Manipulating the name in the process list is a common practice. E.g. I have in my process listing the following:
root 9847 0.0 0.0 42216 1560 ? Ss Aug13 8:27 /usr/sbin/dovecot -c /etc/dovecot/d
root 20186 0.0 0.0 78880 2672 ? S Aug13 2:44 \_ dovecot-auth
dovecot 13371 0.0 0.0 39440 2208 ? S Oct09 0:00 \_ pop3-login
dovecot 9698 0.0 0.0 39452 2640 ? S Nov07 0:00 \_ imap-login
ericb 9026 0.0 0.0 48196 7496 ? S Nov11 0:00 \_ imap [ericb 192.168.170.186]
Dovecot uses this mechanism to easily show what each process is doing.
It's basically as simple as manipulating the argv[0]
parameter in C. argv
is an array of pointers to the parameters with which the process has been started. So a command ls -l /some/directory
will have:
argv[0] -> "ls"
argv[1] -> "-l"
argv[2] -> "/some/directory"
argv[3] -> null
By allocating some memory, putting some text in that memory, and then putting the address of that memory in argv[0]
the process name shown will have been modified to the new text.