Hiding a Running Process Redux
Of course, process management involves more than just the
zombproc lists, and as such, hiding a running process involves more than just manipulating the
allproc list. For instance:
sudo kldload ./process_hiding.koSystem call loaded at offset 210. $
psPID TT STAT TIME COMMAND 521 v1 S 0:00.19 -bash (bash) 524 v1 R+ 0:00.03 ps 519 v2 I 0:00.17 -bash (bash) 520 v2 S+ 0:00.25 top $
perl -e '$p_comm = "top";' -e 'syscall(210, $p_comm);'$
ps -p 520PID TT STAT TIME COMMAND 520 v2 S+ 0:00.56 top
Notice how the hidden process (
top) was found through its PID. Undoubtedly, I'm going to remedy this. But first, some background information on FreeBSD hash tables is required.
The hashinit Function
In FreeBSD, ...