home *** CD-ROM | disk | FTP | other *** search
open in: 
MacOS 8.1
|
Win98
|
DOS
view JSON data
|
view as text
This file was processed as: SHell self-extracting ARchive
(archive/shar).
You can browse this item here: fake_ps.txt
| Confidence | Program | Detection | Match Type | Support
|
|---|
| 100%
| dexvert
| SHell self-extracting ARchive (archive/shar)
| magic
| Supported |
| 1%
| dexvert
| Text File (text/txt)
| fallback
| Supported |
| 100%
| file
| C source text
| default
| |
| 99%
| file
| C source, ASCII text
| default
| |
| 100%
| checkBytes
| Printable ASCII
| default
| |
| 100%
| perlTextCheck
| Likely Text (Perl)
| default
| |
| 100%
| siegfried
| fmt/329 Shell Archive Format
| default
| |
| 100%
| gt2
| Textdatei (UNIX)
| default
| |
| 100%
| detectItEasy
| Format: plain text[LF]
| default (weak)
|
|
hex view+--------+-------------------------+-------------------------+--------+--------+
|00000000| 0a 48 61 76 69 6e 67 20 | 64 69 73 63 6f 76 65 72 |.Having |discover|
|00000010| 65 64 20 74 68 65 20 72 | 6f 6f 74 6b 69 74 20 6f |ed the r|ootkit o|
|00000020| 6e 20 61 20 6d 61 63 68 | 69 6e 65 20 68 65 72 65 |n a mach|ine here|
|00000030| 20 69 73 20 73 6f 6d 65 | 20 63 6f 64 65 20 74 6f | is some| code to|
|00000040| 20 62 65 61 74 0a 76 65 | 72 73 69 6f 6e 73 20 6f | beat.ve|rsions o|
|00000050| 66 20 70 73 20 74 68 61 | 74 20 22 68 69 64 65 22 |f ps tha|t "hide"|
|00000060| 20 70 72 6f 63 65 73 73 | 20 66 6f 72 20 73 79 73 | process| for sys|
|00000070| 74 65 6d 20 56 20 6d 61 | 63 68 69 6e 65 73 2e 20 |tem V ma|chines. |
|00000080| 49 74 20 77 6f 72 6b 73 | 20 62 79 0a 72 75 6e 6e |It works| by.runn|
|00000090| 69 6e 67 20 70 73 20 61 | 6e 64 20 63 68 65 63 6b |ing ps a|nd check|
|000000a0| 69 6e 67 20 77 69 74 68 | 20 2f 70 72 6f 63 2e 20 |ing with| /proc. |
|000000b0| 50 61 74 63 68 65 73 20 | 74 6f 20 61 6c 6c 6f 77 |Patches |to allow|
|000000c0| 20 74 68 65 20 65 6e 61 | 62 6c 69 6e 67 20 6f 66 | the ena|bling of|
|000000d0| 0a 47 45 54 5f 50 41 52 | 45 4e 54 20 77 65 6c 63 |.GET_PAR|ENT welc|
|000000e0| 6f 6d 65 2e 20 54 68 69 | 73 20 69 73 20 61 6c 70 |ome. Thi|s is alp|
|000000f0| 68 61 20 61 6e 64 20 6e | 6f 74 20 74 65 73 74 65 |ha and n|ot teste|
|00000100| 64 20 79 65 74 2c 20 73 | 6f 20 59 4d 4d 56 2e 0a |d yet, s|o YMMV..|
|00000110| 48 6f 77 65 76 65 72 20 | 49 20 74 68 6f 75 67 68 |However |I though|
|00000120| 20 79 6f 75 20 6d 69 67 | 68 74 20 6c 69 6b 65 20 | you mig|ht like |
|00000130| 69 74 20 61 6e 79 77 61 | 79 2e 20 4c 6f 74 73 20 |it anywa|y. Lots |
|00000140| 6f 66 20 61 6e 74 69 2d | 44 6f 53 20 70 61 72 61 |of anti-|DoS para|
|00000150| 6e 69 6f 61 0a 69 73 20 | 69 6e 63 6c 75 64 65 64 |nioa.is |included|
|00000160| 2e 20 28 4a 75 73 74 20 | 6c 6f 6f 6b 20 61 74 20 |. (Just |look at |
|00000170| 74 68 65 20 73 6f 75 72 | 63 65 20 74 6f 20 73 65 |the sour|ce to se|
|00000180| 65 20 73 74 75 66 66 20 | 6c 69 6b 65 20 64 65 74 |e stuff |like det|
|00000190| 65 63 74 69 6f 6e 20 6f | 66 0a 53 49 47 53 54 4f |ection o|f.SIGSTO|
|000001a0| 50 20 69 6e 20 70 61 72 | 65 6e 74 20 61 6e 64 20 |P in par|ent and |
|000001b0| 69 6d 6d 65 64 69 61 74 | 65 20 72 65 73 74 61 72 |immediat|e restar|
|000001c0| 74 20 77 69 74 68 20 53 | 49 47 43 4f 4e 54 2c 20 |t with S|IGCONT, |
|000001d0| 74 69 6d 65 20 6c 69 6d | 69 74 73 2c 0a 6d 61 78 |time lim|its,.max|
|000001e0| 69 6d 75 6d 20 6e 75 6d | 62 65 72 20 6f 66 20 70 |imum num|ber of p|
|000001f0| 72 6f 63 65 73 73 20 6e | 75 6d 62 65 72 73 20 6c |rocess n|umbers l|
|00000200| 69 6d 69 74 73 2c 20 61 | 75 74 6f 20 72 65 73 74 |imits, a|uto rest|
|00000210| 61 72 74 20 63 6f 64 65 | 2e 2e 2e 20 46 6f 72 0a |art code|... For.|
|00000220| 6d 61 78 69 6d 75 6d 20 | 6f 62 73 63 75 72 69 74 |maximum |obscurit|
|00000230| 79 20 63 61 6c 6c 20 69 | 74 20 6c 70 64 20 6f 72 |y call i|t lpd or|
|00000240| 20 73 6f 6d 65 74 68 69 | 6e 67 20 69 6e 6f 63 75 | somethi|ng inocu|
|00000250| 6f 75 73 29 2e 20 76 65 | 72 73 69 6f 6e 73 20 6f |ous). ve|rsions o|
|00000260| 66 20 70 73 0a 74 68 61 | 74 20 61 64 64 20 65 78 |f ps.tha|t add ex|
|00000270| 74 72 61 20 70 72 6f 63 | 65 73 73 65 73 20 61 72 |tra proc|esses ar|
|00000280| 65 20 61 6c 73 6f 20 64 | 65 74 65 63 74 65 64 2e |e also d|etected.|
|00000290| 0a 0a 54 68 69 73 20 70 | 72 6f 67 72 61 6d 20 69 |..This p|rogram i|
|000002a0| 73 20 64 65 64 69 63 61 | 74 65 64 20 74 6f 20 74 |s dedica|ted to t|
|000002b0| 68 65 20 68 6f 6e 65 73 | 74 79 20 6f 66 20 70 73 |he hones|ty of ps|
|000002c0| 20 73 6f 20 73 65 6e 64 | 73 20 53 49 47 4b 49 4c | so send|s SIGKIL|
|000002d0| 4c 20 74 6f 20 61 6c 6c | 0a 68 69 64 64 65 6e 20 |L to all|.hidden |
|000002e0| 70 72 6f 63 65 73 73 65 | 73 2c 20 75 6e 6c 65 73 |processe|s, unles|
|000002f0| 73 20 74 68 65 20 6e 75 | 6d 62 65 72 20 69 73 20 |s the nu|mber is |
|00000300| 69 74 73 65 6c 66 20 28 | 61 70 6f 6c 6c 6f 67 69 |itself (|apollogi|
|00000310| 65 73 20 74 6f 20 63 72 | 61 63 6b 65 72 73 0a 74 |es to cr|ackers.t|
|00000320| 68 61 74 20 74 68 6f 75 | 67 68 74 20 74 68 65 79 |hat thou|ght they|
|00000330| 20 77 6f 75 6c 64 20 61 | 76 6f 69 64 20 74 68 69 | would a|void thi|
|00000340| 73 20 70 72 6f 67 72 61 | 6d 20 62 79 20 68 69 64 |s progra|m by hid|
|00000350| 69 6e 67 20 69 74 2c 20 | 69 74 20 64 6f 65 73 20 |ing it, |it does |
|00000360| 6e 6f 74 0a 77 6f 72 6b | 29 2e 0a 0a 54 6f 20 6b |not.work|)...To k|
|00000370| 69 6c 6c 2c 20 6b 69 6c | 6c 20 74 68 65 20 6c 6f |ill, kil|l the lo|
|00000380| 77 65 72 20 70 72 6f 63 | 65 73 73 20 6e 75 6d 62 |wer proc|ess numb|
|00000390| 65 72 20 66 69 72 73 74 | 20 6f 72 20 74 68 65 20 |er first| or the |
|000003a0| 63 6f 64 65 20 77 69 6c | 6c 20 6a 75 73 74 0a 72 |code wil|l just.r|
|000003b0| 65 73 74 61 72 74 20 69 | 74 73 65 6c 66 2e 20 53 |estart i|tself. S|
|000003c0| 65 6e 64 69 6e 67 20 53 | 49 47 53 54 4f 50 20 74 |ending S|IGSTOP t|
|000003d0| 6f 20 74 68 65 20 6d 61 | 69 6e 20 6a 6f 62 20 69 |o the ma|in job i|
|000003e0| 73 20 65 71 75 61 6c 6c | 79 20 75 73 65 6c 65 73 |s equall|y useles|
|000003f0| 73 20 28 74 68 65 0a 62 | 61 63 6b 75 70 20 6a 6f |s (the.b|ackup jo|
|00000400| 62 20 73 65 6e 64 73 20 | 53 49 47 43 4f 4e 54 20 |b sends |SIGCONT |
|00000410| 69 6d 6d 65 64 69 61 74 | 65 6c 79 2c 20 72 65 73 |immediat|ely, res|
|00000420| 74 61 72 74 69 6e 67 20 | 65 76 65 72 79 74 68 69 |tarting |everythi|
|00000430| 6e 67 29 2e 20 49 20 77 | 69 6c 6c 20 62 65 0a 64 |ng). I w|ill be.d|
|00000440| 65 70 6c 6f 79 69 6e 67 | 20 69 74 20 6d 79 73 65 |eploying| it myse|
|00000450| 6c 66 20 6f 6e 20 74 68 | 61 74 20 72 6f 6f 74 6b |lf on th|at rootk|
|00000460| 69 74 20 65 6e 61 62 6c | 65 64 2d 6d 61 63 68 69 |it enabl|ed-machi|
|00000470| 6e 65 20 28 6e 6f 20 6c | 6f 67 65 72 20 65 6e 61 |ne (no l|oger ena|
|00000480| 62 6c 65 64 0a 6f 72 20 | 70 72 65 73 65 6e 74 2c |bled.or |present,|
|00000490| 20 6f 66 20 63 6f 75 72 | 73 65 29 2e 20 43 6f 6d | of cour|se). Com|
|000004a0| 6d 65 6e 74 73 20 77 65 | 6c 63 6f 6d 65 64 2e 0a |ments we|lcomed..|
|000004b0| 0a 44 75 6e 63 61 6e 20 | 28 2d 3a 0a 61 6b 61 2e |.Duncan |(-:.aka.|
|000004c0| 20 64 70 73 40 69 6f 2e | 73 74 61 72 67 61 74 65 | dps@io.|stargate|
|000004d0| 2e 63 6f 2e 75 6b 2c 20 | 64 70 73 40 64 75 6e 63 |.co.uk, |dps@dunc|
|000004e0| 61 6e 2e 74 65 6c 73 74 | 61 72 2e 6e 65 74 2e 0a |an.telst|ar.net..|
|000004f0| 66 6f 72 20 50 47 50 20 | 6b 65 79 20 65 6d 61 69 |for PGP |key emai|
|00000500| 6c 20 70 67 70 40 64 75 | 6e 63 61 6e 2e 74 65 6c |l pgp@du|ncan.tel|
|00000510| 73 74 61 72 2e 6e 65 74 | 20 61 6e 64 20 63 6f 6e |star.net| and con|
|00000520| 66 69 72 6d 20 73 69 67 | 6e 61 74 75 72 65 20 62 |firm sig|nature b|
|00000530| 79 0a 65 6d 61 69 6c 20 | 77 69 74 68 20 64 70 73 |y.email |with dps|
|00000540| 40 69 6f 2e 73 74 61 72 | 67 61 74 65 2e 63 6f 2e |@io.star|gate.co.|
|00000550| 75 6b 20 28 73 6f 6d 65 | 6f 6e 65 20 6d 69 67 68 |uk (some|one migh|
|00000560| 74 20 68 61 76 65 20 63 | 68 61 6e 67 65 64 20 6d |t have c|hanged m|
|00000570| 79 0a 61 75 74 6f 72 65 | 73 70 6f 6e 73 65 20 6d |y.autore|sponse m|
|00000580| 65 73 73 61 67 65 20 67 | 69 76 65 6e 20 72 6f 6f |essage g|iven roo|
|00000590| 74 20 74 6f 20 70 6c 61 | 79 20 77 69 74 68 29 2e |t to pla|y with).|
|000005a0| 0a 0a 23 21 2f 62 69 6e | 2f 73 68 0a 23 20 54 68 |..#!/bin|/sh.# Th|
|000005b0| 69 73 20 69 73 20 61 20 | 73 68 65 6c 6c 20 61 72 |is is a |shell ar|
|000005c0| 63 68 69 76 65 20 28 70 | 72 6f 64 75 63 65 64 20 |chive (p|roduced |
|000005d0| 62 79 20 73 68 61 72 20 | 33 2e 34 39 29 0a 23 20 |by shar |3.49).# |
|000005e0| 54 6f 20 65 78 74 72 61 | 63 74 20 74 68 65 20 66 |To extra|ct the f|
|000005f0| 69 6c 65 73 20 66 72 6f | 6d 20 74 68 69 73 20 61 |iles fro|m this a|
|00000600| 72 63 68 69 76 65 2c 20 | 73 61 76 65 20 69 74 20 |rchive, |save it |
|00000610| 74 6f 20 61 20 66 69 6c | 65 2c 20 72 65 6d 6f 76 |to a fil|e, remov|
|00000620| 65 0a 23 20 65 76 65 72 | 79 74 68 69 6e 67 20 61 |e.# ever|ything a|
|00000630| 62 6f 76 65 20 74 68 65 | 20 22 21 2f 62 69 6e 2f |bove the| "!/bin/|
|00000640| 73 68 22 20 6c 69 6e 65 | 20 61 62 6f 76 65 2c 20 |sh" line| above, |
|00000650| 61 6e 64 20 74 79 70 65 | 20 22 73 68 20 66 69 6c |and type| "sh fil|
|00000660| 65 5f 6e 61 6d 65 22 2e | 0a 23 0a 23 20 6d 61 64 |e_name".|.#.# mad|
|00000670| 65 20 30 39 2f 31 36 2f | 31 39 39 37 20 32 33 3a |e 09/16/|1997 23:|
|00000680| 30 36 20 55 54 43 20 62 | 79 20 64 70 73 39 36 72 |06 UTC b|y dps96r|
|00000690| 40 66 65 79 6e 6d 61 6e | 0a 23 20 53 6f 75 72 63 |@feynman|.# Sourc|
|000006a0| 65 20 64 69 72 65 63 74 | 6f 72 79 20 2f 74 6d 70 |e direct|ory /tmp|
|000006b0| 5f 6d 6e 74 2f 68 6f 6d | 65 2f 64 70 73 39 36 72 |_mnt/hom|e/dps96r|
|000006c0| 2f 73 72 63 2f 63 68 65 | 63 6b 5f 70 73 0a 23 0a |/src/che|ck_ps.#.|
|000006d0| 23 20 65 78 69 73 74 69 | 6e 67 20 66 69 6c 65 73 |# existi|ng files|
|000006e0| 20 77 69 6c 6c 20 4e 4f | 54 20 62 65 20 6f 76 65 | will NO|T be ove|
|000006f0| 72 77 72 69 74 74 65 6e | 20 75 6e 6c 65 73 73 20 |rwritten| unless |
|00000700| 2d 63 20 69 73 20 73 70 | 65 63 69 66 69 65 64 0a |-c is sp|ecified.|
|00000710| 23 0a 23 20 54 68 69 73 | 20 73 68 61 72 20 63 6f |#.# This| shar co|
|00000720| 6e 74 61 69 6e 73 3a 0a | 23 20 6c 65 6e 67 74 68 |ntains:.|# length|
|00000730| 20 20 6d 6f 64 65 20 20 | 20 20 20 20 20 6e 61 6d | mode | nam|
|00000740| 65 0a 23 20 2d 2d 2d 2d | 2d 2d 20 2d 2d 2d 2d 2d |e.# ----|-- -----|
|00000750| 2d 2d 2d 2d 2d 20 2d 2d | 2d 2d 2d 2d 2d 2d 2d 2d |----- --|--------|
|00000760| 2d 2d 2d 2d 2d 2d 2d 2d | 2d 2d 2d 2d 2d 2d 2d 2d |--------|--------|
|00000770| 2d 2d 2d 2d 2d 2d 2d 2d | 2d 2d 2d 2d 2d 2d 2d 2d |--------|--------|
|00000780| 0a 23 20 20 20 38 35 34 | 30 20 2d 72 77 2d 72 2d |.# 854|0 -rw-r-|
|00000790| 2d 72 2d 2d 20 63 68 65 | 63 6b 5f 70 73 2e 63 0a |-r-- che|ck_ps.c.|
|000007a0| 23 0a 23 20 3d 3d 3d 3d | 3d 3d 3d 3d 3d 3d 3d 3d |#.# ====|========|
|000007b0| 3d 20 63 68 65 63 6b 5f | 70 73 2e 63 20 3d 3d 3d |= check_|ps.c ===|
|000007c0| 3d 3d 3d 3d 3d 3d 3d 3d | 3d 3d 3d 0a 69 66 20 74 |========|===.if t|
|000007d0| 65 73 74 20 2d 66 20 27 | 63 68 65 63 6b 5f 70 73 |est -f '|check_ps|
|000007e0| 2e 63 27 20 2d 61 20 58 | 22 24 31 22 20 21 3d 20 |.c' -a X|"$1" != |
|000007f0| 58 22 2d 63 22 3b 20 74 | 68 65 6e 0a 20 20 20 20 |X"-c"; t|hen. |
|00000800| 20 20 20 20 65 63 68 6f | 20 27 78 20 2d 20 73 6b | echo| 'x - sk|
|00000810| 69 70 70 69 6e 67 20 63 | 68 65 63 6b 5f 70 73 2e |ipping c|heck_ps.|
|00000820| 63 20 28 46 69 6c 65 20 | 61 6c 72 65 61 64 79 20 |c (File |already |
|00000830| 65 78 69 73 74 73 29 27 | 0a 65 6c 73 65 0a 65 63 |exists)'|.else.ec|
|00000840| 68 6f 20 27 78 20 2d 20 | 65 78 74 72 61 63 74 69 |ho 'x - |extracti|
|00000850| 6e 67 20 63 68 65 63 6b | 5f 70 73 2e 63 20 28 54 |ng check|_ps.c (T|
|00000860| 65 78 74 29 27 0a 73 65 | 64 20 27 73 2f 5e 58 2f |ext)'.se|d 's/^X/|
|00000870| 2f 27 20 3c 3c 20 27 53 | 48 41 52 5f 45 4f 46 27 |/' << 'S|HAR_EOF'|
|00000880| 20 3e 20 27 63 68 65 63 | 6b 5f 70 73 2e 63 27 20 | > 'chec|k_ps.c' |
|00000890| 26 26 0a 2f 2a 20 53 70 | 69 6b 65 64 20 70 73 20 |&&./* Sp|iked ps |
|000008a0| 64 65 74 65 63 74 6f 72 | 20 2a 2f 0a 2f 2a 20 4a |detector| */./* J|
|000008b0| 75 73 74 20 72 75 6e 73 | 20 74 68 69 73 20 69 6e |ust runs| this in|
|000008c0| 20 74 68 65 20 62 61 63 | 6b 67 72 6f 75 6e 64 20 | the bac|kground |
|000008d0| 61 6e 64 20 64 65 74 65 | 63 74 73 20 6e 61 73 74 |and dete|cts nast|
|000008e0| 79 20 76 65 72 73 69 6f | 6e 20 6f 66 20 70 73 20 |y versio|n of ps |
|000008f0| 2a 2f 0a 2f 2a 20 28 77 | 69 74 68 20 73 65 70 63 |*/./* (w|ith sepc|
|00000900| 69 61 6c 20 61 6e 74 69 | 2d 6b 69 6c 6c 20 63 6f |ial anti|-kill co|
|00000910| 64 65 20 74 6f 20 68 65 | 6c 70 20 63 72 61 63 6b |de to he|lp crack|
|00000920| 65 72 73 20 68 61 76 65 | 20 70 72 6f 62 6c 65 6d |ers have| problem|
|00000930| 73 20 77 69 74 68 20 2a | 2f 0a 2f 2a 20 61 76 6f |s with *|/./* avo|
|00000940| 69 64 69 6e 67 20 64 65 | 74 65 63 74 69 6f 6e 2e |iding de|tection.|
|00000950| 2e 2e 20 61 6c 6c 20 28 | 63 29 20 44 2e 50 2e 53 |.. all (|c) D.P.S|
|00000960| 69 6d 70 73 6f 6e 20 20 | 20 20 20 20 20 20 20 20 |impson | |
|00000970| 20 20 20 20 20 20 20 20 | 20 20 20 20 20 20 2a 2f | | */|
|00000980| 0a 58 0a 23 69 6e 63 6c | 75 64 65 20 3c 73 74 64 |.X.#incl|ude <std|
|00000990| 69 6f 2e 68 3e 0a 23 69 | 6e 63 6c 75 64 65 20 3c |io.h>.#i|nclude <|
|000009a0| 73 74 64 6c 69 62 2e 68 | 3e 0a 23 69 6e 63 6c 75 |stdlib.h|>.#inclu|
|000009b0| 64 65 20 3c 64 69 72 65 | 6e 74 2e 68 3e 0a 23 69 |de <dire|nt.h>.#i|
|000009c0| 6e 63 6c 75 64 65 20 3c | 75 6e 69 73 74 64 2e 68 |nclude <|unistd.h|
|000009d0| 3e 0a 23 69 6e 63 6c 75 | 64 65 20 3c 73 79 73 6c |>.#inclu|de <sysl|
|000009e0| 6f 67 2e 68 3e 0a 23 69 | 6e 63 6c 75 64 65 20 3c |og.h>.#i|nclude <|
|000009f0| 73 69 67 6e 61 6c 2e 68 | 3e 0a 58 0a 2f 2a 20 54 |signal.h|>.X./* T|
|00000a00| 75 6e 61 62 6c 65 20 2a | 2f 0a 23 64 65 66 69 6e |unable *|/.#defin|
|00000a10| 65 20 4d 41 58 58 5f 4e | 55 4d 53 20 31 30 30 30 |e MAXX_N|UMS 1000|
|00000a20| 30 0a 23 64 65 66 69 6e | 65 20 49 4e 49 54 49 41 |0.#defin|e INITIA|
|00000a30| 4c 5f 4e 55 4d 53 20 32 | 30 30 0a 23 64 65 66 69 |L_NUMS 2|00.#defi|
|00000a40| 6e 65 20 49 4e 43 20 35 | 30 0a 58 0a 2f 2a 20 50 |ne INC 5|0.X./* P|
|00000a50| 72 6f 63 65 73 73 20 6e | 75 6b 65 72 2c 20 61 6c |rocess n|uker, al|
|00000a60| 73 6f 20 6e 75 6b 65 73 | 20 74 68 65 20 63 68 69 |so nukes| the chi|
|00000a70| 6c 64 20 28 68 6f 70 65 | 66 75 6c 6c 79 20 74 68 |ld (hope|fully th|
|00000a80| 65 20 63 72 61 63 6b 65 | 72 73 20 63 6f 6e 6e 65 |e cracke|rs conne|
|00000a90| 63 74 69 6f 6e 29 20 2a | 2f 0a 76 6f 69 64 20 6e |ction) *|/.void n|
|00000aa0| 75 6b 65 28 69 6e 74 20 | 70 69 64 29 0a 7b 0a 23 |uke(int |pid).{.#|
|00000ab0| 69 66 64 65 66 20 47 45 | 54 5f 50 41 52 45 4e 54 |ifdef GE|T_PARENT|
|00000ac0| 0a 58 20 20 20 20 70 69 | 64 5f 74 20 70 61 72 65 |.X pi|d_t pare|
|00000ad0| 6e 74 3b 0a 23 65 6e 64 | 69 66 0a 58 0a 58 20 20 |nt;.#end|if.X.X |
|00000ae0| 20 20 2f 2a 20 43 68 65 | 63 6b 20 66 6f 72 20 6d | /* Che|ck for m|
|00000af0| 65 20 6c 65 73 74 20 63 | 72 61 63 6b 65 72 73 20 |e lest c|rackers |
|00000b00| 74 72 79 20 61 6e 64 20 | 68 69 64 65 20 6d 65 20 |try and |hide me |
|00000b10| 73 6f 20 49 20 6b 69 6c | 6c 20 6d 79 73 65 6c 66 |so I kil|l myself|
|00000b20| 20 2a 2f 0a 58 20 20 20 | 20 69 66 20 28 70 69 64 | */.X | if (pid|
|00000b30| 3d 3d 67 65 74 70 69 64 | 28 29 29 0a 58 20 20 20 |==getpid|()).X |
|00000b40| 20 7b 0a 58 20 20 20 20 | 20 20 20 73 79 73 6c 6f | {.X | syslo|
|00000b50| 67 28 4c 4f 47 5f 4e 4f | 54 49 43 45 2c 20 22 41 |g(LOG_NO|TICE, "A|
|00000b60| 63 74 75 61 6c 6c 79 20 | 70 72 6f 63 65 73 73 20 |ctually |process |
|00000b70| 25 64 20 69 73 20 6d 65 | 2c 20 6e 6f 74 20 6e 75 |%d is me|, not nu|
|00000b80| 6b 69 6e 67 22 29 3b 0a | 58 20 20 20 20 20 20 20 |king");.|X |
|00000b90| 72 65 74 75 72 6e 3b 0a | 58 20 20 20 20 7d 0a 58 |return;.|X }.X|
|00000ba0| 0a 23 69 66 64 65 66 20 | 47 45 54 5f 50 41 52 45 |.#ifdef |GET_PARE|
|00000bb0| 4e 54 0a 58 20 20 20 20 | 2f 2a 20 72 65 61 64 20 |NT.X |/* read |
|00000bc0| 74 68 65 20 70 61 72 65 | 6e 74 20 69 64 20 2a 2f |the pare|nt id */|
|00000bd0| 0a 58 0a 58 20 20 20 20 | 2f 2a 20 46 72 65 65 7a |.X.X |/* Freez|
|00000be0| 65 20 74 68 65 20 70 72 | 6f 63 65 73 73 65 73 20 |e the pr|ocesses |
|00000bf0| 73 6f 20 74 68 65 79 20 | 63 61 6e 20 6e 6f 74 20 |so they |can not |
|00000c00| 6d 6f 6e 69 74 6f 72 20 | 65 61 63 68 20 6f 74 68 |monitor |each oth|
|00000c10| 65 72 20 61 6e 64 0a 58 | 20 20 20 20 20 20 20 66 |er and.X| f|
|00000c20| 6f 72 6b 20 73 6f 6d 65 | 74 68 69 6e 67 20 6f 66 |ork some|thing of|
|00000c30| 66 20 74 6f 20 6b 65 65 | 70 20 67 6f 69 6e 67 2e |f to kee|p going.|
|00000c40| 20 2a 2f 0a 58 20 20 20 | 20 69 66 20 28 70 61 72 | */.X | if (par|
|00000c50| 65 6e 74 21 3d 31 29 0a | 58 20 20 20 20 7b 0a 58 |ent!=1).|X {.X|
|00000c60| 20 20 20 20 20 20 20 73 | 79 73 6c 6f 67 28 22 70 | s|yslog("p|
|00000c70| 61 72 65 6e 74 20 6f 66 | 20 25 64 20 20 69 73 20 |arent of| %d is |
|00000c80| 25 64 2c 20 6e 75 6c 6b | 69 6e 67 20 69 74 20 74 |%d, nulk|ing it t|
|00000c90| 6f 6f 22 2c 20 70 69 64 | 2c 20 70 61 72 65 6e 74 |oo", pid|, parent|
|00000ca0| 5f 69 64 29 3b 0a 58 20 | 20 20 20 20 20 20 6e 69 |_id);.X | ni|
|00000cb0| 63 65 28 2d 31 30 29 3b | 20 20 20 20 20 20 20 20 |ce(-10);| |
|00000cc0| 20 20 20 20 20 20 2f 2a | 20 47 65 74 20 68 69 67 | /*| Get hig|
|00000cd0| 68 20 6e 69 63 65 20 76 | 61 6c 75 65 20 74 6f 20 |h nice v|alue to |
|00000ce0| 6c 69 6d 69 74 20 69 6e | 74 65 72 75 70 74 69 6f |limit in|teruptio|
|00000cf0| 6e 20 2a 2f 0a 58 20 20 | 20 20 20 20 20 6b 69 6c |n */.X | kil|
|00000d00| 6c 20 28 70 61 72 65 6e | 74 2c 20 53 49 47 53 54 |l (paren|t, SIGST|
|00000d10| 4f 50 29 3b 20 2f 2a 20 | 46 72 65 65 7a 65 20 70 |OP); /* |Freeze p|
|00000d20| 61 72 65 6e 74 2c 20 64 | 69 73 61 62 6c 65 73 20 |arent, d|isables |
|00000d30| 6d 79 20 64 65 76 69 63 | 65 20 2a 2f 0a 58 20 20 |my devic|e */.X |
|00000d40| 20 20 20 20 20 6b 69 6c | 6c 20 28 70 69 64 2c 20 | kil|l (pid, |
|00000d50| 53 49 47 53 54 4f 50 29 | 3b 20 20 20 20 2f 2a 20 |SIGSTOP)|; /* |
|00000d60| 46 72 65 65 7a 65 20 63 | 68 69 6c 64 2c 20 73 6f |Freeze c|hild, so|
|00000d70| 20 69 74 20 63 61 6e 20 | 6e 6f 74 20 6e 6f 74 69 | it can |not noti|
|00000d80| 63 65 20 2a 2f 0a 58 20 | 20 20 20 20 20 20 6b 69 |ce */.X | ki|
|00000d90| 6c 6c 20 28 70 61 72 65 | 6e 74 2c 20 53 49 47 4b |ll (pare|nt, SIGK|
|00000da0| 49 4c 4c 29 3b 20 2f 2a | 20 4e 75 6b 65 20 70 61 |ILL); /*| Nuke pa|
|00000db0| 72 65 6e 74 20 2a 2f 0a | 58 20 20 20 20 7d 0a 58 |rent */.|X }.X|
|00000dc0| 20 20 20 20 65 6c 73 65 | 0a 58 20 20 20 20 7b 0a | else|.X {.|
|00000dd0| 58 20 20 20 20 20 20 20 | 73 79 73 6c 6f 67 28 22 |X |syslog("|
|00000de0| 70 61 72 65 6e 74 20 6f | 66 20 25 64 20 69 73 20 |parent o|f %d is |
|00000df0| 69 6e 69 74 2c 20 6e 6f | 74 20 6e 75 6b 69 6e 67 |init, no|t nuking|
|00000e00| 20 70 61 72 65 6e 74 22 | 2c 20 70 69 64 29 3b 0a | parent"|, pid);.|
|00000e10| 58 20 20 20 20 7d 0a 23 | 65 6e 64 69 66 0a 58 20 |X }.#|endif.X |
|00000e20| 20 20 20 6b 69 6c 6c 20 | 28 70 69 64 2c 20 53 49 | kill |(pid, SI|
|00000e30| 47 4b 49 4c 4c 29 3b 20 | 20 20 20 20 20 20 2f 2a |GKILL); | /*|
|00000e40| 20 4e 75 6b 65 20 63 68 | 69 6c 64 20 2a 2f 0a 58 | Nuke ch|ild */.X|
|00000e50| 20 20 20 20 6e 69 63 65 | 28 31 30 29 3b 20 20 20 | nice|(10); |
|00000e60| 20 20 20 20 20 20 20 20 | 20 20 20 20 20 20 20 2f | | /|
|00000e70| 2a 20 42 61 63 6b 20 74 | 6f 20 6e 6f 72 6d 61 6c |* Back t|o normal|
|00000e80| 20 6e 69 63 65 6e 65 73 | 73 20 2a 2f 0a 7d 0a 58 | nicenes|s */.}.X|
|00000e90| 0a 58 0a 2f 2a 20 43 68 | 69 6c 64 20 63 61 74 63 |.X./* Ch|ild catc|
|00000ea0| 68 65 72 20 2a 2f 0a 76 | 6f 69 64 20 63 61 74 63 |her */.v|oid catc|
|00000eb0| 68 5f 63 68 69 6c 64 28 | 69 6e 74 20 73 69 67 29 |h_child(|int sig)|
|00000ec0| 0a 7b 0a 58 20 20 20 20 | 73 69 67 3d 73 69 67 3b |.{.X |sig=sig;|
|00000ed0| 0a 58 20 20 20 20 69 6e | 74 20 2a 73 74 61 74 75 |.X in|t *statu|
|00000ee0| 73 3b 0a 58 20 20 20 20 | 70 69 64 5f 74 20 70 69 |s;.X |pid_t pi|
|00000ef0| 64 3b 0a 58 0a 58 20 20 | 20 20 70 69 64 3d 77 61 |d;.X.X | pid=wa|
|00000f00| 69 74 28 26 73 74 61 74 | 75 73 29 3b 0a 58 20 20 |it(&stat|us);.X |
|00000f10| 20 20 69 66 20 28 57 49 | 46 53 54 4f 50 50 45 44 | if (WI|FSTOPPED|
|00000f20| 28 73 74 61 74 75 73 29 | 29 0a 58 20 20 20 20 20 |(status)|).X |
|00000f30| 20 20 6b 69 6c 6c 28 70 | 69 64 2c 20 53 49 47 43 | kill(p|id, SIGC|
|00000f40| 4f 4e 54 29 3b 20 20 20 | 20 20 2f 2a 20 53 74 6f |ONT); | /* Sto|
|00000f50| 70 20 63 72 61 63 6b 65 | 72 73 20 73 74 6f 70 69 |p cracke|rs stopi|
|00000f60| 6e 67 20 74 68 65 20 70 | 73 20 70 72 6f 63 65 73 |ng the p|s proces|
|00000f70| 73 20 2a 2f 0a 58 20 20 | 20 20 20 20 20 20 20 20 |s */.X | |
|00000f80| 20 20 20 20 20 20 20 20 | 20 20 20 20 20 20 20 20 | | |
|00000f90| 20 20 20 20 20 2f 2a 20 | 28 6d 61 6a 6f 72 20 70 | /* |(major p|
|00000fa0| 61 72 61 6e 6f 69 61 29 | 20 2a 2f 0a 58 20 20 20 |aranoia)| */.X |
|00000fb0| 20 72 65 74 75 72 6e 3b | 0a 7d 0a 58 0a 2f 2a 20 | return;|.}.X./* |
|00000fc0| 70 73 20 6f 75 74 70 75 | 74 20 61 6e 61 6c 79 73 |ps outpu|t analys|
|00000fd0| 65 72 2c 20 6d 61 69 6e | 6c 79 20 6a 75 73 74 20 |er, main|ly just |
|00000fe0| 74 6f 69 6c 65 72 20 72 | 6f 6c 6c 20 2a 2f 0a 69 |toiler r|oll */.i|
|00000ff0| 6e 74 20 2a 72 75 6e 5f | 70 73 28 76 6f 69 64 29 |nt *run_|ps(void)|
|00001000| 0a 7b 0a 58 20 20 20 20 | 73 74 61 74 69 63 20 69 |.{.X |static i|
|00001010| 6e 74 20 2a 6e 63 68 75 | 6e 6b 2c 20 2a 6e 6e 63 |nt *nchu|nk, *nnc|
|00001020| 68 75 6e 6b 3b 0a 58 20 | 20 20 20 69 6e 74 20 6d |hunk;.X | int m|
|00001030| 61 78 2c 20 70 6f 73 3b | 0a 58 20 20 20 20 69 6e |ax, pos;|.X in|
|00001040| 74 20 66 64 5b 32 5d 2c | 20 6e 75 6c 6c 3b 0a 58 |t fd[2],| null;.X|
|00001050| 20 20 20 20 46 49 4c 45 | 20 2a 69 6e 3b 0a 58 20 | FILE| *in;.X |
|00001060| 20 20 20 69 6e 74 20 63 | 2c 20 6e 75 6d 3b 0a 58 | int c|, num;.X|
|00001070| 20 20 20 20 70 69 64 5f | 74 20 70 69 64 3b 0a 58 | pid_|t pid;.X|
|00001080| 20 20 20 20 65 6e 75 6d | 20 7b 53 4b 49 50 5f 57 | enum| {SKIP_W|
|00001090| 53 2c 20 47 45 54 5f 4e | 55 4d 2c 20 53 4b 49 50 |S, GET_N|UM, SKIP|
|000010a0| 5f 45 4e 44 7d 20 6c 69 | 6e 65 3b 0a 58 0a 58 20 |_END} li|ne;.X.X |
|000010b0| 20 20 20 73 69 6e 67 61 | 6c 28 53 49 47 5f 43 48 | singa|l(SIG_CH|
|000010c0| 4c 44 2c 20 63 61 74 63 | 68 5f 63 68 6c 64 29 3b |LD, catc|h_chld);|
|000010d0| 0a 58 0a 58 20 20 20 20 | 69 66 20 28 28 6e 63 68 |.X.X |if ((nch|
|000010e0| 75 6e 6b 3d 6d 61 6c 6c | 6f 63 28 49 4e 49 54 41 |unk=mall|oc(INITA|
|000010f0| 4c 5f 4e 55 4d 53 29 29 | 3d 3d 4e 55 4c 4c 29 0a |L_NUMS))|==NULL).|
|00001100| 58 20 20 20 20 7b 0a 58 | 20 20 20 20 20 20 20 73 |X {.X| s|
|00001110| 79 73 6c 6f 67 28 22 49 | 6e 69 74 61 6c 20 6e 75 |yslog("I|nital nu|
|00001120| 6d 62 65 72 20 62 75 66 | 66 65 72 20 61 6c 6c 6f |mber buf|fer allo|
|00001130| 63 61 74 69 6f 6e 20 66 | 61 69 6c 75 72 65 22 29 |cation f|ailure")|
|00001140| 3b 0a 58 20 20 20 20 20 | 20 20 72 65 74 75 72 6e |;.X | return|
|00001150| 20 4e 55 4c 4c 3b 0a 58 | 20 20 20 20 7d 0a 58 0a | NULL;.X| }.X.|
|00001160| 58 20 20 20 20 69 66 20 | 28 28 6e 75 6c 6c 3d 6f |X if |((null=o|
|00001170| 70 65 6e 28 22 2f 64 65 | 76 2f 6e 75 6c 6c 22 2c |pen("/de|v/null",|
|00001180| 20 4f 5f 52 44 57 52 29 | 29 3d 3d 2d 31 29 0a 58 | O_RDWR)|)==-1).X|
|00001190| 20 20 20 20 7b 0a 58 20 | 20 20 20 20 20 20 73 79 | {.X | sy|
|000011a0| 73 6c 6f 67 28 22 43 6f | 75 6c 64 20 6e 6f 74 20 |slog("Co|uld not |
|000011b0| 6f 70 65 6e 20 2f 64 65 | 76 2f 6e 75 6c 6c 20 28 |open /de|v/null (|
|000011c0| 25 73 29 22 2c 20 73 74 | 72 65 72 72 6f 72 28 65 |%s)", st|rerror(e|
|000011d0| 72 72 6e 6f 29 29 3b 0a | 58 20 20 20 20 20 20 20 |rrno));.|X |
|000011e0| 72 65 74 75 72 6e 20 4e | 55 4c 4c 3b 0a 58 20 20 |return N|ULL;.X |
|000011f0| 20 20 7d 0a 58 0a 58 20 | 20 20 20 69 66 20 28 70 | }.X.X | if (p|
|00001200| 69 70 65 28 66 64 29 29 | 0a 58 20 20 20 20 7b 0a |ipe(fd))|.X {.|
|00001210| 58 20 20 20 20 20 20 20 | 73 79 73 6c 6f 67 28 22 |X |syslog("|
|00001220| 43 6f 75 6c 64 20 6e 6f | 74 20 63 72 65 61 74 65 |Could no|t create|
|00001230| 20 70 69 70 65 22 29 3b | 0a 58 20 20 20 20 20 20 | pipe");|.X |
|00001240| 20 66 72 65 65 28 6e 63 | 68 75 6e 6b 29 3b 0a 58 | free(nc|hunk);.X|
|00001250| 20 20 20 20 20 20 20 63 | 6c 6f 73 65 28 6e 75 6c | c|lose(nul|
|00001260| 6c 29 3b 0a 58 20 20 20 | 20 20 20 20 72 65 74 75 |l);.X | retu|
|00001270| 72 6e 20 4e 55 4c 4c 3b | 0a 58 20 20 20 20 7d 0a |rn NULL;|.X }.|
|00001280| 58 0a 58 20 20 20 20 69 | 66 20 28 28 69 6e 3d 66 |X.X i|f ((in=f|
|00001290| 64 6f 70 65 6e 28 66 64 | 5b 30 5d 2c 22 72 22 29 |dopen(fd|[0],"r")|
|000012a0| 29 3d 3d 4e 55 4c 4c 29 | 0a 58 20 20 20 20 7b 0a |)==NULL)|.X {.|
|000012b0| 58 20 20 20 20 20 20 20 | 73 79 73 6c 6f 67 28 22 |X |syslog("|
|000012c0| 66 64 6f 70 65 6e 20 66 | 61 69 6c 75 72 65 22 29 |fdopen f|ailure")|
|000012d0| 3b 0a 58 20 20 20 20 20 | 20 20 66 72 65 65 28 6e |;.X | free(n|
|000012e0| 63 68 75 6e 6b 29 3b 0a | 58 20 20 20 20 20 20 20 |chunk);.|X |
|000012f0| 63 6c 6f 73 65 28 6e 75 | 6c 6c 29 3b 0a 58 20 20 |close(nu|ll);.X |
|00001300| 20 20 20 20 20 63 6c 6f | 73 65 28 66 64 5b 30 5d | clo|se(fd[0]|
|00001310| 29 3b 0a 58 20 20 20 20 | 20 20 20 63 6c 6f 73 65 |);.X | close|
|00001320| 28 66 64 5b 31 5d 29 3b | 0a 58 20 20 20 20 20 20 |(fd[1]);|.X |
|00001330| 20 72 65 74 75 72 6e 20 | 4e 55 4c 4c 3b 0a 58 20 | return |NULL;.X |
|00001340| 20 20 20 7d 0a 58 0a 58 | 20 20 20 20 73 77 69 74 | }.X.X| swit|
|00001350| 63 68 28 70 69 64 3d 66 | 6f 72 6b 28 29 29 0a 58 |ch(pid=f|ork()).X|
|00001360| 20 20 20 20 7b 0a 58 20 | 20 20 20 63 61 73 65 20 | {.X | case |
|00001370| 2d 31 3a 0a 58 20 20 20 | 20 20 20 20 73 79 73 6c |-1:.X | sysl|
|00001380| 6f 67 28 22 46 6f 72 6b | 20 66 61 69 6c 65 64 22 |og("Fork| failed"|
|00001390| 29 3b 0a 58 20 20 20 20 | 20 20 20 66 72 65 65 28 |);.X | free(|
|000013a0| 6e 63 68 75 6e 6b 29 3b | 0a 58 20 20 20 20 20 20 |nchunk);|.X |
|000013b0| 20 63 6c 6f 73 65 28 6e | 75 6c 6c 29 3b 0a 58 20 | close(n|ull);.X |
|000013c0| 20 20 20 20 20 20 63 6c | 6f 73 65 28 66 64 5b 30 | cl|ose(fd[0|
|000013d0| 5d 29 3b 0a 58 20 20 20 | 20 20 20 20 63 6c 6f 73 |]);.X | clos|
|000013e0| 65 28 66 64 5b 31 5d 29 | 3b 0a 58 20 20 20 20 20 |e(fd[1])|;.X |
|000013f0| 20 20 72 65 74 75 72 6e | 20 4e 55 4c 4c 3b 0a 58 | return| NULL;.X|
|00001400| 0a 58 20 20 20 20 63 61 | 73 65 20 30 3a 20 2f 2a |.X ca|se 0: /*|
|00001410| 20 63 68 69 6c 64 20 2a | 2f 0a 58 20 20 20 20 20 | child *|/.X |
|00001420| 20 20 73 69 67 6e 61 6c | 28 53 49 47 5f 54 53 54 | signal|(SIG_TST|
|00001430| 50 2c 20 53 49 47 5f 49 | 47 4e 29 3b 20 2f 2a 20 |P, SIG_I|GN); /* |
|00001440| 53 74 6f 70 20 54 53 54 | 50 20 2a 2f 0a 58 20 20 |Stop TST|P */.X |
|00001450| 20 20 20 20 20 63 6c 6f | 73 65 28 66 64 5b 30 5d | clo|se(fd[0]|
|00001460| 29 3b 0a 58 20 20 20 20 | 20 20 20 63 6c 6f 73 65 |);.X | close|
|00001470| 28 30 29 3b 0a 58 20 20 | 20 20 20 20 20 63 6c 6f |(0);.X | clo|
|00001480| 73 65 28 31 29 3b 0a 58 | 20 20 20 20 20 20 20 63 |se(1);.X| c|
|00001490| 6c 6f 73 65 28 32 29 3b | 0a 58 20 20 20 20 20 20 |lose(2);|.X |
|000014a0| 20 64 75 70 32 28 6e 75 | 6c 6c 2c 30 29 3b 0a 58 | dup2(nu|ll,0);.X|
|000014b0| 20 20 20 20 20 20 20 64 | 75 70 32 28 66 64 5b 31 | d|up2(fd[1|
|000014c0| 5d 2c 31 29 3b 0a 58 20 | 20 20 20 20 20 20 64 75 |],1);.X | du|
|000014d0| 70 32 28 6e 75 6c 6c 2c | 32 29 3b 0a 58 20 20 20 |p2(null,|2);.X |
|000014e0| 20 20 20 20 65 78 65 63 | 28 22 2f 75 73 72 2f 62 | exec|("/usr/b|
|000014f0| 69 6e 2f 70 73 22 2c 22 | 61 78 22 29 3b 0a 58 20 |in/ps","|ax");.X |
|00001500| 20 20 20 20 20 20 65 78 | 69 74 28 30 29 3b 20 20 | ex|it(0); |
|00001510| 20 20 20 20 20 20 20 20 | 20 20 20 20 20 20 2f 2a | | /*|
|00001520| 20 53 68 6f 75 6c 64 20 | 6e 65 76 65 72 20 67 65 | Should |never ge|
|00001530| 74 20 68 65 72 65 20 2a | 2f 0a 58 0a 58 20 20 20 |t here *|/.X.X |
|00001540| 20 64 65 66 61 75 6c 74 | 3a 0a 58 20 20 20 20 20 | default|:.X |
|00001550| 20 20 63 6c 6f 73 65 28 | 66 64 5b 31 5d 29 3b 0a | close(|fd[1]);.|
|00001560| 58 20 20 20 20 20 20 20 | 63 6c 6f 73 65 28 6e 75 |X |close(nu|
|00001570| 6c 6c 29 3b 0a 58 20 20 | 20 20 20 20 20 62 72 65 |ll);.X | bre|
|00001580| 61 6b 3b 0a 58 20 20 20 | 20 7d 0a 58 20 20 20 20 |ak;.X | }.X |
|00001590| 6d 61 78 3d 49 4e 49 54 | 49 41 4c 5f 4e 55 4d 53 |max=INIT|IAL_NUMS|
|000015a0| 3b 20 70 6f 73 3d 30 3b | 0a 58 0a 58 20 20 20 20 |; pos=0;|.X.X |
|000015b0| 6c 69 6e 65 3d 53 4b 49 | 50 5f 45 4e 44 3b 20 20 |line=SKI|P_END; |
|000015c0| 20 20 20 20 20 20 20 20 | 20 20 20 2f 2a 20 53 6b | | /* Sk|
|000015d0| 69 70 20 31 73 74 20 6c | 69 6e 65 20 2a 2f 0a 58 |ip 1st l|ine */.X|
|000015e0| 20 20 20 20 77 68 69 6c | 65 28 28 63 3d 66 67 65 | whil|e((c=fge|
|000015f0| 74 63 28 69 6e 29 29 21 | 3d 45 4f 46 29 0a 58 20 |tc(in))!|=EOF).X |
|00001600| 20 20 20 7b 0a 58 20 20 | 20 20 20 20 20 73 77 69 | {.X | swi|
|00001610| 74 63 68 28 6c 69 6e 65 | 29 0a 58 20 20 20 20 20 |tch(line|).X |
|00001620| 20 20 7b 0a 58 20 20 20 | 20 20 20 20 63 61 73 65 | {.X | case|
|00001630| 20 53 4b 49 50 5f 57 53 | 3a 0a 58 20 20 20 20 20 | SKIP_WS|:.X |
|00001640| 20 20 20 20 20 20 69 66 | 20 28 69 73 77 68 69 74 | if| (iswhit|
|00001650| 65 28 63 29 29 0a 58 20 | 20 20 20 20 20 20 20 20 |e(c)).X | |
|00001660| 20 20 20 20 20 20 63 6f | 6e 74 69 6e 75 65 3b 0a | co|ntinue;.|
|00001670| 58 20 20 20 20 20 20 20 | 20 20 20 20 6e 75 6d 3d |X | num=|
|00001680| 30 3b 0a 58 20 20 20 20 | 20 20 20 20 20 20 20 73 |0;.X | s|
|00001690| 6c 69 6e 65 3d 47 45 54 | 5f 4e 55 4d 3b 0a 58 20 |line=GET|_NUM;.X |
|000016a0| 20 20 20 20 20 20 20 20 | 20 20 2f 2a 20 46 41 4c | | /* FAL|
|000016b0| 4c 20 54 48 52 55 20 2a | 2f 0a 58 20 20 20 20 20 |L THRU *|/.X |
|000016c0| 20 20 63 61 73 65 20 47 | 45 54 5f 4e 55 4d 3a 0a | case G|ET_NUM:.|
|000016d0| 58 20 20 20 20 20 20 20 | 20 20 20 20 69 66 20 28 |X | if (|
|000016e0| 69 73 64 69 67 69 74 28 | 63 29 29 0a 58 20 20 20 |isdigit(|c)).X |
|000016f0| 20 20 20 20 20 20 20 20 | 7b 0a 58 20 20 20 20 20 | |{.X |
|00001700| 20 20 20 20 20 20 20 20 | 20 20 6e 75 6d 3d 6e 75 | | num=nu|
|00001710| 6d 2a 31 30 2b 28 63 2d | 27 30 27 29 3b 0a 58 20 |m*10+(c-|'0');.X |
|00001720| 20 20 20 20 20 20 20 20 | 20 20 20 20 20 20 63 6f | | co|
|00001730| 6e 74 69 6e 75 65 3b 0a | 58 20 20 20 20 20 20 20 |ntinue;.|X |
|00001740| 20 20 20 20 7d 0a 58 20 | 20 20 20 20 20 20 20 20 | }.X | |
|00001750| 20 20 69 66 20 28 6e 75 | 6d 21 3d 70 69 64 29 0a | if (nu|m!=pid).|
|00001760| 58 20 20 20 20 20 20 20 | 20 20 20 20 7b 0a 58 20 |X | {.X |
|00001770| 20 20 20 20 20 20 20 20 | 20 20 20 20 20 20 2f 2a | | /*|
|00001780| 20 43 68 65 63 6b 20 66 | 6f 72 20 6f 76 65 72 66 | Check f|or overf|
|00001790| 6c 6f 77 73 2c 20 49 20 | 61 6d 20 70 61 72 61 6e |lows, I |am paran|
|000017a0| 6f 69 64 2c 20 4d 41 58 | 58 5f 4e 55 4d 53 20 69 |oid, MAX|X_NUMS i|
|000017b0| 73 20 74 6f 20 73 74 6f | 70 0a 58 20 20 20 20 20 |s to sto|p.X |
|000017c0| 20 20 20 20 20 20 20 20 | 20 20 20 20 20 73 69 6d | | sim|
|000017d0| 70 6c 65 20 44 6f 53 20 | 61 74 74 61 63 6b 73 20 |ple DoS |attacks |
|000017e0| 77 69 74 68 20 61 20 66 | 69 78 65 64 20 76 65 72 |with a f|ixed ver|
|000017f0| 73 69 6f 6e 20 6f 66 20 | 70 73 2e 20 2a 2f 0a 58 |sion of |ps. */.X|
|00001800| 20 20 20 20 20 20 20 20 | 20 20 20 20 20 20 20 69 | | i|
|00001810| 66 20 28 70 6f 73 3d 3d | 6d 61 78 29 0a 58 20 20 |f (pos==|max).X |
|00001820| 20 20 20 20 20 20 20 20 | 20 20 20 20 20 7b 0a 58 | | {.X|
|00001830| 20 20 20 20 20 20 20 20 | 20 20 20 20 20 20 20 20 | | |
|00001840| 20 20 20 69 66 28 6d 61 | 78 3e 4d 41 58 58 5f 4e | if(ma|x>MAXX_N|
|00001850| 55 4d 53 20 7c 7c 0a 58 | 20 20 20 20 20 20 20 20 |UMS ||.X| |
|00001860| 20 20 20 20 20 20 20 20 | 20 20 20 20 20 20 28 6e | | (n|
|00001870| 6e 63 68 75 6e 6b 3d 6d | 61 6c 6c 6f 63 28 73 69 |nchunk=m|alloc(si|
|00001880| 7a 65 6f 66 28 69 6e 74 | 29 2a 28 6d 61 78 2b 49 |zeof(int|)*(max+I|
|00001890| 4e 43 29 29 29 3d 3d 4e | 55 4c 4c 29 0a 58 20 20 |NC)))==N|ULL).X |
|000018a0| 20 20 20 20 20 20 20 20 | 20 20 20 20 20 20 20 20 | | |
|000018b0| 20 7b 0a 58 20 20 20 20 | 20 20 20 20 20 20 20 20 | {.X | |
|000018c0| 20 20 20 20 20 20 20 20 | 20 20 20 73 79 73 6c 6f | | syslo|
|000018d0| 67 28 4c 4f 47 5f 4e 4f | 54 49 43 45 2c 0a 58 20 |g(LOG_NO|TICE,.X |
|000018e0| 20 20 20 20 20 20 20 20 | 20 20 20 20 20 20 20 20 | | |
|000018f0| 20 20 20 20 20 20 20 20 | 20 20 20 20 20 22 45 78 | | "Ex|
|00001900| 70 61 6e 73 69 6f 6e 20 | 66 61 69 6c 75 72 65 20 |pansion |failure |
|00001910| 28 25 64 20 70 72 6f 63 | 73 29 22 2c 20 6d 61 78 |(%d proc|s)", max|
|00001920| 29 3b 0a 58 20 20 20 20 | 20 20 20 20 20 20 20 20 |);.X | |
|00001930| 20 20 20 20 20 20 20 20 | 20 20 20 66 72 65 65 28 | | free(|
|00001940| 6e 63 68 75 6e 6b 29 3b | 0a 58 20 20 20 20 20 20 |nchunk);|.X |
|00001950| 20 20 20 20 20 20 20 20 | 20 20 20 20 20 20 20 20 | | |
|00001960| 20 66 63 6c 6f 73 65 28 | 69 6e 29 3b 0a 58 20 20 | fclose(|in);.X |
|00001970| 20 20 20 20 20 20 20 20 | 20 20 20 20 20 20 20 20 | | |
|00001980| 20 20 20 20 20 72 65 74 | 75 72 6e 20 4e 55 4c 4c | ret|urn NULL|
|00001990| 3b 0a 58 20 20 20 20 20 | 20 20 20 20 20 20 20 20 |;.X | |
|000019a0| 20 20 20 20 20 20 7d 0a | 58 20 20 20 20 20 20 20 | }.|X |
|000019b0| 20 20 20 20 20 20 20 20 | 20 20 20 20 66 6f 72 20 | | for |
|000019c0| 28 70 6f 73 3d 30 3b 20 | 70 6f 73 3c 6d 61 78 3b |(pos=0; |pos<max;|
|000019d0| 20 70 6f 73 2b 2b 29 0a | 58 20 20 20 20 20 20 20 | pos++).|X |
|000019e0| 20 20 20 20 20 20 20 20 | 20 20 20 20 20 20 20 20 | | |
|000019f0| 6e 6e 63 68 75 6e 6b 5b | 70 6f 73 5d 3d 6e 63 68 |nnchunk[|pos]=nch|
|00001a00| 75 6e 6b 5b 70 6f 73 5d | 3b 0a 58 20 20 20 20 20 |unk[pos]|;.X |
|00001a10| 20 20 20 20 20 20 20 20 | 20 20 20 20 20 20 66 72 | | fr|
|00001a20| 65 65 28 6e 63 68 75 6e | 6b 29 3b 0a 58 20 20 20 |ee(nchun|k);.X |
|00001a30| 20 20 20 20 20 20 20 20 | 20 20 20 20 20 20 20 20 | | |
|00001a40| 6e 63 68 75 6e 6b 3d 6e | 6e 63 68 75 6e 6b 3b 0a |nchunk=n|nchunk;.|
|00001a50| 58 20 20 20 20 20 20 20 | 20 20 20 20 20 20 20 20 |X | |
|00001a60| 20 20 20 20 6d 61 78 2b | 3d 49 4e 43 3b 0a 58 20 | max+|=INC;.X |
|00001a70| 20 20 20 20 20 20 20 20 | 20 20 20 20 20 20 7d 0a | | }.|
|00001a80| 58 20 20 20 20 20 20 20 | 20 20 20 20 20 20 20 20 |X | |
|00001a90| 6e 75 6d 73 5b 70 6f 73 | 2b 2b 5d 3d 6e 75 6d 3b |nums[pos|++]=num;|
|00001aa0| 0a 58 20 20 20 20 20 20 | 20 20 20 20 20 7d 0a 58 |.X | }.X|
|00001ab0| 20 20 20 20 20 20 20 20 | 20 20 20 6c 69 6e 65 3d | | line=|
|00001ac0| 53 4b 49 50 5f 45 4e 44 | 3b 0a 58 20 20 20 20 20 |SKIP_END|;.X |
|00001ad0| 20 20 20 20 20 20 2f 2a | 20 46 41 4c 4c 20 54 48 | /*| FALL TH|
|00001ae0| 52 55 20 2a 2f 0a 58 0a | 58 20 20 20 20 20 20 20 |RU */.X.|X |
|00001af0| 63 61 73 65 20 53 4b 49 | 50 5f 45 4e 44 3a 0a 58 |case SKI|P_END:.X|
|00001b00| 20 20 20 20 20 20 20 20 | 20 20 20 69 66 20 28 63 | | if (c|
|00001b10| 3d 3d 27 5c 6e 27 29 0a | 58 20 20 20 20 20 20 20 |=='\n').|X |
|00001b20| 20 20 20 20 20 20 20 20 | 6c 69 6e 65 3d 53 4b 49 | |line=SKI|
|00001b30| 50 5f 57 53 3b 0a 58 20 | 20 20 20 20 20 20 20 20 |P_WS;.X | |
|00001b40| 20 20 62 72 65 61 6b 3b | 0a 58 0a 58 20 20 20 20 | break;|.X.X |
|00001b50| 20 20 20 64 65 66 61 75 | 6c 74 3a 0a 58 20 20 20 | defau|lt:.X |
|00001b60| 20 20 20 20 20 20 20 20 | 73 79 73 6c 6f 67 28 22 | |syslog("|
|00001b70| 49 6d 70 6f 73 69 62 6c | 65 20 73 74 61 74 65 22 |Imposibl|e state"|
|00001b80| 29 3b 0a 58 20 20 20 20 | 20 20 20 20 20 20 20 66 |);.X | f|
|00001b90| 72 65 65 28 6e 63 68 75 | 6e 6b 29 3b 0a 58 20 20 |ree(nchu|nk);.X |
|00001ba0| 20 20 20 20 20 20 20 20 | 20 66 63 6c 6f 73 65 28 | | fclose(|
|00001bb0| 69 6e 29 3b 0a 58 20 20 | 20 20 20 20 20 20 20 20 |in);.X | |
|00001bc0| 20 72 65 74 75 72 6e 20 | 4e 55 4c 4c 3b 0a 58 20 | return |NULL;.X |
|00001bd0| 20 20 20 20 20 20 7d 0a | 58 20 20 20 20 7d 0a 58 | }.|X }.X|
|00001be0| 20 20 20 20 73 6c 65 65 | 70 28 31 38 30 29 3b 20 | slee|p(180); |
|00001bf0| 20 20 20 20 20 20 20 20 | 20 20 20 20 20 20 20 20 | | |
|00001c00| 20 20 20 20 20 20 20 2f | 2a 20 57 61 69 74 20 33 | /|* Wait 3|
|00001c10| 20 6d 69 6e 73 20 2a 2f | 0a 58 20 20 20 20 6b 69 | mins */|.X ki|
|00001c20| 6c 6c 28 70 69 64 2c 20 | 53 49 47 4b 49 4c 4c 29 |ll(pid, |SIGKILL)|
|00001c30| 3b 20 20 20 20 20 20 20 | 20 20 20 20 20 20 20 20 |; | |
|00001c40| 20 2f 2a 20 4b 69 6c 6c | 20 70 73 20 28 73 74 6f | /* Kill| ps (sto|
|00001c50| 70 20 70 73 20 44 6f 53 | 20 61 74 74 61 63 6b 29 |p ps DoS| attack)|
|00001c60| 20 2a 2f 0a 58 0a 58 20 | 20 20 20 2f 2a 20 4e 6f | */.X.X | /* No|
|00001c70| 20 6e 65 65 64 20 74 6f | 20 77 61 69 74 2c 20 53 | need to| wait, S|
|00001c80| 49 47 43 48 4c 44 20 68 | 61 6e 64 6c 65 72 20 64 |IGCHLD h|andler d|
|00001c90| 6f 65 73 20 74 68 61 74 | 20 2a 2f 0a 58 0a 58 20 |oes that| */.X.X |
|00001ca0| 20 20 20 2f 2a 20 41 64 | 64 20 2d 31 20 74 6f 20 | /* Ad|d -1 to |
|00001cb0| 65 6e 64 2c 20 6d 69 67 | 68 74 20 6e 65 65 64 20 |end, mig|ht need |
|00001cc0| 74 6f 20 65 78 70 61 6e | 64 20 62 75 66 66 65 72 |to expan|d buffer|
|00001cd0| 20 2e 2e 2e 20 2a 2f 0a | 58 20 20 20 20 69 66 20 | ... */.|X if |
|00001ce0| 28 70 6f 73 3d 3d 6d 61 | 78 29 0a 58 20 20 20 20 |(pos==ma|x).X |
|00001cf0| 7b 0a 58 20 20 20 20 20 | 20 20 69 66 20 28 28 6e |{.X | if ((n|
|00001d00| 6e 63 68 75 6e 6b 3d 6d | 61 6c 6c 6f 63 28 73 69 |nchunk=m|alloc(si|
|00001d10| 7a 65 6f 66 28 69 6e 74 | 29 2a 28 6d 61 78 2b 31 |zeof(int|)*(max+1|
|00001d20| 29 29 29 3d 3d 4e 55 4c | 4c 29 61 73 0a 58 20 20 |)))==NUL|L)as.X |
|00001d30| 20 20 20 20 20 7b 0a 58 | 20 20 20 20 20 20 20 20 | {.X| |
|00001d40| 20 20 20 73 79 73 6c 6f | 67 28 4c 4f 47 5f 4e 4f | syslo|g(LOG_NO|
|00001d50| 54 49 43 45 2c 20 22 45 | 78 70 61 6e 73 69 6f 6e |TICE, "E|xpansion|
|00001d60| 20 66 61 69 6c 75 72 65 | 20 28 25 64 20 70 72 6f | failure| (%d pro|
|00001d70| 63 73 29 22 2c 20 6d 61 | 78 29 3b 0a 58 20 20 20 |cs)", ma|x);.X |
|00001d80| 20 20 20 20 20 20 20 20 | 66 72 65 65 28 6e 63 68 | |free(nch|
|00001d90| 75 6e 6b 29 3b 0a 58 20 | 20 20 20 20 20 20 20 20 |unk);.X | |
|00001da0| 20 20 66 63 6c 6f 73 65 | 28 69 6e 29 3b 0a 58 20 | fclose|(in);.X |
|00001db0| 20 20 20 20 20 20 20 20 | 20 20 72 65 74 75 72 6e | | return|
|00001dc0| 20 4e 55 4c 4c 3b 0a 58 | 20 20 20 20 20 20 20 7d | NULL;.X| }|
|00001dd0| 0a 58 20 20 20 20 20 20 | 20 66 6f 72 20 28 70 6f |.X | for (po|
|00001de0| 73 3d 30 3b 20 70 6f 73 | 3c 6d 61 78 3b 20 70 6f |s=0; pos|<max; po|
|00001df0| 73 2b 2b 29 0a 58 20 20 | 20 20 20 20 20 20 20 20 |s++).X | |
|00001e00| 20 6e 6e 63 68 75 6e 6b | 5b 70 6f 73 5d 3d 6e 63 | nnchunk|[pos]=nc|
|00001e10| 68 75 6e 6b 5b 70 6f 73 | 5d 3b 0a 58 20 20 20 20 |hunk[pos|];.X |
|00001e20| 20 20 20 66 72 65 65 28 | 6e 63 68 75 6e 6b 29 3b | free(|nchunk);|
|00001e30| 0a 58 20 20 20 20 20 20 | 20 6e 63 68 75 6e 6b 3d |.X | nchunk=|
|00001e40| 6e 6e 63 68 75 6e 6b 3b | 0a 58 20 20 20 20 20 20 |nnchunk;|.X |
|00001e50| 20 6d 61 78 2b 3d 31 3b | 0a 58 20 20 20 20 7d 0a | max+=1;|.X }.|
|00001e60| 58 20 20 20 20 6e 75 6d | 73 5b 70 6f 73 2b 2b 5d |X num|s[pos++]|
|00001e70| 3d 2d 31 3b 20 20 20 20 | 20 20 20 20 20 20 20 20 |=-1; | |
|00001e80| 2f 2a 20 45 6e 64 20 6d | 61 72 6b 65 72 20 2a 2f |/* End m|arker */|
|00001e90| 0a 58 20 20 20 20 72 65 | 74 75 72 6e 20 6e 63 68 |.X re|turn nch|
|00001ea0| 75 6e 6b 3b 0a 7d 0a 58 | 0a 2f 2a 20 69 73 20 6e |unk;.}.X|./* is n|
|00001eb0| 75 6d 62 65 72 20 74 65 | 73 74 65 72 20 2a 2f 0a |umber te|ster */.|
|00001ec0| 69 6e 74 20 69 73 5f 6e | 75 6d 28 63 6f 6e 73 74 |int is_n|um(const|
|00001ed0| 20 63 68 61 72 20 2a 73 | 29 0a 7b 0a 58 20 20 20 | char *s|).{.X |
|00001ee0| 20 69 64 20 28 2a 73 3d | 3d 27 5c 30 27 29 0a 58 | id (*s=|='\0').X|
|00001ef0| 20 20 20 20 20 20 20 72 | 65 74 75 72 6e 20 30 3b | r|eturn 0;|
|00001f00| 0a 58 20 20 20 20 77 68 | 69 6c 65 20 28 69 73 64 |.X wh|ile (isd|
|00001f10| 69 67 69 74 28 2a 73 29 | 29 20 73 2b 2b 3b 0a 58 |igit(*s)|) s++;.X|
|00001f20| 20 20 20 20 69 66 20 28 | 2a 73 21 3d 27 5c 30 27 | if (|*s!='\0'|
|00001f30| 29 0a 58 20 20 20 20 20 | 20 20 72 65 74 75 72 6e |).X | return|
|00001f40| 20 30 3b 0a 7d 0a 58 0a | 2f 2a 20 43 68 65 63 6b | 0;.}.X.|/* Check|
|00001f50| 20 63 6f 72 72 65 6c 61 | 74 69 6f 6e 20 77 69 74 | correla|tion wit|
|00001f60| 68 20 2f 70 72 6f 63 20 | 2a 2f 0a 76 6f 69 64 20 |h /proc |*/.void |
|00001f70| 61 6e 61 6c 79 73 65 5f | 6e 75 6d 73 28 69 6e 74 |analyse_|nums(int|
|00001f80| 20 2a 6e 75 6d 73 29 0a | 7b 0a 58 20 20 20 20 44 | *nums).|{.X D|
|00001f90| 49 52 20 2a 64 70 3b 0a | 58 20 20 20 20 73 74 72 |IR *dp;.|X str|
|00001fa0| 75 63 74 20 64 69 72 65 | 6e 74 20 2a 66 69 6c 65 |uct dire|nt *file|
|00001fb0| 70 3b 0a 58 20 20 20 20 | 69 6e 74 20 70 72 6f 62 |p;.X |int prob|
|00001fc0| 65 64 5f 70 69 64 3b 0a | 58 20 20 20 20 69 6e 74 |ed_pid;.|X int|
|00001fd0| 20 69 3b 0a 58 0a 58 20 | 20 20 20 69 66 20 28 28 | i;.X.X | if ((|
|00001fe0| 64 70 3d 6f 70 65 6e 64 | 69 72 28 22 2f 70 72 6f |dp=opend|ir("/pro|
|00001ff0| 63 22 29 29 3d 3d 4e 55 | 4c 4c 29 0a 58 20 20 20 |c"))==NU|LL).X |
|00002000| 20 7b 0a 58 20 20 20 20 | 20 20 20 73 79 73 6c 6f | {.X | syslo|
|00002010| 67 28 22 2f 70 72 6f 63 | 20 6e 6f 74 20 66 6f 75 |g("/proc| not fou|
|00002020| 6e 64 21 22 29 3b 0a 58 | 20 20 20 20 20 20 20 62 |nd!");.X| b|
|00002030| 72 65 61 6b 3b 0a 58 20 | 20 20 20 7d 0a 58 0a 58 |reak;.X | }.X.X|
|00002040| 20 20 20 20 2f 2a 20 4d | 61 6b 65 20 73 75 72 65 | /* M|ake sure|
|00002050| 20 61 6c 6c 20 70 69 64 | 73 20 61 72 65 20 6c 69 | all pid|s are li|
|00002060| 73 74 65 64 20 2a 2f 0a | 58 20 20 20 20 77 68 69 |sted */.|X whi|
|00002070| 6c 65 20 28 28 66 69 6c | 65 70 3d 72 65 61 64 64 |le ((fil|ep=readd|
|00002080| 69 72 28 64 70 29 29 21 | 3d 4e 55 4c 4c 29 0a 58 |ir(dp))!|=NULL).X|
|00002090| 20 20 20 20 7b 0a 58 20 | 20 20 20 20 20 20 69 66 | {.X | if|
|000020a0| 20 28 69 73 5f 6e 75 6d | 28 64 70 2d 3e 64 5f 6e | (is_num|(dp->d_n|
|000020b0| 61 6d 65 29 29 0a 58 20 | 20 20 20 20 20 20 7b 0a |ame)).X | {.|
|000020c0| 58 20 20 20 20 20 20 20 | 20 20 20 20 70 72 6f 62 |X | prob|
|000020d0| 65 64 5f 70 69 64 3d 61 | 74 6f 69 28 64 70 2d 3e |ed_pid=a|toi(dp->|
|000020e0| 64 5f 6e 61 6d 65 29 3b | 0a 58 20 20 20 20 20 20 |d_name);|.X |
|000020f0| 20 20 20 20 20 66 6f 72 | 20 28 69 3d 30 3b 20 6e | for| (i=0; n|
|00002100| 75 6d 73 5b 69 5d 21 3d | 2d 31 3b 20 69 2b 2b 29 |ums[i]!=|-1; i++)|
|00002110| 0a 58 20 20 20 20 20 20 | 20 20 20 20 20 7b 0a 58 |.X | {.X|
|00002120| 20 20 20 20 20 20 20 20 | 20 20 20 20 20 20 20 69 | | i|
|00002130| 66 20 28 28 70 69 64 5f | 74 29 20 70 72 6f 62 65 |f ((pid_|t) probe|
|00002140| 64 5f 70 69 64 3d 3d 6e | 75 6d 73 5b 69 5d 29 0a |d_pid==n|ums[i]).|
|00002150| 58 20 20 20 20 20 20 20 | 20 20 20 20 20 20 20 20 |X | |
|00002160| 7b 0a 58 20 20 20 20 20 | 20 20 20 20 20 20 20 20 |{.X | |
|00002170| 20 20 20 20 20 20 6e 75 | 6d 73 5b 70 69 64 5d 3d | nu|ms[pid]=|
|00002180| 2d 32 3b 20 2f 2a 20 55 | 73 65 64 20 6d 61 72 6b |-2; /* U|sed mark|
|00002190| 65 64 20 2a 2f 0a 58 20 | 20 20 20 20 20 20 20 20 |ed */.X | |
|000021a0| 20 20 20 20 20 20 20 20 | 20 20 63 6f 6e 74 69 6e | | contin|
|000021b0| 75 65 3b 20 2f 2a 20 63 | 6f 6e 74 69 6e 75 65 20 |ue; /* c|ontinue |
|000021c0| 2a 2f 0a 58 20 20 20 20 | 20 20 20 20 20 20 20 20 |*/.X | |
|000021d0| 20 20 20 7d 0a 58 20 20 | 20 20 20 20 20 20 20 20 | }.X | |
|000021e0| 20 7d 0a 58 20 20 20 20 | 20 20 20 20 20 20 20 73 | }.X | s|
|000021f0| 79 73 6c 6f 67 28 4c 4f | 47 5f 4e 4f 54 49 43 45 |yslog(LO|G_NOTICE|
|00002200| 2c 0a 58 20 20 20 20 20 | 20 20 20 20 20 20 20 20 |,.X | |
|00002210| 20 20 20 20 20 22 68 61 | 63 6b 65 64 20 70 73 3a | "ha|cked ps:|
|00002220| 20 70 69 64 20 25 64 20 | 6e 6f 74 20 6d 61 74 63 | pid %d |not matc|
|00002230| 68 65 64 2c 20 6e 75 6b | 69 6e 67 20 69 74 22 2c |hed, nuk|ing it",|
|00002240| 20 70 6f 72 62 65 64 5f | 70 69 64 29 3b 0a 58 20 | porbed_|pid);.X |
|00002250| 20 20 20 20 20 20 20 20 | 20 20 6e 75 6b 65 5f 70 | | nuke_p|
|00002260| 72 6f 63 65 73 73 28 70 | 69 64 29 3b 0a 58 20 20 |rocess(p|id);.X |
|00002270| 20 20 20 20 20 7d 0a 58 | 20 20 20 20 7d 0a 58 0a | }.X| }.X.|
|00002280| 58 20 20 20 20 2f 2a 20 | 43 68 65 63 6b 20 66 6f |X /* |Check fo|
|00002290| 72 20 66 61 6b 65 20 70 | 69 64 73 20 2a 2f 0a 58 |r fake p|ids */.X|
|000022a0| 20 20 20 20 66 6f 72 20 | 28 69 3d 30 3b 20 6e 75 | for |(i=0; nu|
|000022b0| 6d 73 5b 69 5d 21 3d 2d | 31 3b 20 69 2b 2b 29 0a |ms[i]!=-|1; i++).|
|000022c0| 58 20 20 20 20 7b 0a 58 | 20 20 20 20 20 20 20 69 |X {.X| i|
|000022d0| 66 20 28 6e 75 6d 73 5b | 69 5d 21 3d 2d 32 29 0a |f (nums[|i]!=-2).|
|000022e0| 58 20 20 20 20 20 20 20 | 20 20 20 20 73 79 73 6c |X | sysl|
|000022f0| 6f 67 28 4c 4f 47 5f 4e | 4f 54 49 43 45 2c 22 68 |og(LOG_N|OTICE,"h|
|00002300| 61 63 6b 65 64 20 70 73 | 3a 20 66 61 6b 65 20 70 |acked ps|: fake p|
|00002310| 69 64 20 25 64 20 69 6e | 73 65 72 74 65 64 22 2c |id %d in|serted",|
|00002320| 20 6e 75 6d 73 5b 69 5d | 29 3b 0a 58 20 20 20 20 | nums[i]|);.X |
|00002330| 7d 0a 7d 0a 58 0a 2f 2a | 20 64 65 6d 6f 6e 20 62 |}.}.X./*| demon b|
|00002340| 6f 64 79 20 2a 2f 0a 76 | 6f 69 64 20 64 65 6d 6f |ody */.v|oid demo|
|00002350| 6e 5f 62 6f 64 79 28 76 | 6f 69 64 29 0a 7b 0a 58 |n_body(v|oid).{.X|
|00002360| 20 20 20 20 69 6e 74 20 | 2a 6e 75 6d 73 3b 0a 58 | int |*nums;.X|
|00002370| 0a 58 20 20 20 20 77 68 | 69 6c 65 28 31 29 0a 58 |.X wh|ile(1).X|
|00002380| 20 20 20 20 7b 0a 58 20 | 20 20 20 20 20 20 69 66 | {.X | if|
|00002390| 20 28 28 6e 75 6d 73 3d | 72 75 6e 5f 70 73 28 29 | ((nums=|run_ps()|
|000023a0| 29 3d 3d 4e 55 4c 4c 29 | 0a 58 20 20 20 20 20 20 |)==NULL)|.X |
|000023b0| 20 7b 0a 58 20 20 20 20 | 20 20 20 20 20 20 20 73 | {.X | s|
|000023c0| 79 73 6c 6f 67 28 4c 4f | 47 5f 4e 4f 54 49 43 45 |yslog(LO|G_NOTICE|
|000023d0| 2c 20 22 72 75 6e 5f 70 | 73 20 66 61 69 6c 65 64 |, "run_p|s failed|
|000023e0| 22 29 3b 0a 58 20 20 20 | 20 20 20 20 20 20 20 20 |");.X | |
|000023f0| 73 6c 65 65 70 20 28 35 | 30 29 3b 0a 58 20 20 20 |sleep (5|0);.X |
|00002400| 20 20 20 20 20 20 20 20 | 63 6f 6e 74 69 6e 75 65 | |continue|
|00002410| 3b 0a 58 20 20 20 20 20 | 20 20 7d 0a 58 20 20 20 |;.X | }.X |
|00002420| 20 20 20 20 61 6e 61 6c | 79 73 65 5f 6e 75 6d 73 | anal|yse_nums|
|00002430| 28 6e 75 6d 73 29 3b 0a | 58 20 20 20 20 20 20 20 |(nums);.|X |
|00002440| 66 72 65 65 28 6e 75 6d | 73 29 3b 0a 58 20 20 20 |free(num|s);.X |
|00002450| 20 20 20 20 73 6c 65 65 | 70 28 36 30 30 29 3b 20 | slee|p(600); |
|00002460| 20 20 20 20 20 20 20 20 | 20 20 20 20 2f 2a 20 53 | | /* S|
|00002470| 6c 65 65 70 20 31 30 20 | 6d 69 6e 73 20 2a 2f 0a |leep 10 |mins */.|
|00002480| 58 20 20 20 20 7d 0a 7d | 0a 58 0a 2f 2a 20 43 6f |X }.}|.X./* Co|
|00002490| 64 65 20 74 6f 20 6d 61 | 6b 65 20 6d 65 20 68 61 |de to ma|ke me ha|
|000024a0| 72 64 20 74 6f 20 6b 69 | 6c 6c 20 2a 2f 0a 76 6f |rd to ki|ll */.vo|
|000024b0| 69 64 20 72 65 73 74 61 | 72 74 5f 6d 65 28 69 6e |id resta|rt_me(in|
|000024c0| 74 20 73 69 67 29 0a 7b | 0a 58 20 20 20 20 70 69 |t sig).{|.X pi|
|000024d0| 64 5f 74 20 70 69 64 3b | 0a 58 20 20 20 20 69 6e |d_t pid;|.X in|
|000024e0| 74 20 2a 73 74 61 74 75 | 73 3b 0a 58 0a 58 20 20 |t *statu|s;.X.X |
|000024f0| 20 20 73 69 67 3d 73 69 | 67 3b 0a 58 20 20 20 20 | sig=si|g;.X |
|00002500| 70 69 64 3d 77 61 69 74 | 28 26 73 74 61 74 75 73 |pid=wait|(&status|
|00002510| 29 3b 0a 58 20 20 20 20 | 69 66 20 28 57 49 46 5f |);.X |if (WIF_|
|00002520| 53 54 4f 50 50 45 44 28 | 73 74 61 74 75 73 29 29 |STOPPED(|status))|
|00002530| 0a 58 20 20 20 20 7b 0a | 58 20 20 20 20 20 20 20 |.X {.|X |
|00002540| 6b 69 6c 6c 20 28 70 69 | 64 2c 20 53 49 47 43 4f |kill (pi|d, SIGCO|
|00002550| 4e 54 29 3b 20 20 20 20 | 2f 2a 20 55 6e 73 74 6f |NT); |/* Unsto|
|00002560| 70 20 6d 65 20 2a 2f 0a | 58 20 20 20 20 20 20 20 |p me */.|X |
|00002570| 72 65 74 75 72 6e 3b 0a | 58 20 20 20 20 7d 0a 58 |return;.|X }.X|
|00002580| 20 20 20 20 73 77 69 74 | 63 68 28 70 69 64 3d 66 | swit|ch(pid=f|
|00002590| 6f 72 6b 28 29 29 0a 58 | 20 20 20 20 7b 0a 58 20 |ork()).X| {.X |
|000025a0| 20 20 20 63 61 73 65 20 | 2d 31 3a 0a 58 20 20 20 | case |-1:.X |
|000025b0| 20 20 20 20 73 79 73 6c | 6f 67 28 22 43 6f 75 6c | sysl|og("Coul|
|000025c0| 64 20 6e 6f 74 20 66 6f | 72 6b 28 29 20 61 6e 6f |d not fo|rk() ano|
|000025d0| 74 68 65 72 20 63 6f 70 | 79 20 6f 66 20 6d 79 73 |ther cop|y of mys|
|000025e0| 65 6c 66 22 29 3b 0a 58 | 20 20 20 20 20 20 20 62 |elf");.X| b|
|000025f0| 72 65 61 6b 3b 0a 58 0a | 58 20 20 20 20 63 61 73 |reak;.X.|X cas|
|00002600| 65 20 30 3a 0a 58 20 20 | 20 20 20 20 20 73 65 74 |e 0:.X | set|
|00002610| 70 67 69 64 28 67 65 74 | 70 69 64 28 29 2c 20 67 |pgid(get|pid(), g|
|00002620| 65 74 70 69 64 28 29 29 | 3b 20 2f 2a 20 4d 61 6b |etpid())|; /* Mak|
|00002630| 65 20 6e 65 77 20 70 72 | 6f 63 20 67 72 6f 75 70 |e new pr|oc group|
|00002640| 20 2a 2f 0a 58 20 20 20 | 20 20 20 20 64 65 6d 6f | */.X | demo|
|00002650| 6e 5f 62 6f 64 79 28 29 | 3b 20 20 20 20 20 20 20 |n_body()|; |
|00002660| 20 20 20 20 2f 2a 20 50 | 65 72 66 72 6f 6d 20 63 | /* P|erfrom c|
|00002670| 68 65 63 6b 73 20 2a 2f | 0a 58 20 20 20 20 20 20 |hecks */|.X |
|00002680| 20 73 79 73 6c 6f 67 28 | 22 4f 6f 70 73 21 20 44 | syslog(|"Oops! D|
|00002690| 65 6d 6f 6e 20 62 6f 64 | 79 20 72 65 74 75 72 6e |emon bod|y return|
|000026a0| 65 64 2c 20 65 78 69 74 | 74 69 6e 67 22 29 3b 0a |ed, exit|ting");.|
|000026b0| 58 20 20 20 20 20 20 20 | 65 78 69 74 28 30 29 3b |X |exit(0);|
|000026c0| 20 20 20 20 20 20 20 20 | 20 20 20 20 20 20 20 20 | | |
|000026d0| 2f 2a 20 4e 65 76 65 72 | 20 67 65 74 73 20 68 65 |/* Never| gets he|
|000026e0| 72 65 20 2a 2f 0a 58 0a | 58 20 20 20 20 64 65 66 |re */.X.|X def|
|000026f0| 61 75 6c 74 3a 0a 58 20 | 20 20 20 20 20 20 73 79 |ault:.X | sy|
|00002700| 73 6c 6f 67 28 22 41 74 | 74 65 6d 70 74 20 74 6f |slog("At|tempt to|
|00002710| 20 6b 69 6c 6c 20 6d 65 | 20 66 6f 69 6c 65 64 2c | kill me| foiled,|
|00002720| 20 49 20 61 6d 20 6e 6f | 77 20 25 64 22 2c 20 70 | I am no|w %d", p|
|00002730| 69 64 29 3b 0a 58 20 20 | 20 20 20 20 20 62 72 65 |id);.X | bre|
|00002740| 61 6b 3b 0a 58 20 20 20 | 20 7d 0a 7d 0a 58 0a 2f |ak;.X | }.}.X./|
|00002750| 2a 20 6d 61 69 6e 20 70 | 72 6f 67 72 61 6d 20 2a |* main p|rogram *|
|00002760| 2f 0a 69 6e 74 20 6d 61 | 69 6e 28 76 6f 69 64 29 |/.int ma|in(void)|
|00002770| 0a 7b 0a 58 0a 58 20 20 | 20 20 2f 2a 20 43 72 61 |.{.X.X | /* Cra|
|00002780| 63 6b 65 72 73 20 6d 69 | 67 68 74 20 74 72 79 20 |ckers mi|ght try |
|00002790| 61 6e 79 20 73 69 67 6e | 61 6c 2e 20 49 66 20 77 |any sign|al. If w|
|000027a0| 65 20 63 61 6e 2c 20 73 | 74 6f 70 20 74 68 65 6d |e can, s|top them|
|000027b0| 20 2a 2f 0a 58 20 20 20 | 20 73 69 6e 67 61 6c 28 | */.X | singal(|
|000027c0| 53 49 47 48 55 50 2c 20 | 53 49 47 5f 49 47 4e 29 |SIGHUP, |SIG_IGN)|
|000027d0| 3b 20 20 20 2f 2a 20 49 | 67 6e 6f 72 65 20 48 55 |; /* I|gnore HU|
|000027e0| 50 20 2a 2f 0a 58 20 20 | 20 20 73 69 67 6e 61 6c |P */.X | signal|
|000027f0| 28 53 49 47 49 4e 54 2c | 20 53 49 47 5f 49 4e 54 |(SIGINT,| SIG_INT|
|00002800| 29 3b 20 20 20 2f 2a 20 | 49 67 6e 6f 72 65 20 53 |); /* |Ignore S|
|00002810| 49 47 5f 49 4e 54 20 2a | 2f 0a 58 20 20 20 20 73 |IG_INT *|/.X s|
|00002820| 69 67 6e 61 6c 28 53 49 | 47 49 4c 4c 2c 20 53 49 |ignal(SI|GILL, SI|
|00002830| 47 5f 49 47 4e 29 3b 20 | 20 20 2f 2a 20 53 74 6f |G_IGN); | /* Sto|
|00002840| 70 20 63 72 61 63 6b 65 | 72 73 20 2a 2f 0a 58 20 |p cracke|rs */.X |
|00002850| 20 20 20 73 69 67 6e 61 | 6c 28 53 49 47 54 52 41 | signa|l(SIGTRA|
|00002860| 50 2c 20 53 49 47 5f 49 | 47 4e 29 3b 20 20 2f 2a |P, SIG_I|GN); /*|
|00002870| 20 53 74 6f 70 20 74 72 | 61 63 69 6e 67 20 2a 2f | Stop tr|acing */|
|00002880| 0a 23 69 66 64 65 66 20 | 53 47 49 49 4f 54 0a 58 |.#ifdef |SGIIOT.X|
|00002890| 20 20 20 20 73 69 67 6e | 61 6c 28 53 49 47 49 4f | sign|al(SIGIO|
|000028a0| 54 2e 20 53 49 47 5f 47 | 4e 49 47 4e 29 3b 20 2f |T. SIG_G|NIGN); /|
|000028b0| 2a 20 53 74 6f 70 20 63 | 72 61 63 6b 65 72 73 20 |* Stop c|rackers |
|000028c0| 2a 2f 0a 23 65 6d 64 6f | 66 0a 58 20 20 20 20 73 |*/.#emdo|f.X s|
|000028d0| 69 67 6e 61 6c 28 53 49 | 47 41 42 52 54 2c 20 53 |ignal(SI|GABRT, S|
|000028e0| 49 47 5f 49 47 4e 29 3b | 20 20 2f 2a 20 53 74 6f |IG_IGN);| /* Sto|
|000028f0| 70 20 63 72 61 63 6b 65 | 72 73 20 2a 2f 0a 23 69 |p cracke|rs */.#i|
|00002900| 66 64 65 66 20 53 49 47 | 45 4d 54 0a 58 20 20 20 |fdef SIG|EMT.X |
|00002910| 20 73 69 67 6e 61 6c 28 | 53 49 47 45 4d 54 2c 20 | signal(|SIGEMT, |
|00002920| 53 49 47 5f 49 47 4e 29 | 3b 20 20 20 2f 2a 20 53 |SIG_IGN)|; /* S|
|00002930| 74 6f 70 20 63 72 61 63 | 6b 65 72 73 20 2a 2f 0a |top crac|kers */.|
|00002940| 23 65 6e 64 69 66 0a 58 | 20 20 20 20 73 69 67 6e |#endif.X| sign|
|00002950| 61 6c 28 53 49 47 46 50 | 45 2c 20 53 49 47 5f 49 |al(SIGFP|E, SIG_I|
|00002960| 47 4e 29 3b 20 20 20 2f | 2a 20 53 74 6f 70 20 63 |GN); /|* Stop c|
|00002970| 72 61 63 6b 65 72 73 20 | 2a 2f 0a 58 20 20 20 20 |rackers |*/.X |
|00002980| 73 69 67 6e 61 6c 28 53 | 49 47 42 55 53 2c 20 53 |signal(S|IGBUS, S|
|00002990| 49 47 5f 49 47 4e 29 3b | 20 20 20 2f 2a 20 53 74 |IG_IGN);| /* St|
|000029a0| 6f 70 20 63 72 61 63 6b | 65 72 73 20 2a 2f 0a 58 |op crack|ers */.X|
|000029b0| 20 20 20 20 73 69 67 6e | 61 6c 28 53 49 47 53 45 | sign|al(SIGSE|
|000029c0| 47 56 2c 20 53 49 47 5f | 49 47 4e 29 3b 20 20 2f |GV, SIG_|IGN); /|
|000029d0| 2a 20 53 74 6f 70 20 63 | 72 61 63 6b 65 72 73 20 |* Stop c|rackers |
|000029e0| 2a 2f 0a 23 69 66 64 65 | 66 20 53 49 47 53 59 53 |*/.#ifde|f SIGSYS|
|000029f0| 0a 58 20 20 20 20 73 69 | 67 6e 61 6c 28 53 49 47 |.X si|gnal(SIG|
|00002a00| 53 59 53 2c 20 53 49 47 | 5f 49 47 4e 29 3b 20 20 |SYS, SIG|_IGN); |
|00002a10| 20 2f 2a 20 53 74 6f 70 | 20 63 72 61 63 6b 65 72 | /* Stop| cracker|
|00002a20| 73 20 2a 2f 0a 23 65 6e | 64 69 66 0a 58 20 20 20 |s */.#en|dif.X |
|00002a30| 20 73 69 67 6e 61 6c 28 | 53 49 47 50 49 50 45 2c | signal(|SIGPIPE,|
|00002a40| 20 53 49 47 5f 49 47 4e | 29 3b 20 20 2f 2a 20 53 | SIG_IGN|); /* S|
|00002a50| 74 6f 70 20 63 72 61 63 | 6b 65 72 73 20 2a 2f 0a |top crac|kers */.|
|00002a60| 58 20 20 20 20 73 69 6e | 67 61 6c 28 53 49 47 41 |X sin|gal(SIGA|
|00002a70| 4c 52 4d 2c 20 53 49 47 | 5f 49 47 4e 29 3b 20 20 |LRM, SIG|_IGN); |
|00002a80| 2f 2a 20 53 74 6f 70 20 | 63 72 61 63 6b 65 72 73 |/* Stop |crackers|
|00002a90| 20 2a 2f 0a 58 20 20 20 | 20 73 69 67 6e 61 6c 28 | */.X | signal(|
|00002aa0| 53 49 47 55 52 47 2c 20 | 53 49 47 5f 49 47 4e 29 |SIGURG, |SIG_IGN)|
|00002ab0| 3b 20 20 20 2f 2a 20 53 | 74 6f 70 20 63 72 61 63 |; /* S|top crac|
|00002ac0| 6b 65 72 73 20 2a 2f 0a | 58 20 20 20 20 73 69 67 |kers */.|X sig|
|00002ad0| 6e 61 6c 28 53 49 47 54 | 53 54 50 2c 20 53 49 47 |nal(SIGT|STP, SIG|
|00002ae0| 5f 49 47 4e 29 3b 20 20 | 2f 2a 20 53 74 6f 70 20 |_IGN); |/* Stop |
|00002af0| 63 72 61 63 6b 65 72 73 | 20 2a 2f 0a 58 20 20 20 |crackers| */.X |
|00002b00| 20 73 69 67 6e 61 6c 28 | 53 49 47 43 4f 4e 54 2c | signal(|SIGCONT,|
|00002b10| 20 53 49 47 5f 49 47 4e | 29 3b 20 20 2f 2a 20 53 | SIG_IGN|); /* S|
|00002b20| 74 6f 70 20 63 72 61 63 | 6b 65 72 73 20 2a 2f 0a |top crac|kers */.|
|00002b30| 58 20 20 20 20 73 69 67 | 6e 61 6c 28 53 49 47 54 |X sig|nal(SIGT|
|00002b40| 54 49 4e 2c 20 53 49 47 | 5f 49 47 4e 29 3b 20 20 |TIN, SIG|_IGN); |
|00002b50| 2f 2a 20 53 74 6f 70 20 | 63 72 61 63 6b 65 72 73 |/* Stop |crackers|
|00002b60| 20 2a 2f 0a 58 20 20 20 | 20 73 69 67 6e 61 6c 28 | */.X | signal(|
|00002b70| 53 49 47 54 54 4f 55 2c | 20 53 49 47 5f 49 47 4e |SIGTTOU,| SIG_IGN|
|00002b80| 29 3b 20 20 2f 2a 20 53 | 74 6f 70 20 63 72 61 63 |); /* S|top crac|
|00002b90| 6b 65 72 73 20 2a 2f 0a | 23 69 66 64 65 66 20 53 |kers */.|#ifdef S|
|00002ba0| 49 47 49 4f 0a 58 20 20 | 20 20 73 69 67 6e 61 6c |IGIO.X | signal|
|00002bb0| 28 53 49 47 49 4f 2c 20 | 53 49 47 5f 49 47 4e 29 |(SIGIO, |SIG_IGN)|
|00002bc0| 3b 20 20 20 20 2f 2a 20 | 53 74 6f 70 20 63 72 61 |; /* |Stop cra|
|00002bd0| 63 6b 65 72 73 20 2a 2f | 0a 23 65 6e 64 69 66 0a |ckers */|.#endif.|
|00002be0| 23 69 66 64 65 66 20 53 | 49 47 58 43 50 55 0a 58 |#ifdef S|IGXCPU.X|
|00002bf0| 20 20 20 20 73 69 67 6e | 61 6c 28 53 49 47 58 43 | sign|al(SIGXC|
|00002c00| 50 55 2c 20 53 49 47 5f | 49 47 4e 29 3b 20 20 2f |PU, SIG_|IGN); /|
|00002c10| 2a 20 53 74 6f 70 20 63 | 72 61 63 6b 65 72 73 20 |* Stop c|rackers |
|00002c20| 2a 2f 0a 23 65 6e 64 69 | 66 0a 23 69 66 64 65 66 |*/.#endi|f.#ifdef|
|00002c30| 20 53 49 47 58 46 53 5a | 0a 58 20 20 20 20 73 69 | SIGXFSZ|.X si|
|00002c40| 67 6e 61 6c 28 53 49 47 | 58 46 53 5a 2c 20 53 49 |gnal(SIG|XFSZ, SI|
|00002c50| 47 5f 49 47 4e 29 3b 20 | 20 2f 2a 20 53 74 6f 70 |G_IGN); | /* Stop|
|00002c60| 20 63 72 61 63 6b 65 72 | 73 20 2a 2f 0a 23 65 6e | cracker|s */.#en|
|00002c70| 64 69 66 0a 23 69 66 64 | 65 66 20 53 49 47 56 54 |dif.#ifd|ef SIGVT|
|00002c80| 41 4c 52 4d 0a 58 20 20 | 20 20 73 69 67 6e 61 6c |ALRM.X | signal|
|00002c90| 28 53 49 47 56 54 41 4c | 52 4d 2c 20 53 49 47 5f |(SIGVTAL|RM, SIG_|
|00002ca0| 49 47 4e 29 3b 20 20 20 | 20 20 20 20 20 2f 2a 20 |IGN); | /* |
|00002cb0| 53 74 6f 70 20 63 72 61 | 63 6b 65 72 73 20 2a 2f |Stop cra|ckers */|
|00002cc0| 0a 23 65 6e 64 69 66 0a | 58 20 20 20 20 73 69 67 |.#endif.|X sig|
|00002cd0| 6e 61 6c 28 53 49 47 50 | 52 4f 46 2c 20 53 49 47 |nal(SIGP|ROF, SIG|
|00002ce0| 5f 49 47 4e 29 3b 20 20 | 2f 2a 20 53 74 6f 70 20 |_IGN); |/* Stop |
|00002cf0| 63 72 61 63 6b 65 72 73 | 20 2a 2f 0a 58 20 20 20 |crackers| */.X |
|00002d00| 20 73 69 67 6e 61 6c 28 | 53 49 47 57 49 4d 43 48 | signal(|SIGWIMCH|
|00002d10| 2c 20 53 49 47 5f 49 47 | 4e 29 3b 20 2f 2a 20 53 |, SIG_IG|N); /* S|
|00002d20| 74 6f 70 20 63 72 61 63 | 6b 65 72 73 20 2a 2f 0a |top crac|kers */.|
|00002d30| 58 20 20 20 20 73 69 67 | 6e 61 6c 28 53 49 47 4c |X sig|nal(SIGL|
|00002d40| 4f 53 54 2c 20 53 49 47 | 5f 49 47 4e 29 3b 20 20 |OST, SIG|_IGN); |
|00002d50| 2f 2a 20 53 74 6f 70 20 | 63 72 61 63 6b 65 72 73 |/* Stop |crackers|
|00002d60| 20 2a 2f 0a 58 20 20 20 | 20 73 69 67 6e 61 6c 28 | */.X | signal(|
|00002d70| 53 49 47 55 53 52 31 2c | 20 53 49 47 5f 49 47 4e |SIGUSR1,| SIG_IGN|
|00002d80| 29 3b 20 20 2f 2a 20 53 | 74 6f 70 20 63 72 61 63 |); /* S|top crac|
|00002d90| 6b 65 72 73 20 2a 2f 0a | 58 20 20 20 20 73 69 67 |kers */.|X sig|
|00002da0| 6e 61 6c 28 53 49 47 55 | 53 52 32 2c 20 53 49 47 |nal(SIGU|SR2, SIG|
|00002db0| 5f 49 47 4e 29 3b 20 20 | 2f 2a 20 53 74 6f 70 20 |_IGN); |/* Stop |
|00002dc0| 63 72 61 63 6b 65 72 73 | 20 2a 2f 0a 58 20 20 20 |crackers| */.X |
|00002dd0| 20 73 77 69 74 63 68 28 | 66 6f 72 6b 28 29 29 0a | switch(|fork()).|
|00002de0| 58 20 20 20 20 7b 0a 58 | 20 20 20 20 63 61 73 65 |X {.X| case|
|00002df0| 20 2d 31 3a 0a 58 20 20 | 20 20 20 20 20 73 79 73 | -1:.X | sys|
|00002e00| 6c 6f 67 28 22 43 6f 75 | 6c 64 20 6e 6f 74 20 66 |log("Cou|ld not f|
|00002e10| 6f 72 6b 28 29 2c 20 66 | 61 74 61 6c 22 29 3b 0a |ork(), f|atal");.|
|00002e20| 58 20 20 20 20 20 20 20 | 65 78 69 74 28 31 29 3b |X |exit(1);|
|00002e30| 0a 58 0a 58 20 20 20 20 | 63 61 73 65 20 30 3a 0a |.X.X |case 0:.|
|00002e40| 58 20 20 20 20 20 20 20 | 73 77 69 74 63 68 28 66 |X |switch(f|
|00002e50| 6f 72 6b 28 29 29 0a 58 | 20 20 20 20 20 20 20 7b |ork()).X| {|
|00002e60| 0a 58 20 20 20 20 20 20 | 20 20 20 20 20 73 65 74 |.X | set|
|00002e70| 70 67 69 64 28 67 65 74 | 70 69 64 28 29 2c 20 67 |pgid(get|pid(), g|
|00002e80| 65 74 70 69 64 28 29 29 | 3b 0a 58 20 20 20 20 20 |etpid())|;.X |
|00002e90| 20 20 20 20 20 20 73 77 | 69 74 63 68 28 66 6f 72 | sw|itch(for|
|00002ea0| 6b 28 29 29 0a 58 20 20 | 20 20 20 20 20 20 20 20 |k()).X | |
|00002eb0| 20 7b 0a 58 20 20 20 20 | 20 20 20 20 20 20 20 63 | {.X | c|
|00002ec0| 61 73 65 20 2d 31 3a 0a | 58 20 20 20 20 20 20 20 |ase -1:.|X |
|00002ed0| 20 20 20 20 20 20 20 20 | 73 79 73 6c 6f 67 28 22 | |syslog("|
|00002ee0| 43 6f 75 6c 64 20 6e 6f | 74 20 66 6f 72 6b 20 64 |Could no|t fork d|
|00002ef0| 65 6d 6f 6e 20 28 66 61 | 74 61 6c 29 22 29 3b 0a |emon (fa|tal)");.|
|00002f00| 58 20 20 20 20 20 20 20 | 20 20 20 20 20 20 20 20 |X | |
|00002f10| 65 78 69 74 28 31 29 3b | 0a 58 0a 58 20 20 20 20 |exit(1);|.X.X |
|00002f20| 20 20 20 20 20 20 20 63 | 61 73 65 20 30 3a 0a 58 | c|ase 0:.X|
|00002f30| 20 20 20 20 20 20 20 20 | 20 20 20 20 20 20 20 73 | | s|
|00002f40| 65 74 70 67 69 64 28 67 | 65 74 70 69 64 28 29 2c |etpgid(g|etpid(),|
|00002f50| 20 67 65 74 70 69 64 28 | 29 29 3b 20 2f 2a 20 4d | getpid(|)); /* M|
|00002f60| 61 6b 65 20 6e 65 77 20 | 70 72 6f 63 20 67 72 6f |ake new |proc gro|
|00002f70| 75 70 20 2a 2f 0a 58 20 | 20 20 20 20 20 20 20 20 |up */.X | |
|00002f80| 20 20 20 20 20 20 73 79 | 73 6c 6f 67 28 22 70 73 | sy|slog("ps|
|00002f90| 20 74 65 73 74 20 64 65 | 6d 6f 6e 20 25 64 20 73 | test de|mon %d s|
|00002fa0| 74 61 72 74 69 6e 67 22 | 2c 20 67 65 74 70 69 64 |tarting"|, getpid|
|00002fb0| 28 29 29 3b 0a 58 20 20 | 20 20 20 20 20 20 20 20 |());.X | |
|00002fc0| 20 20 20 20 20 64 65 6d | 6f 6e 5f 62 6f 64 79 28 | dem|on_body(|
|00002fd0| 29 3b 0a 58 20 20 20 20 | 20 20 20 20 20 20 20 20 |);.X | |
|00002fe0| 20 20 20 73 79 73 6c 6f | 67 28 22 4f 6f 70 73 21 | syslo|g("Oops!|
|00002ff0| 20 44 65 6d 6f 6e 20 62 | 6f 64 79 20 72 65 74 75 | Demon b|ody retu|
|00003000| 72 6e 65 64 2c 20 65 78 | 69 74 74 69 6e 67 22 29 |rned, ex|itting")|
|00003010| 3b 0a 58 20 20 20 20 20 | 20 20 20 20 20 20 20 20 |;.X | |
|00003020| 20 20 65 78 69 74 28 30 | 29 3b 20 20 20 20 20 20 | exit(0|); |
|00003030| 20 20 20 20 20 20 20 20 | 20 20 2f 2a 20 4e 65 76 | | /* Nev|
|00003040| 65 72 20 67 65 74 73 20 | 68 65 72 65 20 2a 2f 0a |er gets |here */.|
|00003050| 58 0a 58 20 20 20 20 20 | 20 20 20 20 20 20 64 65 |X.X | de|
|00003060| 66 61 75 6c 74 3a 0a 58 | 20 20 20 20 20 20 20 20 |fault:.X| |
|00003070| 20 20 20 20 20 20 20 62 | 72 65 61 6b 3b 0a 58 20 | b|reak;.X |
|00003080| 20 20 20 20 20 20 20 20 | 20 20 7d 0a 58 20 20 20 | | }.X |
|00003090| 20 20 20 20 20 20 20 20 | 73 69 67 6e 61 6c 28 53 | |signal(S|
|000030a0| 49 47 43 48 4c 44 2c 20 | 72 65 73 74 61 72 74 5f |IGCHLD, |restart_|
|000030b0| 6d 65 29 3b 20 2f 2a 20 | 54 72 79 20 74 6f 20 73 |me); /* |Try to s|
|000030c0| 74 6f 70 20 63 72 61 63 | 6b 65 72 20 6b 69 6c 6c |top crac|ker kill|
|000030d0| 69 6e 67 20 6d 65 20 2a | 2f 0a 58 20 20 20 20 20 |ing me *|/.X |
|000030e0| 20 20 7d 0a 58 20 20 20 | 20 64 65 66 61 75 6c 74 | }.X | default|
|000030f0| 3a 0a 58 20 20 20 20 20 | 20 20 62 72 65 61 6b 3b |:.X | break;|
|00003100| 0a 58 20 20 20 20 7d 0a | 58 20 20 20 20 72 65 74 |.X }.|X ret|
|00003110| 75 72 6e 20 30 3b 0a 7d | 0a 58 0a 58 0a 53 48 41 |urn 0;.}|.X.X.SHA|
|00003120| 52 5f 45 4f 46 0a 63 68 | 6d 6f 64 20 30 36 34 34 |R_EOF.ch|mod 0644|
|00003130| 20 63 68 65 63 6b 5f 70 | 73 2e 63 20 7c 7c 0a 65 | check_p|s.c ||.e|
|00003140| 63 68 6f 20 27 72 65 73 | 74 6f 72 65 20 6f 66 20 |cho 'res|tore of |
|00003150| 63 68 65 63 6b 5f 70 73 | 2e 63 20 66 61 69 6c 65 |check_ps|.c faile|
|00003160| 64 27 0a 57 63 5f 63 3d | 22 60 77 63 20 2d 63 20 |d'.Wc_c=|"`wc -c |
|00003170| 3c 20 27 63 68 65 63 6b | 5f 70 73 2e 63 27 60 22 |< 'check|_ps.c'`"|
|00003180| 0a 74 65 73 74 20 38 35 | 34 30 20 2d 65 71 20 22 |.test 85|40 -eq "|
|00003190| 24 57 63 5f 63 22 20 7c | 7c 0a 20 20 20 20 20 20 |$Wc_c" |||. |
|000031a0| 20 20 65 63 68 6f 20 27 | 63 68 65 63 6b 5f 70 73 | echo '|check_ps|
|000031b0| 2e 63 3a 20 6f 72 69 67 | 69 6e 61 6c 20 73 69 7a |.c: orig|inal siz|
|000031c0| 65 20 38 35 34 30 2c 20 | 63 75 72 72 65 6e 74 20 |e 8540, |current |
|000031d0| 73 69 7a 65 27 20 22 24 | 57 63 5f 63 22 0a 66 69 |size' "$|Wc_c".fi|
|000031e0| 0a 65 78 69 74 20 30 0a | 0a 0a 0a 0a 0a 0a 0a 0a |.exit 0.|........|
|000031f0| 2d 2d 2d 2d 2d 2d 2d 2d | 2d 2d 2d 2d 2d 2d 2d 2d |--------|--------|
|00003200| 2d 2d 2d 2d 2d 2d 2d 2d | 2d 2d 2d 2d 2d 2d 2d 2d |--------|--------|
|00003210| 2d 2d 2d 2d 2d 2d 2d 2d | 2d 2d 2d 2d 2d 2d 2d 2d |--------|--------|
|00003220| 2d 2d 2d 2d 2d 2d 2d 2d | 2d 2d 2d 2d 2d 2d 2d 2d |--------|--------|
|00003230| 2d 2d 2d 2d 2d 2d 2d 2d | 2d 2d 2d 0a 0a 0a 0a 41 |--------|---....A|
|00003240| 62 6f 75 74 20 28 70 72 | 6f 62 6c 65 6d 73 20 77 |bout (pr|oblems w|
|00003250| 69 74 68 29 20 63 68 65 | 63 6b 5f 70 73 2e 63 3a |ith) che|ck_ps.c:|
|00003260| 0a 0a 46 72 6f 6d 20 77 | 68 61 74 20 49 20 63 61 |..From w|hat I ca|
|00003270| 6e 20 73 65 65 2c 20 74 | 68 69 73 20 64 6f 65 73 |n see, t|his does|
|00003280| 6e 27 74 20 73 65 65 6d | 20 74 6f 20 61 6c 6c 6f |n't seem| to allo|
|00003290| 77 20 61 20 70 72 6f 63 | 65 73 73 20 74 6f 20 73 |w a proc|ess to s|
|000032a0| 74 61 72 74 20 69 6e 20 | 74 68 65 0a 64 65 6c 61 |tart in |the.dela|
|000032b0| 79 20 62 65 74 77 65 65 | 6e 20 63 68 65 63 6b 69 |y betwee|n checki|
|000032c0| 6e 67 20 74 68 65 20 6f | 75 74 70 75 74 20 6f 66 |ng the o|utput of|
|000032d0| 20 27 70 73 27 20 61 6e | 64 20 63 68 65 63 6b 69 | 'ps' an|d checki|
|000032e0| 6e 67 20 2f 70 72 6f 63 | 20 2d 20 74 68 65 20 6f |ng /proc| - the o|
|000032f0| 62 76 69 6f 75 73 0a 72 | 61 63 65 20 63 6f 6e 64 |bvious.r|ace cond|
|00003300| 69 74 69 6f 6e 20 6b 69 | 6c 6c 69 6e 67 20 74 68 |ition ki|lling th|
|00003310| 6f 75 73 61 6e 64 73 20 | 6f 66 20 69 6e 6e 6f 63 |ousands |of innoc|
|00003320| 65 6e 74 20 70 72 6f 63 | 65 73 73 65 73 2e 20 20 |ent proc|esses. |
|00003330| 4d 75 63 68 20 62 65 74 | 74 65 72 20 77 6f 75 6c |Much bet|ter woul|
|00003340| 64 0a 62 65 2e 2e 2e 0a | 0a 20 20 63 68 65 63 6b |d.be....|. check|
|00003350| 20 2f 70 72 6f 63 0a 20 | 20 63 68 65 63 6b 20 70 | /proc. | check p|
|00003360| 73 0a 20 20 6e 6f 74 65 | 20 68 69 64 64 65 6e 20 |s. note| hidden |
|00003370| 70 72 6f 63 65 73 73 65 | 73 20 61 6e 64 20 6b 69 |processe|s and ki|
|00003380| 6c 6c 20 2d 20 69 66 20 | 74 68 65 79 20 68 61 76 |ll - if |they hav|
|00003390| 65 20 74 65 72 6d 69 6e | 61 74 65 64 20 74 68 65 |e termin|ated the|
|000033a0| 79 20 77 69 6c 6c 20 62 | 65 0a 20 20 20 20 20 67 |y will b|e. g|
|000033b0| 6f 6e 65 20 61 6c 72 65 | 61 64 79 20 61 6e 64 20 |one alre|ady and |
|000033c0| 69 74 20 77 6f 6e 27 74 | 20 6d 61 74 74 65 72 0a |it won't| matter.|
|000033d0| 20 20 69 66 20 6b 69 6c | 6c 20 73 75 63 63 65 65 | if kil|l succee|
|000033e0| 64 73 2c 20 6c 6f 67 20 | 61 20 6d 65 73 73 61 67 |ds, log |a messag|
|000033f0| 65 20 28 61 20 72 65 61 | 6c 20 68 69 64 64 65 6e |e (a rea|l hidden|
|00003400| 20 70 72 6f 63 65 73 73 | 3b 20 69 66 20 69 74 20 | process|; if it |
|00003410| 66 61 69 6c 73 2c 20 69 | 74 0a 20 20 20 20 20 77 |fails, i|t. w|
|00003420| 61 73 20 6a 75 73 74 20 | 61 20 70 72 6f 63 65 73 |as just |a proces|
|00003430| 73 20 77 68 69 63 68 20 | 64 69 65 64 29 0a 20 20 |s which |died). |
|00003440| 6e 6f 74 65 20 6e 65 77 | 20 70 72 6f 63 65 73 73 |note new| process|
|00003450| 65 73 20 61 6e 64 20 72 | 65 63 68 65 63 6b 20 2f |es and r|echeck /|
|00003460| 70 72 6f 63 20 6f 6e 6c | 79 20 66 6f 72 20 74 68 |proc onl|y for th|
|00003470| 65 6d 20 2d 20 69 66 20 | 74 68 65 79 20 61 72 65 |em - if |they are|
|00003480| 6e 27 74 0a 20 20 20 20 | 20 74 68 65 72 65 2c 20 |n't. | there, |
|00003490| 72 65 63 68 65 63 6b 20 | 70 73 2c 20 69 66 20 74 |recheck |ps, if t|
|000034a0| 68 65 79 20 61 72 65 20 | 73 74 69 6c 6c 20 74 68 |hey are |still th|
|000034b0| 65 72 65 20 74 68 65 79 | 20 61 72 65 20 61 20 62 |ere they| are a b|
|000034c0| 6f 67 75 73 20 70 72 6f | 63 65 73 73 0a 20 20 20 |ogus pro|cess. |
|000034d0| 20 20 28 65 6c 73 65 20 | 74 68 65 79 20 77 65 72 | (else |they wer|
|000034e0| 65 20 61 20 73 68 6f 72 | 74 2d 6c 69 76 65 64 20 |e a shor|t-lived |
|000034f0| 70 72 6f 63 65 73 73 29 | 0a 0a 74 68 65 20 6f 6e |process)|..the on|
|00003500| 6c 79 20 72 61 63 65 20 | 63 6f 6e 64 69 74 69 6f |ly race |conditio|
|00003510| 6e 20 6e 6f 77 20 69 73 | 20 50 49 44 20 72 65 2d |n now is| PID re-|
|00003520| 75 73 65 2e 0a 0a 4e 69 | 63 69 6e 67 20 79 6f 75 |use...Ni|cing you|
|00003530| 72 73 65 6c 66 20 6d 61 | 6b 65 73 20 79 6f 75 20 |rself ma|kes you |
|00003540| 73 74 61 6e 64 20 6f 75 | 74 20 69 6e 20 74 68 65 |stand ou|t in the|
|00003550| 20 70 72 6f 63 65 73 73 | 20 6c 69 73 74 2c 20 77 | process| list, w|
|00003560| 68 69 63 68 20 6d 61 6b | 65 73 20 79 6f 75 0a 76 |hich mak|es you.v|
|00003570| 75 6c 6e 65 72 61 62 6c | 65 20 74 6f 20 6b 69 6c |ulnerabl|e to kil|
|00003580| 6c 73 2e 20 20 49 74 20 | 77 6f 75 6c 64 20 62 65 |ls. It |would be|
|00003590| 20 62 65 74 74 65 72 20 | 74 6f 20 6a 75 73 74 20 | better |to just |
|000035a0| 73 69 74 20 61 74 20 61 | 20 73 74 61 6e 64 61 72 |sit at a| standar|
|000035b0| 64 0a 70 72 69 6f 72 69 | 74 79 20 77 69 74 68 20 |d.priori|ty with |
|000035c0| 61 20 6e 61 6d 65 20 6c | 69 6b 65 20 22 69 6e 2e |a name l|ike "in.|
|000035d0| 74 65 6c 6e 65 74 64 22 | 20 6f 72 20 73 6f 20 6f |telnetd"| or so o|
|000035e0| 6e 2e 2e 2e 6d 61 79 62 | 65 20 61 20 63 68 69 6c |n...mayb|e a chil|
|000035f0| 64 20 70 72 6f 63 65 73 | 73 0a 63 61 6c 6c 65 64 |d proces|s.called|
|00003600| 20 22 2d 74 63 73 68 22 | 20 28 6f 72 20 22 2d 72 | "-tcsh"| (or "-r|
|00003610| 63 22 20 66 6f 72 20 50 | 6c 61 6e 39 69 73 68 20 |c" for P|lan9ish |
|00003620| 75 73 65 72 73 3a 29 20 | 61 6e 64 20 61 74 74 61 |users:) |and atta|
|00003630| 63 68 65 64 20 74 6f 20 | 61 20 74 65 72 6d 69 6e |ched to |a termin|
|00003640| 61 6c 0a 3a 29 0a 0a 53 | 79 73 6c 6f 67 67 69 6e |al.:)..S|ysloggin|
|00003650| 67 20 79 6f 75 72 20 70 | 69 64 20 6f 6e 20 73 74 |g your p|id on st|
|00003660| 61 72 74 20 69 73 20 61 | 6c 73 6f 20 61 20 70 72 |art is a|lso a pr|
|00003670| 65 74 74 79 20 73 69 6c | 6c 79 20 69 64 65 61 20 |etty sil|ly idea |
|00003680| 66 6f 72 20 61 20 70 72 | 6f 67 72 61 6d 0a 77 68 |for a pr|ogram.wh|
|00003690| 69 63 68 20 69 73 20 6d | 65 61 6e 74 20 74 6f 20 |ich is m|eant to |
|000036a0| 68 69 64 65 20 2d 20 6f | 6e 63 65 20 73 6f 6d 65 |hide - o|nce some|
|000036b0| 6f 6e 65 20 68 61 73 20 | 72 6f 6f 74 2c 20 74 68 |one has |root, th|
|000036c0| 65 79 20 77 69 6c 6c 20 | 70 72 6f 62 61 62 6c 79 |ey will |probably|
|000036d0| 0a 63 68 65 63 6b 20 6f | 75 74 20 74 68 65 20 6c |.check o|ut the l|
|000036e0| 6f 67 73 20 74 6f 20 73 | 65 65 20 5f 77 68 61 74 |ogs to s|ee _what|
|000036f0| 5f 20 79 6f 75 20 61 72 | 65 20 6c 6f 67 67 69 6e |_ you ar|e loggin|
|00003700| 67 3b 20 69 74 27 73 20 | 65 61 73 79 20 65 6e 6f |g; it's |easy eno|
|00003710| 75 67 68 20 74 6f 0a 63 | 68 65 63 6b 20 74 68 65 |ugh to.c|heck the|
|00003720| 20 70 70 69 64 20 69 6e | 20 70 73 20 6c 69 73 74 | ppid in| ps list|
|00003730| 20 66 6f 72 20 74 68 65 | 20 72 65 73 74 61 72 74 | for the| restart|
|00003740| 65 72 2f 63 68 69 6c 64 | 20 70 72 6f 63 65 73 73 |er/child| process|
|00003750| 20 6f 6e 63 65 20 6f 6e | 65 20 50 49 44 20 69 73 | once on|e PID is|
|00003760| 0a 6b 6e 6f 77 6e 2c 20 | 74 6f 6f 2e 20 20 44 6f |.known, |too. Do|
|00003770| 6e 27 74 20 61 73 73 75 | 6d 65 20 63 72 61 63 6b |n't assu|me crack|
|00003780| 65 72 73 20 61 72 65 20 | 73 74 75 70 69 64 2c 20 |ers are |stupid, |
|00003790| 68 65 79 2c 20 74 68 65 | 79 20 77 6f 75 6c 64 20 |hey, the|y would |
|000037a0| 68 61 76 65 0a 61 6c 72 | 65 61 64 79 20 67 6f 74 |have.alr|eady got|
|000037b0| 20 69 6e 74 6f 20 72 6f | 6f 74 20 6f 6e 20 79 6f | into ro|ot on yo|
|000037c0| 75 72 20 73 79 73 74 65 | 6d 20 62 65 66 6f 72 65 |ur syste|m before|
|000037d0| 20 74 68 69 73 20 70 72 | 6f 67 72 61 6d 20 77 6f | this pr|ogram wo|
|000037e0| 75 6c 64 20 62 65 20 61 | 6e 79 20 75 73 65 2e 0a |uld be a|ny use..|
+--------+-------------------------+-------------------------+--------+--------+
