Re: Process table (537 Views)
Reply
Frequent Advisor
allanm77
Posts: 88
Registered: ‎06-27-2011
Message 1 of 6 (557 Views)

Process table

Hi All,

 

Is there a way I can run a command/script so that it does not show up in the ps command while running.

 

Avoid process table?

 

Thanks,

Allan.

Acclaimed Contributor
Torsten.
Posts: 23,451
Registered: ‎10-02-2001
Message 2 of 6 (551 Views)

Re: Process table

I wonder if this would make any sense?

Hope this helps!
Regards
Torsten.

__________________________________________________

There are only 10 types of people in the world -
those who understand binary, and those who don't.

__________________________________________________

No support by private messages. Please ask the forum!

If you feel this was helpful please click the KUDOS! thumb below!   
Acclaimed Contributor
James R. Ferguson
Posts: 21,184
Registered: ‎07-06-2000
Message 3 of 6 (537 Views)

Re: Process table

Hi:

 

Are you asking how to hide something as in "security-by-obscurity" or are you asking how to best look at the process table but not find the process used to look (e.g. the classic use of 'grep' to find a process by name)?

 

Regards!

 

...JRF...

Frequent Advisor
allanm77
Posts: 88
Registered: ‎06-27-2011
Message 4 of 6 (524 Views)

Re: Process table

Hi JRF!

Best would be that the process doesn't show up through ps command.

Security bu obscurity would work too if first one doesn't...

Thanks,
Allan.
Honored Contributor
Matti_Kurkela
Posts: 6,271
Registered: ‎12-02-2001
Message 5 of 6 (509 Views)

Re: Process table

As far as I understand, on HP-UX the ps output is produced by direct examination of the process table structure of the kernel. If the process is not listed in the kernel's table, it won't receive any CPU time and therefore won't be running (technically, it would not even exist as a real process). Regular users already have an option to see their own processes only in the ps listing, and root can always see everything.

 

Since it is possible for programs to edit their own command line as displayed in the ps listing (example: sendmail), it might be possible to embed some terminal control sequences that would cause the line to be deleted from a typical terminal/emulator, but that trick only works against one terminal type at a time, and is easily undone with "ps -ef | cat -v" anyway. If I saw a program trying to hide itself, I would consider it extremely suspicious and a possible indication of malicious intent.

 

What is the actual problem you're trying to solve by hiding a process?

MK
Acclaimed Contributor
Dennis Handly
Posts: 25,291
Registered: ‎03-06-2006
Message 6 of 6 (499 Views)

Re: Process table, hiding

>Is there a way I can run a command/script so that it does not show up in the ps command

 

If there is a process, it shows up.

 

>on HP-UX the ps output is produced by direct examination of the process table structure of the kernel.

 

Well, it comes from pstat(2).

 

>Since it is possible for programs to edit their own command line as displayed in the ps listing, it might be possible to embed some terminal control sequences

 

pstat(2) looks for those and suppresses them.

The opinions expressed above are the personal opinions of the authors, not of HP. By using this site, you accept the Terms of Use and Rules of Participation.