process_argument_spoofer_linux.c

/*
 * Process arguments spoofing in GNU/Linux.
 *
 * Hide program arguments by overwriting them with null.
 *
 * You can read my full post here: https://rubenhortas.github.io/posts/process-argument-spoofing-gnu-linux/
 */

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>

int main(int argc, char *argv[]) {
    char *argv0 = argv[0];
    char *argvi;
    int i, len;

    printf("PID: %d\n", getpid());
    printf("argv[0] '%s', address '%p'\n", argv[0], argv);

    for (i = 1; i < argc; i++) {
        argvi = argv[i];
        printf("argv[%d] '%s', address '%p'\n", i, argv[i], argvi);

        len = strlen(argv[i]);
        memset(argv[i], 0, len); // Overwrite everything with null
    }

    strcpy(argv0, "[kworker fake/1:1-events]"); // Overwrite the program name

    while(1) { // Do some stuff
    }

    free(argv0);
    free(argvi);

    return 0;
}