
+	end
+
+	return false
 end
 
 function Security.hasPassword()
@@ -28,8 +56,15 @@ function Security.getIdentifier()
 end
 
 function Security.updatePassword(password)
+	local salt = generateSalt()
+	local derived = SHA.pbkdf2(password, Util.hexToByteArray(salt), PBKDF2_ITERATIONS)
+
 	local config = Config.load('os')
-	config.password = password
+	config.password = {
+		hash = derived:toHex(),
+		salt = salt,
+		iter = PBKDF2_ITERATIONS,
+	}
 	Config.update('os', config)
 end
 

sys/modules/opus/ui.lua

@@ -115,12 +115,16 @@ function UI:init()
 			local ie = Input:translate('mouse_up', button, x, y)
 			local currentPage = self:getActivePage()
 
-			if ie.code == 'control-shift-mouse_click' then -- hack
-				local event = currentPage:pointToChild(x, y)
-				_ENV.multishell.openTab(_ENV, {
-					path = 'sys/apps/Lua.lua',
-					args = { event.element, self, _ENV },
-					focused = true })
+			if ie.code == 'control-shift-mouse_click' then -- debug inspector
+				local Config = require('opus.config')
+				local debugCfg = Config.load('os', { debug_inspector = false })
+				if debugCfg.debug_inspector then
+					local event = currentPage:pointToChild(x, y)
+					_ENV.multishell.openTab(_ENV, {
+						path = 'sys/apps/Lua.lua',
+						args = { event.element, self, _ENV },
+						focused = true })
+				end
 
 			elseif ie and currentPage and currentPage.parent.device.side == side then
 				self:click(currentPage, ie)