diff --git a/.gitignore b/.gitignore index 74c47c1..7662ae3 100644 --- a/.gitignore +++ b/.gitignore @@ -1,5 +1 @@ unhide-20100201.tgz -/unhide-20121229.tgz -/unhide-20130526.tgz -/Unhide-v20220611.tar.gz -/Unhide-v20240510.tar.gz diff --git a/sources b/sources index 8cfe452..4c0d500 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (Unhide-v20240510.tar.gz) = d0dd21ce3ee4e7c36f4e83161776e3a9fcb79b706448e90f4667b9ce114b7a5fb2905a2756f0ff19d31499b416b194fa0891f486d294d0c63316310773b6b211 +43cb2af4b0a03e0d1b253058626c1358 unhide-20100201.tgz diff --git a/unhide.spec b/unhide.spec index e143308..e278b13 100644 --- a/unhide.spec +++ b/unhide.spec @@ -1,192 +1,57 @@ -%global srcname Unhide Name: unhide -Version: 20240510 -Release: 4%{?dist} +Version: 1.0 +Release: 6%{?dist}.20100201 Summary: Tool to find hidden processes and TCP/UDP ports from rootkits -# GPL-3.0-or-later -# unhide-20240510-build/Unhide-20240510/COPYING -# unhide-20240510-build/Unhide-20240510/LEEME.txt -# unhide-20240510-build/Unhide-20240510/LICENSE -# unhide-20240510-build/Unhide-20240510/LISEZ-MOI.TXT -# unhide-20240510-build/Unhide-20240510/NEWS -# unhide-20240510-build/Unhide-20240510/README.txt -# unhide-20240510-build/Unhide-20240510/TODO -# unhide-20240510-build/Unhide-20240510/build_all.sh -# unhide-20240510-build/Unhide-20240510/changelog -# unhide-20240510-build/Unhide-20240510/make_tarball.sh -# unhide-20240510-build/Unhide-20240510/man/es/unhide-tcp.8 -# unhide-20240510-build/Unhide-20240510/man/es/unhide.8 -# unhide-20240510-build/Unhide-20240510/man/fr/unhide-tcp.8 -# unhide-20240510-build/Unhide-20240510/man/fr/unhide.8 -# unhide-20240510-build/Unhide-20240510/man/unhide-tcp.8 -# unhide-20240510-build/Unhide-20240510/man/unhide.8 -# unhide-20240510-build/Unhide-20240510/ps -# unhide-20240510-build/Unhide-20240510/sanity-tcp.sh -# unhide-20240510-build/Unhide-20240510/sanity.sh -# unhide-20240510-build/Unhide-20240510/ss -# unhide-20240510-build/Unhide-20240510/ss-ref -# unhide-20240510-build/Unhide-20240510/tar_list.txt -# unhide-20240510-build/Unhide-20240510/unhide-linux-bruteforce.c -# unhide-20240510-build/Unhide-20240510/unhide-linux-compound.c -# unhide-20240510-build/Unhide-20240510/unhide-linux-procfs.c -# unhide-20240510-build/Unhide-20240510/unhide-linux-syscall.c -# unhide-20240510-build/Unhide-20240510/unhide-linux.c -# unhide-20240510-build/Unhide-20240510/unhide-linux.h -# unhide-20240510-build/Unhide-20240510/unhide-output.c -# unhide-20240510-build/Unhide-20240510/unhide-output.h -# unhide-20240510-build/Unhide-20240510/unhide-posix.c -# unhide-20240510-build/Unhide-20240510/unhide-tcp-fast.c -# unhide-20240510-build/Unhide-20240510/unhide-tcp.c -# unhide-20240510-build/Unhide-20240510/unhide-tcp.h -# unhide-20240510-build/Unhide-20240510/unhideGui.py -# unhide-20240510-build/Unhide-20240510/unhide_rb.c -# MIT -# unhide-20240510-build/Unhide-20240510/ToolTip.py -License: GPL-3.0-or-later AND MIT -URL: http://www.unhide-forensics.info/ -Source0: http://github.com/YJesus/%{srcname}/archive/v%{version}/%{srcname}-v%{version}.tar.gz - -BuildRequires: gcc +Group: Applications/System +License: GPLv3 +URL: http://www.security-projects.com/?Unhide +Source0: http://www.security-projects.com/unhide-20100201.tgz +BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n) %description -Unhide is a forensic tool to find hidden processes and TCP/UDP ports by -rootkits/LKMs or by another hiding technique. +Unhide is a forensic tool to find processes and TCP/UDP ports hidden by +rootkits, Linux kernel modules or by other techniques. It includes two +utilities: unhide and unhide-tcp. + +Unhide detects hidden processes using three techniques: + + - comparing the output of /proc and /bin/ps + - comparing the information gathered from /bin/ps with the one gathered + from system calls (syscall scanning) + - full scan of the process ID space (PIDs bruteforcing) + +unhide-tcp identifies TCP/UDP ports that are listening but are not listed +in /bin/netstat through brute forcing of all TCP/UDP ports available. + %prep -%autosetup -n %{srcname}-%{version} -chmod -x sanity*.sh +%setup -q -n %{name}-20100201 %build -%{__cc} %{optflags} -lpthread unhide-linux*.c unhide-output.c -o unhide %{?__global_ldflags} -%{__cc} %{optflags} unhide-tcp.c unhide-tcp-fast.c unhide-output.c -o unhide-tcp %{?__global_ldflags} -%{__cc} %{optflags} unhide_rb.c -o unhide_rb %{?__global_ldflags} +%{__cc} %{optflags} -lpthread unhide-linux26.c -o unhide +%{__cc} %{optflags} unhide-tcp.c -o unhide-tcp + %install -mkdir -p %{buildroot}%{_sbindir}/ -mkdir -p %{buildroot}%{_mandir}/man8/ -mkdir -p %{buildroot}%{_mandir}/es/man8/ -mkdir -p %{buildroot}%{_mandir}/fr/man8/ -install -pm0755 unhide %{buildroot}%{_sbindir}/ -install -pm0755 unhide-tcp %{buildroot}%{_sbindir}/ -install -pm0755 unhide_rb %{buildroot}%{_sbindir}/ -install -pm0644 man/unhide.8 %{buildroot}%{_mandir}/man8/ -install -pm0644 man/unhide-tcp.8 %{buildroot}%{_mandir}/man8/ -install -pm0644 man/es/unhide.8 %{buildroot}%{_mandir}/es/man8 -install -pm0644 man/es/unhide-tcp.8 %{buildroot}%{_mandir}/es/man8/ -install -pm0644 man/fr/unhide.8 %{buildroot}%{_mandir}/fr/man8/ -install -pm0644 man/fr/unhide-tcp.8 %{buildroot}%{_mandir}/fr/man8/ +rm -rf %{buildroot} +%{__install} -Dp -m0755 unhide %{buildroot}%{_sbindir}/unhide +%{__install} -Dp -m0755 unhide-tcp %{buildroot}%{_sbindir}/unhide-tcp +%{__install} -Dp -m0644 man/unhide.8 %{buildroot}%{_mandir}/man8/unhide.8 +%{__install} -Dp -m0644 man/unhide-tcp.8 %{buildroot}%{_mandir}/man8/unhide-tcp.8 + +%clean +rm -rf %{buildroot} %files -%doc changelog README.txt NEWS sanity.sh sanity-tcp.sh -%license COPYING LICENSE -%{_mandir}/man8/unhide*.8* -%{_mandir}/es/man8/unhide*.8* -%{_mandir}/fr/man8/unhide*.8* +%defattr(-,root,root,-) +%doc COPYING LEEME.txt README.txt +%doc %{_mandir}/man8/unhide.8* +%doc %{_mandir}/man8/unhide-tcp.8* %{_sbindir}/unhide %{_sbindir}/unhide-tcp -%{_sbindir}/unhide_rb %changelog -* Fri Jul 17 2026 Fedora Release Engineering - 20240510-4 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_45_Mass_Rebuild - -* Sat Jan 17 2026 Fedora Release Engineering - 20240510-3 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild - -* Fri Jul 25 2025 Fedora Release Engineering - 20240510-2 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild - -* Mon May 12 2025 Robby Callicotte - 20240510-1 -- Updated to 20240510 -- Corrected license - -* Sun Jan 19 2025 Fedora Release Engineering - 20220611-4 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild - -* Sat Jul 20 2024 Fedora Release Engineering - 20220611-3 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - -* Sat Jan 27 2024 Fedora Release Engineering - 20220611-2 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - -* Thu Jul 20 2023 Robby Callicotte - 20220611-1 -- Rebased to new version - -* Sat Jan 21 2023 Fedora Release Engineering - 20130526-20 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - -* Sat Jul 23 2022 Fedora Release Engineering - 20130526-19 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - -* Sat Jan 22 2022 Fedora Release Engineering - 20130526-18 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - -* Fri Jul 23 2021 Fedora Release Engineering - 20130526-17 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - -* Wed Jan 27 2021 Fedora Release Engineering - 20130526-16 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - -* Wed Jul 29 2020 Fedora Release Engineering - 20130526-15 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - -* Fri Jan 31 2020 Fedora Release Engineering - 20130526-14 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - -* Sat Jul 27 2019 Fedora Release Engineering - 20130526-13 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild - -* Sun Feb 03 2019 Fedora Release Engineering - 20130526-12 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild - -* Sat Jul 14 2018 Fedora Release Engineering - 20130526-11 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild - -* Mon Feb 19 2018 Athmane Madjoudj - 20130526-10 -- Add gcc as BR (minimal buildroot change) - -* Fri Feb 09 2018 Fedora Release Engineering - 20130526-9 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild - -* Thu Aug 03 2017 Fedora Release Engineering - 20130526-8 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild - -* Thu Jul 27 2017 Fedora Release Engineering - 20130526-7 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild - -* Sat Feb 11 2017 Fedora Release Engineering - 20130526-6 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild - -* Fri Feb 05 2016 Fedora Release Engineering - 20130526-5 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild - -* Fri Jun 19 2015 Fedora Release Engineering - 20130526-4 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_23_Mass_Rebuild - -* Mon Aug 18 2014 Fedora Release Engineering - 20130526-3 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_22_Mass_Rebuild - -* Sun Jun 08 2014 Fedora Release Engineering - 20130526-2 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild - -* Thu Jan 09 2014 Christopher Meng - 20130526-1 -- Update to 20130526 -- Add multilingual manpages. -- SPEC cleanup, build with RELRO. - -* Fri Jul 26 2013 Parag - 1.0-10.20121229 -- Update to new version - -* Fri Feb 15 2013 Fedora Release Engineering - 1.0-9.20100201 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_19_Mass_Rebuild - -* Sun Jul 22 2012 Fedora Release Engineering - 1.0-8.20100201 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_18_Mass_Rebuild - -* Sat Jan 14 2012 Fedora Release Engineering - 1.0-7.20100201 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_17_Mass_Rebuild - * Mon Feb 07 2011 Fedora Release Engineering - 1.0-6.20100201 - Rebuilt for https://fedoraproject.org/wiki/Fedora_15_Mass_Rebuild