ShadowDetect.sh

#!/bin/bash
# Script Name: Shadow Detect
# Description: A lightweight tool to detect hidden processes on Linux
# by comparing kernel syscalls against the /proc filesystem.
# Written by Frank Zhu <zhuzhenquan@bytedance.com>      2025.12.08

if [ "$(id -u)" -ne 0 ]; then
    echo "[-] Error: Please run as root (sudo) to probe all system processes.."
    exit 1
fi

if [ -f /proc/sys/kernel/pid_max ]; then
    PID_MAX=$(cat /proc/sys/kernel/pid_max)
else
    PID_MAX=32768
fi

echo "[*] Initializing Shadow Detect..."
echo "[*] System Max PID: $PID_MAX"
echo "[*] Starting Brute-Force Enumeration..."

HIDDEN_COUNT=0
STEP=$((PID_MAX / 10))
if [ "$STEP" -lt 1 ]; then STEP=1; fi

for (( pid=1; pid<=PID_MAX; pid++ )); do

    if (( pid % STEP == 0 )); then
        PERCENT=$(( pid * 100 / PID_MAX ))
        echo -ne "\r[*] Scanning progress: ${PERCENT}%"
    fi

    if kill -0 "$pid" 2>/dev/null; then
        
        if [ ! -d "/proc/$pid" ]; then
            if [ ! -d "/proc/$pid" ]; then
                echo ""
                echo "[!] SUSPICIOUS: Hidden Process Found! PID: $pid"
                echo "    -> Kernel (kill -0) confirms existence."
                echo "    -> Directory (/proc/$pid) is missing."
                ((HIDDEN_COUNT++))
            fi
        fi
    fi

done

echo -e "\n=================================================="
if [ "$HIDDEN_COUNT" -eq 0 ]; then
    echo "[+] System Clean: No hidden processes detected."
else
    echo "[-] WARNING: Found $HIDDEN_COUNT hidden process(es)."
fi
echo "=================================================="