can you fake *nix uptime?

Question

Just curious, Can you fake an uptime, for instance increase it to 10 years?

I have tried changing system time, and it won't do this trick.

Dependency

Answer 1

Have a look at this utility: UptimeFaker.

Carper

Answer 2

alias uptime='echo " 11:07:17 up 10 BILLION YEARS!,  4 users,  load average: 0.38, 0.52, 0.41"'

If you want to get extra-fancy, you could take the actual uptime output and modify that.

Lorenzetti

thats one way, but is there a way to /usr/bin/uptime to produce this? – Dependency

@c2h2: if you tell us what you're trying to achieve, then we might be able to find out what you want. Replacing /usr/bin/uptime with a shellscript would be one possible approach (people could still query /proc/uptime however). – Lorenzetti

I'm not trying to do anything harm, just curious if this is something can be manually changed. so next time when I login some machines and check uptime, I know no one has hacked anything. – Dependency

@c2h2: how does the uptime tell you that nothing has been hacked? – Lorenzetti

Answer 3

Yeah, you should be able to attach a gdb to the running kernel, and hack the uptime value. You'd need to know where it was kept, and have a symbols file. I am assuming here, that uptime is held in something statically allocated.

Alternatively, write a small kernel module which hacks the uptime when you load it (and immediately unloads again).

Chesterfieldian

If it's statically allocated, you could also find it in /dev/mem and modify it directly. – Billman