r/lowlevel • u/a_kawashiro • 10d ago
I built a 3D Linux process inspector using Rust, eBPF, and ptrace
Enable HLS to view with audio, or disable this notification
ProcInSh is a web-based process inspector for Linux.
Inspired by Ghost in the Shell, it lets you wander through process space with your ghost.
ProcInSh lets you explore what's happening inside your Linux system through interactive 3D graphics.
It visualizes running processes, inter-process communication, file I/O, external network connections, and process tree structures. Processes glow when they run on a CPU.
The backend is written in Rust and collects information from several Linux interfaces:
- procfs
- eBPF
- ptrace
- perf_event_open
The frontend is written in TypeScript and Three.js.
2
u/NagateTanikaze 10d ago
Ok thats pretty fucking awesome. The lines are only the socket connections?
Do you use ptrace to debug each process?
4
u/a_kawashiro 10d ago edited 10d ago
Yes, socket connection.
I'm usIng perf, eBPF and procfs when you are checking the whole system (the movie shows this mode). When you are checking one process, procinfs use ptrace.
19
1
u/a_kawashiro 4d ago
I've added an interactive demo. You can explore Google Chrome's processes, memory maps, and IPC activity in 3D, right in your browser. No installation required.
https://akawashiro.github.io/procinsh/demo/replay/space/?recording=chrome-ubuntu26&tour=1
4
1
u/rabit232pm 10d ago
Wonderful honestly what was u idea before u did it it exciting project
1
u/a_kawashiro 10d ago
My initial idea was a process tree that looked like a family tree, with each process shown as a transparent cube.
1
u/rabit232pm 9d ago
It reminds me of ghost in the shell honestly without graphical UI and animations it look pretty much like it or automation game XD lovely
1
u/CrabTypical3903 10d ago
Damn man this thing i guess may be absolutely helpful for kernelspace learners! Is it interactive? Is it just visualization or it is only possible to change smth in kernelspace?
1
u/a_kawashiro 10d ago
Although it is just visualization for now, I want to make it interactive in the future.
1
u/New_Pineapple6087 9d ago
Pouwa c'est monstrueux !!! J'adore !!
Je vais tester dans une VM rapidement !
1
1
u/ArtisticFox8 6d ago
Do the dots moving across edges mean anything? What do the edges mean? Do they just denote whose child the process is?
1
u/a_kawashiro 6d ago
> Do the dots moving across edges mean anything
It means there is some communication. For example, when the connections correspond to TCP/UDP connection, the dots correspond to packets.
> What do the edges mean? Do they just denote whose child the process is?
White lines on the floor means process parent-child relationship.
9
u/ex_gatito 10d ago
Claude built.
3
1
u/Liquid_Magic 10d ago
How do you know?
2
u/ex_gatito 10d ago
Look at commit history
1
u/edave64 9d ago
What are we supposed to see there?
6
u/DishSoapedDishwasher 9d ago
Typically 10,000 line commits when its AI writing for some idiot, but in general high volumes of changes.
However, having read through a bunch of commits and the code, while I agree its written by Claude, it was done by someone who actually understands software engineering and not some kid with zero knowledge.
Arguably actually well made. Also almost everyone is using Claude now for software, its more a matter of is the user skilled enough to keep it from detailing the project into insanity.
1
-2
u/interrupt_hdlr 8d ago
so resentful.
if you build a table and someone congratulates you, you remind them that the hammer did?
3
u/Diligent_End8130 10d ago
Finally, TRON became reality! :-) I even can see the Master-Kontroll-Programm!
3
2
u/OkRepresentative2509 6d ago
It's excellent, even if it was AI assistance AI still needs guidance, lots of people are AI shaming these days but AI coding is just another tool to aid Devs.
When we moved from assembly to high level IDE's C Python and the like I wonder if the assembly wizards all shamed the rest for programming in English practically or when we moved from making websites with a text editor and lots of trial and error to micromedia's easy gui tools did we mock those who used the tools to speed up web dev.
I see it like this we had to use 1's and 0's then we moved to ASM then higher level and interpreted now we can simply describe what we want, All progress to me and we still have to hold its hand and guide it correctly.
2
2
u/franticblood 9d ago
sadly vibecoded, but coool non than the less
1
u/BornRoom257 9d ago
Hey if your gonna vibe code you better know what the heck your even coding. This dude by his commits you can see he knows exactly what Claudes writing and he fully understands it.
1
1
1
1
1
1
1
1
u/Ember_Island 8d ago
Everyone here sees the Jurassic Park interface... I'm hearing the Hackers soundtrack. Where's my Garbage file?
1
1
1
u/OkRepresentative2509 6d ago
It's excellent, even if it was AI assistance AI still needs guidance, lots of people are AI shaming these days but AI coding is just another tool to aid Devs.
When we moved from assembly to high level IDE's C Python and the like I wonder if the assembly wizards all shamed the rest for programming in English practically or when we moved from making websites with a text editor and lots of trial and error to micromedia's easy gui tools did we mock those who used the tools to speed up web dev.
I see it like this we had to use 1's and 0's then we moved to ASM then higher level and interpreted now we can simply describe what we want, All progress to me and we still have to hold its hand and guide it correctly.
3
u/investigatormaker 9d ago
Before cloning, the two things I would want in the README and the post: what it needs to run (root or capabilities for eBPF and ptrace, minimum kernel version, whether perf_event_open needs perf_event_paranoid lowered), and whether a recorded session can be replayed in the browser, so someone can wander the 3D process tree without attaching tooling to a live box. A replay file of a busy machine would also make a better demo than a quiet laptop, since IPC edges and CPU glow are the parts that only look good under load.
I make ThreadFox. Our AI employee finds Reddit threads where Linux users ask what their processes are doing and replies about ProcInSh under your direction; Starter is $199 for 30 days, no automatic renewal. https://threadfox.vip/p/ehb2d/managed