Is there a way to find hidden options and arguments on for a command / package that isnt documented?

Question

On Linux if I install a new package and it contains commands I haven't used before, is there a way to find hidden options and args that are not documented in the MAN page or with the --help option.

Iv come across a couple of packages recently where there was hidden options that I would not of known had I not found out from the internet when troubleshooting an issue.

score 3 · Answer 1 · answered Jul 03 '18 at 10:36

You can only find hidden options and arguments from the source code, but that's not a problem as GNU/Linux is open source. On programs written in C you start by looking from main() function how the int argc for argument count and char *argv[] argument pointer array are handled.

#include <stdio.h>

int main( int argc, char *argv[] )  {

  if( argc == 2 ) {
    printf("The argument is %s\n", argv[1]);
  }
  else {
    printf("Exactly one argument expected.\n");
  }
}

Options are also passed from command line to the program as arguments. If the options are handed using getopt() API, you'll probably see a while loop checking through options using switch-case. This allows parsing the options and their arguments regardless of their order.

Normally, getopt is called in a loop. When getopt returns -1, indicating no more options are present, the loop terminates.

  while ((c = getopt (argc, argv, "abc:")) != -1)
    switch (c)
      {
      case 'a':
        aflag = 1;
        break;
      case 'b':
        bflag = 1;
        break;
      case 'c':
        cvalue = optarg;
        break;
      case '?':
        if (optopt == 'c')
          fprintf (stderr, "Option -%c requires an argument.\n", optopt);
        else if (isprint (optopt))
          fprintf (stderr, "Unknown option `-%c'.\n", optopt);
        else
          fprintf (stderr,
                   "Unknown option character `\\x%x'.\n",
                   optopt);
        return 1;
      default:
        abort ();
      }

A second loop is used to process the remaining non-option arguments.

  for (index = optind; index < argc; index++)
    printf ("Non-option argument %s\n", argv[index]);

I'd start the search by looking for these loops and then where else argv is used.

score 2 · Accepted Answer · answered Jul 03 '18 at 11:29

Not everything is open source, even on Linux so assuming the source code isn't available to you for some reason, perhaps just because you don't want to bother with searching the source code and downloading it or viewing it online, you might find clues by looking for strings in the command binary file.

The strings command is precisely designed to extract readable strings from a binary file.

For example, you now the the lscommand is accepting the -T <tabsize> option, so assuming it is using getopt to parse its arguments, the sequence of characters T: should be in the getopt option list.

This is indeed the case:

$ strings /bin/ls | grep T:
abcdfghiklmnopqrstuvw:xABCDFGHI:LNQRST:UXZ1

All the letters are options so you can then verify if all are documented or not.

You might also look for long options but unless you have already a clue about what the hidden option names might be, it is more complex as you need to have a look to all the strings.

Should you already know one of the long options, you might limit your search to the strings appearing close to them.

Staying with the ls case, you'll find all these strings around the tabsize option:

$ strings /bin/ls | less
...
no-group
hide-control-chars
reverse
almost-all
ignore-backups
classify
file-type
dereference-command-line
hide
ignore
dereference
literal
quote-name
recursive
show-control-chars
tabsize
time-style
block-size
context
author
help

score 1 · Answer 3 · answered Jul 03 '18 at 11:27

The problem with undocumented features/options/switches is that there is of course no standard place where you can find them.

The source code is the ultimate (or maybe the first) place to look for what is supported, but you may need some background in software development to be able to read code and understand the implication/implementation of a certain feature.

Many developers that neglect updating documentation will still mention new features in the Changelog they maintain. Changelogs are although frequently quite concise, still in normal English rather than code.

Even if not maintained by the developer frequently a packager will still maintain a Changelog that includes an overview of security updates and any new features that were backported.
Typically by the package maintainer installs the Changelog in /usr/share/doc/<package-name/ and includes a version of it in the package itself, query your installed RPM packages with rpm -q -changelog <package> or use apt-get changelog <package> on Debian and Ubuntu.

One somewhat obscure example:
The -- option is as far as I know not explicitly documented for many if not most of the commands that do support it and it has become a slightly obscure syntax.
It finds it's origins in the getopt function and is used to "delimit the end of the options and the start of the parameters" and is what you would use when (possibly) your arguments may have the appearance of options. example here

I went directly to the source mainly for this reason: it's not very useful to know that an option exists without also knowing what it does. Since there's no documentation, source is the only place to get that information from. (Also a usable method when the documentation fails to explain the feature accurately.) — Esa Jokinen, Jul 03 '18 at 11:40

Is there a way to find hidden options and arguments on for a command / package that isnt documented?

3 Answers3