/* Unhide shows hidden processes, and it is located here: http://travcom.tripod.com/unhide.c Basically it's a tiny little program which sends signal 0 to each possible PID. It could be easily written in PERL or sh. All it does is give you a sorted list of PIDs, which you have to correlate. On a busy system all you have to do is minimize the time between running the commands: $ ./hide > /tmp/foo; ps -ax > /tmp/bar Then use your standard Unix tools for extracting the list of processes: $ tail -n +2 /tmp/bar | awk -- '{ print $1; }' | sort > /tmp/baz Note that the files must be sorted lexically, not numerically, for comm to work: $ sort /tmp/foo > /tmp/bar Then show the pids found only by unhide: $ comm -2 -3 /tmp/bar /tmp/baz Note that I do all postprocessing after I've saved the values; you really don't want awk and sort and tail to show up in the listings. Ideally you would use it on a quiescent system, but sometimes that's not possible. Happy hunting! */ #include #include #include #include #include #define PID_MAX 30000 /* 4.4BSD, YMMV */ int main(int argc, char **argv) { int i = 0; for(i = 1; i < PID_MAX + 1; i++) if(kill(i, 0) != -1 || errno != ESRCH) printf("%d\n", i); exit(0); }