A faithful, cross-platform Rust reimplementation of the UnHide forensic toolkit — find processes and TCP/UDP ports hidden by rootkits.
English · 中文
UnHide is a forensic tool that detects processes and TCP/UDP ports that are
present on a system but hidden from the usual tools (ps, ss/netstat) — the
classic signature of a rootkit or a malicious kernel module. It works by
cross-checking what userland tools report against what the kernel actually
knows (/proc, system calls, direct PID/port probing).
unhide-rs rewrites the whole toolkit in Rust, keeping the output, exit codes,
and detection semantics byte-for-byte / code-for-code identical to the
original, while shipping a single binary, an optional GUI, and multi-platform
release builds.
- 🦀 Pure Rust, single
unhidebinary with four subcommands. - 🔍 All original techniques:
/procvsps, procfs walking, syscall scans, PID brute-forcing, reverse (anti-tamper) checks, and TCP/UDP port hunting. - 🖥️ Optional GUI (
unhide-gui, egui) — point-and-click test selection. - 🎯 Faithful: identical strings, exit codes, and semantics to UnHide v20240510.
- 📦 Cross-platform releases via GitHub Actions — static musl Linux builds for many architectures, macOS (Intel + Apple Silicon), and FreeBSD.
- ✅ Verified item-by-item against the original C binaries.
The original shipped four programs; here they are subcommands of one binary:
| command | original | platforms |
|---|---|---|
unhide linux [options] <test_list> |
unhide-linux |
Linux ≥ 2.6 |
unhide posix <proc|sys> |
unhide-posix |
generic Unix |
unhide tcp [options] |
unhide-tcp |
Linux/macOS/*BSD |
unhide rb |
unhide_rb |
Linux |
Like the original, root is required to run
linux/tcp/rb.
Download the archive for your platform from the Releases
page, unpack it, and run ./unhide. Or build from source (below).
Which Linux build?
| asset | linking | use it for |
|---|---|---|
…-linux-musl (x86_64 / aarch64 / armv7 / i686 / riscv64) |
static | servers, older distros, anything — no glibc dependency (recommended). CLI only. |
…-linux-gnu (x86_64) |
dynamic glibc | recent desktops; also ships the GUI (unhide-gui). Needs a recent glibc. |
If a
gnubuild printsGLIBC_2.xx not found, your system's glibc is too old (e.g. CentOS 7/8) — use the musl build instead: it is fully static and runs anywhere. The GUI cannot be statically linked, so it ships only in thegnudesktop archive.
sudo unhide linux quick reverse # fast process scan + anti-tamper check
sudo unhide linux -m -d sys procall brute reverse # deep forensic sweep
sudo unhide tcp -s # fast hidden-port scan (server strategy)
sudo unhide tcp -flov # hidden ports + fuser/lsof attribution + logSee the full user manual (中文：docs/USAGE_zh.md) for every option, the test list, worked examples, and scenario playbooks.
cargo build --release # everything (incl. GUI; needs graphics dev libs)
cargo build --release -p unhide-cli # CLI only (no graphics dependencies)Building the GUI on Linux needs graphics dev libraries (Debian/Ubuntu):
sudo apt-get install -y libclang-dev libgtk-3-dev libxcb-render0-dev \
libxcb-shape0-dev libxcb-xfixes0-dev libxkbcommon-dev libssl-devPushing a v* tag triggers .github/workflows/release.yml, which cross-compiles
and publishes archives:
- Linux (static musl): x86_64 / aarch64 / armv7 / i686 / riscv64
- Linux x86_64 desktop and macOS (Intel + Apple Silicon): CLI + GUI
- FreeBSD: CLI (best-effort)
cargo test --workspace- Output strings, exit codes, and detection semantics match the original (errno vs. return value, PID ranges, test execution order, standard-test expansion, …).
- Verified item-by-item against the original C binaries on Linux as root (proc/procfs/sys/quick/reverse, every elementary test, all tcp modes, posix, rb); output is identical apart from the inherently timing-based false positives that vary between runs.
GPL-3.0-or-later (same as the original UnHide).