Illustration: Port hiding of adore-ng

Port hiding prevents users from using commands such as netstat to obtain the port information to be hidden. Netstat is done by reading files in/proc/net. Strace can be seen that netstat's main operations include: Open/Read File/proc/NET/tcp,/proc/NET/udp,/proc/NET/raw ......,

For example:

Adore-ng implementation:

By default, adore hides TCP ports 2222 and 7350:

1. Find the subitem proc_net named TCP. Replace the get_info function of this subitem.

2. Our get_info function first calls the original get_info function of the system to obtain a buffer. The buffer contains the content of the/proc/NET/tcp file. Parse the data obtained by get_info, filter out the ports 2222 and 7350, and then load the filtered content into a new buffer. Finally, we will return the memory that we applied for and filtered out port 2222 and port 7350 information.