From 297e06c138cce5d9c85ac8b44ca94cedc36026e8 Mon Sep 17 00:00:00 2001
From: Skyper THC <skyper@proton.thc.org>
Date: Sat, 29 Nov 2025 08:07:56 +0000
Subject: [PATCH] Generic Ebury socket detection

---
 ebury/detect_ebury.sh | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/ebury/detect_ebury.sh b/ebury/detect_ebury.sh
index aa76430..c432b5f 100755
--- a/ebury/detect_ebury.sh
+++ b/ebury/detect_ebury.sh
@@ -61,6 +61,18 @@ declare -A ebury_socket_addr=(
 	["event-lqG1FF5dwG"]="1.8.2.e6"
 )
 
+# Detect Ebury abstract UNIX socket based on regex.
+add_generic_socket() {
+	local s
+
+	s="$(grep -Eom1 '@(event-[a-zA-Z0-9]{10}|/dev/(event|stats)-[a-zA-Z0-9]{10}|UDEV-[a-zA-Z0-9]{8}|/run/systemd/log|/proc/udevd)' /proc/net/unix)"
+	s="${s:1}"
+	# /tmp/dbus-[a-zA-Z0-9]{10} is a common name, but Ebury has only 1 per master process.
+	[ -z "$s" ] && s="$(grep -E '@/tmp/dbus-[a-zA-Z0-9]{10}' /proc/net/unix | sed 's|.*@||g'  | sort | uniq -c | grep " 1 " | awk '{print $2}' | head -n1)"
+	[ -z "$s" ] && return
+	ebury_socket_addr["$s"]="Ebury of unknown version"
+}
+
 # Finds the PID of the Ebury process from the inode of the UNIX socket
 function find_ebury_pid() {
 	find /proc -maxdepth 3 -lname "socket:\[$1\]" 2> /dev/null | cut -d/ -f 3
@@ -93,6 +105,7 @@ function retry_with_rootkit_evastion {
 function detect() {
 	local RED='\033[0;31m'
 	local CLEAR='\033[0m'
+	add_generic_socket
 	for socket in "${!ebury_socket_addr[@]}"; do
 		if abstract_unix_socket_exists "$socket"; then
 			echo -n -e "${RED}Found abstract UNIX socket \"$socket\" for "