Abstract: This paper analyses the mechanism of LKM backdoor in hiding processes. According to the vulnerability in design and the characteristics of /proc file system, a new method for finding hided processes is proposed, that is, traversing all possible existing PID directories to find out all actually existing processes, then through contrasting with the ordinary output to discover the differences. At last the workflow in Perl has been provided. The experiments show that this method presented can efficiently find the processes hided by LKM backdoor.

Key words: Linux, LKM Backdoor, Hide processes, PID, Perl

摘要： 分析LKM后门实现隐藏进程的机理。针对后门设计存在的缺陷，结合/proc文件系统特点，提出一种按顺序遍历所有PID目录而找出全部进程的方法。再将结果与普通的进程查找输出作对比，可以发现隐藏的进程。最后给出采用Perl语言实现此查找功能的流程图。实验表明该方法能准确、有效地发现被LKM后门隐藏的进程。

关键词: Linux, LKM后门, 隐藏进程, PID, Perl