unhide: Forensic tool to find hidden processes and ports

Unhide is a forensic tool to find hidden processes and TCP/UDP ports by rootkits / LKMs or by another hidden technique.

Unhide (ps) - Detecting hidden processes. Implements six main techniques
1. Compare /proc vs /bin/ps output
2. Compare info gathered from /bin/ps with info gathered by walking thru the procfs.
3. Compare info gathered from /bin/ps with info gathered from syscalls (syscall scanning).
4. Full PIDs space ocupation (PIDs bruteforcing).
5. Compare /bin/ps output vs /proc, procfs walking and syscall.
Reverse search, verify that all thread seen by ps are also seen in the kernel.
6. Quick compare /proc, procfs walking and syscall vs /bin/ps output.
It's about 20 times faster than tests 1+2+3 but maybe give more false positives.

Unhide-TCP
Identify TCP/UDP ports that are listening but not listed in /bin/netstat doing brute forcing of all TCP/UDP ports availables.

Name:	unhide
Release:	20240510-2mamba
Group:	Applications/Security
Maintainer:	silvan
License:	GPL
Size:	78.11 kB
Upstream URL:	https://www.unhide-forensics.info/
Build time:	2026-10-29 18:14:57

Source files

Unhide-20240510.tar.bz2
unhide.spec

Binary packages and requirements

	x86_64	i586
Built RPMS	unhide unhide-debug	unhide unhide-debug
Build requirements

History of changes

Date	Packager	Release	Description
2026-10-29	autodist	20240510-2mamba	- automatic rebuild by autodist
2025-03-21	autodist	20240510-1mamba	- automatic version update by autodist
2022-11-26	silvan	20220611-1mamba	- update to 20220611
2013-05-27	autodist	20130526-1mamba	- automatic version update by autodist
2013-01-31	autodist	20121229-1mamba	- automatic version update by autodist
2011-12-13	davide	20110113-1mamba	- package created by autospec

Build required by