🚀 go-pugleaf

RetroBBS NetNews Server

Inspired by RockSolid Light RIP Retro Guy

Article View: comp.security.misc
Article #331

Re: Hiding Processes from ps -ax

#331
From: Alan J Rosenthal
Date: Fri, 11 Sep 1992 04:48
49 lines
2568 bytes
avalon@coombs.anu.edu.au (Darren Reed) writes:
>Some people reported that "ps" showed "rn ut".

I never saw those articles; on what system does it do this??!??!?  That is, if
you zero out the rest of the name as my article said.  This would be extremely
bizarre behaviour and I'm quite sceptical that it exists.

>Here, it shows "rn (a.out)".
>eg, I commonly have this:
>18570 p8   I     0:01 -tcsh (tcsh)

This is not the same situation.  Did my program actually show "rn (a.out)" or
are you extrapolating?  On what OS?  There is a kludge in ps for when the
argv[0] begins with a minus sign.  On SunOS 4.1.1 at least, it also seems to be
triggered by having a completely empty name, as you create later.  Neither of
these are methods I suggested because neither of them achieves the desired
results.

>However, if you can get the pid of a process then you can also
>get the inode number of it too

Processes don't have inode numbers.  Files have inode numbers.

>and if you have a decent OS, it shouldnt let you delete it while its running
>(SunOS allows you to unlink running processes :-/).

If you have a decent OS, it shouldn't try to second-guess you to death.  Unix
has always (well for a very, very long time at least) permitted you to unlink
files which are currently being executed, and to kill processes.  Neither of
these is an undesirable feature; the second is essential; if you don't like the
first, just don't invoke it.

>Just now I tried the following:
>	for (s = argv; *s; s++)
>		for (t = *s; *t;)
>			*t++ = '\0';
>	pause();

Yes, as I originally posted, this is not useful.


And to continue the confusion, gay@moebius.loria.fr (Gay Stephane) writes:
>ok, name is changed. but you can have the real name using ps -axc.
>still waiting for *the* solution.

*The* solution to hiding names from ps -ax?  As I posted.  Some other solution?
I guess it depends on to which problem.  If you want to change the name that
ps -axc reports, change the name of the program before executing it.  Using
symlinks may help but this is not an essential component.
Technical Details
Message-ID: <1992Sep11.004815.23118@jarvis.csri.toronto.edu>
Path: arc1-ca.pugleaf.net!sparky!uunet!usc!rpi!utcsri!dgp.toronto.edu!flaps
References: <sxjcb-040992091012@sxjcb.uacn.alaska.edu> <1992Sep4.172142.4750@jarvis.csri.toronto.edu> <avalon.715879172@coombs> <GAY.92Sep10141255@moebius.loria.fr>

Show Full Headers
Complete Article Headers
Path: arc1-ca.pugleaf.net!sparky!uunet!usc!rpi!utcsri!dgp.toronto.edu!flaps
Newsgroups: comp.security.misc
From: flaps@dgp.toronto.edu (Alan J Rosenthal)
Subject: Re: Hiding Processes from ps -ax
Message-ID: <1992Sep11.004815.23118@jarvis.csri.toronto.edu>
References: <sxjcb-040992091012@sxjcb.uacn.alaska.edu> <1992Sep4.172142.4750@jarvis.csri.toronto.edu> <avalon.715879172@coombs> <GAY.92Sep10141255@moebius.loria.fr>
Date: 11 Sep 92 04:48:16 GMT
Lines: 49