Designing BSD Rootkits

Hiding a Running Process

Now, equipped with the macros and functions from the previous sections, I'll detail how to hide a running process using DKOM. First, though, we need some background information on process management.

The proc Structure

In FreeBSD the context of each process is maintained in a proc structure, which is defined in the <sys/proc.h> header. The following list describes the fields in struct proc that you'll need to understand in order to hide a running process.

Note

I've tried to keep this list brief so that it can be used as a reference. You can skip over this list on your first reading and refer back to it when you face some real C code.

LIST_ENTRY(proc) p_list;

This field contains the linkage pointers that are associated with the ...