Changing Linux 'ps' output by changing argv[0]

Question

I'm trying to have a program alter what 'ps' displays as the process's CMD name, using the technique I've seen recommended of simply overlaying the memory pointed to by argv[0]. Here is the sample program I wrote.

#include <iostream>
#include <cstring>
#include <sys/prctl.h>
#include <linux/prctl.h>
using std::cout;
using std::endl;
using std::memcpy;

int main(int argc, char** argv)  {
    if ( argc < 2 ) {
        cout << "You forgot to give new name." << endl;
        return 1;
    }

    // Set new 'ps' command name - NOTE that it can't be longer than
    // what was originally in argv[0]!

    const char *ps_name = argv[1];
    size_t arg0_strlen = strlen(argv[0]);
    size_t ps_strlen = strlen(ps_name);
    cout << "Original argv[0] is '" << argv[0] << "'" << endl;

    // truncate if needed
    size_t copy_len = (ps_strlen < arg0_strlen) ? ps_strlen+1 : arg0_strlen;
    memcpy((void *)argv[0], ps_name, copy_len);
    cout << "New name for ps is '" << argv[0] << "'" << endl;

    cout << "Now spin.  Go run ps -ef and see what command is." << endl;
    while (1) {};
}

The output is:

$ ./ps_test2 foo
Original argv[0] is './ps_test2'
New name for ps is 'foo'
Now spin.  Go run ps -ef and see what command is.

The output of ps -ef is:

5079     28952  9142 95 15:55 pts/20   00:00:08 foo _test2 foo

Clearly, "foo" was inserted, but its null terminator was either ignored or turned into a blank. The trailing portion of the original argv[0] is still visible.

How can I replace the string that 'ps' prints?

Answer 1

You need to rewrite the entire command line, which in Linux is stored as a contiguous buffer with arguments separated by zeros.

Something like:

size_t cmdline_len = argv[argc-1] + strlen(argv[argc-1]) - argv[0];
size_t copy_len = (ps_strlen + 1 < cmdline_len) ? ps_strlen + 1 : cmdline_len;
memcpy(argv[0], ps_name, copy_len);
memset(argv[0] + copy_len, 0, cmdline_len - copy_len);