Ghost Process Hider

LD_PRELOAD rootkit-style demo that intercepts readdir() to hide the current process from /proc directory listings. When preloaded, the library hides its own process ID from being visible in /proc when enumerating that directory.

How it works

• Hooks readdir() via dlsym(RTLD_NEXT, "readdir").
• For each directory read, resolves the symlink /proc/self/fd/{fd} to determine if we're reading /proc.
• Gets the current process ID via getpid().
• Skips entries that match the current process ID when scanning /proc, making the process invisible in /proc listings.
• Passes through all other entries unmodified.

Build

cmake -S . -B build
cmake --build build

Produces build/libghost.so.

Usage

Preload the library into any program that enumerates /proc:

LD_PRELOAD=./libghost.so ls /proc

The calling process will be hidden from the listing. Run from the build/ directory for relative path resolution.

Notes

• Only hides the process that has the library preloaded; other processes remain visible.
• Only affects /proc directory listings; other directories pass through normally.
• Uses _GNU_SOURCE for RTLD_NEXT and related functions; requires glibc.
• Intended for educational/demonstration purposes only.