elfmaster / taskverse

A tool like /bin/ps but uses /proc/kcore for walking the tasklist; this finds hidden processes
56 stars 13 forks source link

taskverse lists all processes (Including hidden ones) and points out if a process appears to be hidden.

NOTE: ONLY TESTED ON Ubuntu 14 32bit and 64bit (And very little)

taskverse uses /proc/kallsyms for symbol resolution but you may also specify a System.map file as the first argument as an alternative.

$ taskverse

[pid] [state] [comm] [2] [S] [kthreadd] [3] [S] [ksoftirqd/0] [5] [S] [kworker/0:0H] [7] [S] [rcu_sched] [8] [S] [rcuos/0] [9] [S] [rcuos/1] [10] [S] [rcuos/2] [11] [S] [rcuos/3] [12] [S] [rcuos/4] [13] [S] [rcuos/5] [14] [S] [rcuos/6] [15] [S] [rcuos/7] [16] [S] [rcu_bh] [17] [S] [rcuob/0] [18] [S] [rcuob/1] [19] [S] [rcuob/2] [20] [S] [rcuob/3] [21] [S] [rcuob/4] [22] [S] [rcuob/5] [23] [S] [rcuob/6] [24] [S] [rcuob/7] [25] [S] [migration/0] [26] [S] [watchdog/0] [27] [S] [watchdog/1] [28] [S] [migration/1] [29] [S] [ksoftirqd/1] [31] [S] [kworker/1:0H] [32] [S] [watchdog/2] [33] [S] [migration/2] [34] [S] [ksoftirqd/2] [36] [S] [kworker/2:0H] [37] [S] [watchdog/3] [38] [S] [migration/3] [39] [S] [ksoftirqd/3] [41] [S] [kworker/3:0H] [42] [S] [khelper] [43] [S] [kdevtmpfs] [44] [S] [netns] [45] [S] [writeback] [46] [S] [kintegrityd] [47] [S] [bioset] [48] [S] [kworker/u17:0] [49] [S] [kblockd] [50] [S] [ata_sff] [51] [S] [khubd] [52] [S] [md] [53] [S] [devfreq_wq] [57] [S] [khungtaskd] [58] [S] [kswapd0] [59] [S] [ksmd] [60] [S] [khugepaged] [61] [S] [fsnotify_mark] [62] [S] [ecryptfs-kthrea] [63] [S] [crypto] [75] [S] [kthrotld] [95] [S] [deferwq] [96] [S] [charger_manager] [144] [S] [firewire] [145] [S] [firewire_ohci] [146] [S] [kpsmoused] [149] [S] [ttm_swap] [150] [S] [scsi_eh_0] [151] [S] [scsi_eh_1] [152] [S] [scsi_eh_2] [153] [S] [scsi_eh_3] [154] [S] [scsi_eh_4] [155] [S] [scsi_eh_5] [210] [S] [kworker/u17:1] [211] [S] [jbd2/sda1-8] [212] [S] [ext4-rsv-conver] [247] [S] [mountall] [333] [S] [upstart-udev-br] [339] [S] [systemd-udevd] [387] [S] [irq/50-mei_me] [415] [S] [cfg80211] [425] [S] [hd-audio0] [437] [S] [ktpacpid] [447] [S] [hd-audio1] [472] [S] [kvm-irqfd-clean] [539] [S] [upstart-socket-] [638] [S] [rpcbind] [657] [S] [rpc.statd] [754] [S] [smbd] [756] [S] [rpciod] [761] [S] [nfsiod] [827] [S] [upstart-file-br] [830] [S] [rsyslogd] [848] [S] [rpc.idmapd] [937] [S] [dbus-daemon] [950] [S] [ModemManager] [955] [S] [bluetoothd] [962] [S] [krfcommd] [974] [S] [avahi-daemon] [979] [S] [avahi-daemon] [983] [S] [NetworkManager] [1009] [S] [systemd-logind] [1014] [S] [smbd] [1035] [S] [polkitd] [1078] [S] [getty] [1082] [S] [getty] [1090] [S] [getty] [1091] [S] [getty] [1094] [S] [getty] [1149] [S] [gdm] [1172] [S] [cron] [1205] [S] [irqbalance] [1209] [S] [cups-browsed] [1234] [S] [gdm-simple-slav] [1249] [S] [whoopsie] [1266] [S] [acpid] [1313] [S] [wpa_supplicant] [1314] [S] [Xorg] [1328] [S] [accounts-daemon] [1450] [S] [dhclient] [1511] [S] [kerneloops] [1531] [S] [pkcsslotd] [1556] [S] [tor] [1602] [S] [tcsd] [1608] [S] [kauditd] [1633] [S] [iprt] [1692] [S] [vmamqpd] [1703] [S] [vmware-usbarbit] [1704] [S] [dnsmasq] [1821] [S] [winbindd] [1823] [S] [winbindd] [1824] [S] [nmbd] [1826] [S] [dhclient] [2179] [S] [upowerd] [2533] [S] [colord] [2542] [S] [rtkit-daemon] [3277] [S] [vmware-vmblock-] [3291] [S] [vmnet-bridge] [3325] [S] [vmnet-natd] [3327] [S] [vmnet-netifup] [3342] [S] [vmnet-dhcpd] [3345] [S] [vmnet-netifup] [3360] [S] [vmnet-dhcpd] [3387] [S] [vmware-authdlau] [3516] [S] [hostd-worker] [3558] [S] [getty] [3623] [S] [cupsd] [3630] [S] [dbus] [3751] [S] [gdm-session-wor] [3792] [S] [gnome-keyring-d] [3805] [S] [init] [3896] [S] [dbus-launch] [3898] [S] [dbus-daemon] [3929] [S] [dbus-daemon] [3940] [S] [upstart-event-b] [3948] [S] [window-stack-br] [3975] [S] [ibus-daemon] [3987] [S] [gvfsd] [3991] [S] [gvfsd-fuse] [3995] [S] [ibus-dconf] [3998] [S] [ibus-ui-gtk3] [4007] [S] [ibus-x11] [4020] [S] [unity-settings-] [4025] [S] [hud-service] [4028] [S] [at-spi-bus-laun] [4029] [S] [gnome-session] [4033] [S] [unity-panel-ser] [4036] [S] [dbus-daemon] [4039] [S] [upstart-dbus-br] [4046] [S] [upstart-file-br] [4048] [S] [upstart-dbus-br] [4050] [S] [at-spi2-registr] [4079] [S] [bamfdaemon] [4099] [S] [syndaemon] [4103] [S] [pulseaudio] [4128] [S] [indicator-keybo] [4131] [S] [ibus-engine-sim] [4135] [S] [indicator-messa] [4136] [S] [indicator-bluet] [4138] [S] [indicator-power] [4142] [S] [indicator-datet] [4145] [S] [indicator-sound] [4146] [S] [indicator-print] [4147] [S] [indicator-sessi] [4161] [S] [indicator-appli] [4196] [S] [evolution-sourc] [4209] [S] [notify-osd] [4211] [S] [dconf-service] [4225] [S] [compiz] [4287] [S] [evolution-calen] [4292] [S] [nm-applet] [4294] [S] [unity-fallback-] [4299] [S] [nautilus] [4304] [S] [polkit-gnome-au] [4312] [S] [gvfs-udisks2-vo] [4322] [S] [udisksd] [4336] [S] [gconfd-2] [4352] [S] [gvfs-mtp-volume] [4356] [S] [gvfs-gphoto2-vo] [4371] [S] [gvfs-afc-volume] [4389] [S] [gvfsd-afc] [4391] [S] [gvfsd-trash] [4403] [S] [gvfsd-burn] [4416] [S] [gvfsd-metadata] [4428] [S] [telepathy-indic] [4435] [S] [mission-control] [4455] [S] [firefox] [4470] [S] [zeitgeist-datah] [4477] [S] [zeitgeist-daemo] [4499] [S] [zeitgeist-fts] [4521] [S] [cat] [4548] [S] [unity-webapps-s] [4710] [S] [update-notifier] [4781] [S] [gnome-terminal] [4790] [S] [gnome-pty-helpe] [4791] [S] [bash] [4846] [S] [deja-dup-monito] [6637] [S] [kworker/u16:1] [6812] [S] [irssi] [6816] [S] [bash] [6837] [S] [evil_fucker] <- Hidden process [6972] [S] [openvpn] [7204] [S] [kworker/1:2] [7349] [S] [gvfsd-http] [7385] [S] [plugin-containe] [7422] [S] [bash] [7449] [S] [ssh] [8011] [S] [sshd] [10029] [S] [bash] [10056] [S] [ssh] [10715] [S] [sudo] [10716] [S] [bash] [10918] [S] [kworker/1:1] [10930] [S] [kworker/3:0] [15075] [S] [bash] [15454] [S] [thunderbird] [15583] [S] [kworker/2:0] [15603] [S] [kworker/u16:0] [15681] [S] [transmission-gt] [15690] [S] [kworker/0:2] [16207] [S] [kworker/2:1] [16231] [S] [kworker/3:1] [19190] [S] [oosplash] [19209] [S] [soffice.bin] [19283] [S] [kworker/0:3] [19364] [S] [kworker/u16:2] [19940] [S] [kworker/2:2] [19954] [S] [nm-dispatcher.a] [19957] [R] [taskverse]