🚀 go-pugleaf

flaps@dgp.toronto.edu (Alan J Rosenthal) writes:

>sxjcb@orca.alaska.edu (Jay C. Beavers) writes:
>>I've recently heard that you can hide a process from being displayed by a
>>ps -ax command.  Is this true, and if so what security implications does it
>>have?  How is this done,

>#include <stdio.h>
>#include <string.h>

>int main(argc, argv)
>    int argc;
>    char **argv;
>{
>    char *p;

>    for (p = argv[0]; *p; p++)
>	*p = 0;
>    strcpy(argv[0], "rn");

>    (void)getchar();  /* to allow you to see that ps reports "rn" */
>    return(0);
>}

Some people reported that "ps" showed "rn ut".

Here, it shows "rn (a.out)".

eg, I commonly have this:

18570 p8   I     0:01 -tcsh (tcsh)

However, if you can get the pid of a process then you can also
get the inode number of it too and if you have a decent OS, it
shouldnt let you delete it while its running (SunOS allows you
to unlink running processes :-/).

Just now I tried the following:

main(argc, argv)
int	argc;
char	*argv[];
{
	char	**s, *t;

	for (s = argv; *s; s++)
		for (t = *s; *t;)
			*t++ = '\0';
	pause();
}

% cc foo.c
% a.out &
% ps
...
19645 q5   S     0:00  (a.out)
...

If you have problems with ps showing the right name, try checking using
top to see if it will tell you the real name of the process.

Darren.

p.s the above code was compiled/tested on a Pyramid 9825 using OSx5.1 and
    SunOS 4.1.2 where the same results occured.