It's nmap
but for pids. 🤓
Please help me become an independent programmer by donating directly below.
xpid
gives a user the ability to "investigate" for process details on a Linux system.
For example a sleeping thread will have a directory /proc/[pid]
that can be navigated to, but not listed.
xpid
will check many different places in the kernel for details about a pid.
By searching subsets of possible pids xpid
will be able to check for pid details in many places in the kernel.
xpid [flags] -o [output] <query>
Investigate all pids
xpid
Investigate pid 1
xpid 1
Find all container processes on a system
xpid -c
Find all processes in the same namespace(s) as pid 1
xpid --ns-in [mnt, net, pid, ipc, cgroup]
Find all processes not in the same namespace(s) as current user
xpid --ns-out-user [mnt, net, pid, ipc, cgroup]
Find all processes running with eBPF programs as JSON
xpid --ebpf -o json <pid-query>
Find all processes running with eBPF programs, in a container, in /proc
xpid -b -c -p
Find all processes between specific values (Query syntax)
xpid <flags> +100 # Search pids up to 100
xpid <flags> 100-2000 # Search pids between 100-2000
xpid <flags> 65000+ # Search pids 65000 or above
Find all hidden processes on a system (slow)
xpid -x <pid-query>
xpid
will lookup container processes at runtime. 🎉
This works by reading the link in /proc/[pid]/ns/@cgroup
and correlating it back to the value in /proc/1/[pid]/ns/@cgroup
.
Regardless of the pid namespace context, if there is a "container" that is unique from the current pid 1, xpid
will find it.
xpid
will find pids that have eBPF programs loaded at runtime.
This works by correlating the file descriptor info from /proc/[pid]/fdinfo/*
back to /sys/fs/bpf/progs.debug
.
If a pid has an eBPF program loaded, xpid
will find it.
Hidden pids (xpid -x) 🙈
Because of the flexibility with kernel modules and eBPF in the kernel, it can be possible to prevent the proc(5)
filesystem from listing pid details in traditional ways.
xpid
uses a variety of tactics to search for pids in the same way nmap
will use different tactics to port scan a target.
xpid
is a Go runtime utility that depends on libxpid
.
Install libxpid
first (below), and then compile the Go runtime.
git clone https://github.com/kris-nova/xpid.git
cd xpid
make
sudo make install
libxpid
is written in C, as it will leverage ptrace(2)
and eBPF code directly.
This means that the xpid
executable is NOT entirely statically linked.
You must first have libxpid
installed on your system, before the xpid
Go program will run.
git clone https://github.com/kris-nova/xpid.git
cd xpid/libxpid
./configure
cd build
make
sudo make install