Path: utzoo!utgpu!jarvis.csri.toronto.edu!cs.utexas.edu!rice!uw-beaver!sumax!amc-gw!pilchuck!pacer!davidb
From: davidb@Pacer.UUCP (David Barts)
Newsgroups: comp.sys.hp
Subject: Re: ps lists command parameters
Summary: just overwrite memory at argv[i]
Keywords: stop that!
Message-ID: <279@zircon.UUCP>
Date: 6 Mar 90 21:46:14 GMT
References: <686@mmlai.UUCP>
Organization: Pacer Corp., Bothell, WA
Lines: 55

In article <686@mmlai.UUCP>, burzio@mmlai.UUCP (Tony Burzio) writes:
> 
> Does anyone know how to stop ps from listing the parameters
> of a process owned by another user?  Some commands will
> be put in square brackets, which means ps couldn't get the
> parameters.  Is there a way to force this?  Thanks for any help!

Sure, do something like:

	/* set clobber[] to 50 blanks */
	char clobber[] = "                                                  ";

	main(argc, argv)
	int argc;
	char *argv[];
	{
		while(argc--){
			strncpy(*argv, clobber, strlen(*argv));
			++argv;
		}
		sleep(1000);
	}

This seems to work on HP-UX 6.2, and there's no reason why it shouldn't
work on 6.5.  No what's weird is that the following code *doesn't* work:

	main(argc, argv)
	int argc;
	char *argv[];
	{
		while(argc--){
			**argv++ = 0;
		}
		sleep(1000);
	}

Suppose this program is called `argtest'.  I type to the shell:

	$ argtest this is a test &
	4477
	$ argtest this is test one &
	4480

...and a ps -f will show 4477's argument list to be `est' and 4480's
to be ` rgtest his s est ne'!  Seems like ps is getting string sizes
somewhere and using memcpy() instead of strcpy().  But then it should
have gotten more args. for process 4477 than just `est'.  Strange...

However, back to the original question.  Overwriting the arguments
with blanks seems to work.  The first example will force ps -f to
place the name of the program in square brackets.  Nulls probably
would also work, but I didn't try them.
-- 
David Barts			Pacer Corporation
davidb@pacer.uucp		...!uunet!pilchuck!pacer!davidb