15 lines
599 B
Text
15 lines
599 B
Text
Unhide is a forensic tool to find hidden processes and TCP/UDP ports by
|
|
rootkits / LKMs or by another hidden technique. It consists of two
|
|
programs: unhide and unhide-tcp.
|
|
|
|
unhide detects hidden processes through:
|
|
* Comparison of /proc vs /bin/ps output.
|
|
* Comparison of info gathered from /bin/ps with info gathered from.
|
|
* Syscalls (syscall scanning).
|
|
* Full PIDs space ocupation (PIDs bruteforcing).
|
|
|
|
unhide-tcp identifies TCP/UDP ports that are listening but not listed in
|
|
/bin/netstat by doing brute forcing of all TCP/UDP ports availables.
|
|
|
|
|
|
WWW: http://www.unhide-forensics.info/
|