Problem - Kevin Tafuro

Discussion
The spc_trap_detect( ) function is used to install a signal handler to catch trap signals
sent to the target, then issue a trap signal. The SPC_DEBUGGER_PRESENT macro
checks the num_traps counter managed by the trap signal handler; if the counter is
zero, a debugger is capturing the trap signals and is not sending them to the process.
#include
#include
#define SPC_DEBUGGER_PRESENT (num_traps = = 0)
static int num_traps = 0;
static void dbg_trap(int signo) {
num_traps++;
}
int spc_trap_detect(void) {
if (signal(SIGTRAP, dbg_trap) = = SIG_ERR) return 0;
raise(SIGTRAP);
return 1;
}
The following example demonstrates the use of spc_trap_detect( ) to initialize the
debugger detection, and SPC_DEBUGGER_PRESENT to check for the presence of a debugger:
int main(int argc, char *argv[ ]) {
int x;
spc_trap_detect( );
for (x = 0; x < 10; x++) {
if (SPC_DEBUGGER_PRESENT) printf("being debugged!\n");
else printf("y\n");
}
return(0);
}
This detection method is not particularly effective because most Unix debuggers
allow the trap signal to be sent through to the process; however, tools that automatically
single step through their targets (to record system calls, data access, etc.) will be
detected using this method.
Most Unix debuggers are based on the ptrace system service, which is an interface to
process control services in the kernel. ptrace-based debuggers were designed with
source code debugging in mind, so they are incapable of dealing with hostile code.
Detecting a ptrace debugger is simple, and the technique is well-known: ptrace prevents
a process that is currently being traced from tracing itself or another process, so
an attempt to ptrace another process will always fail if the current process is being
traced. The following code demonstrates how to detect a ptrace-based debugger by
creating a child process and attempting to attach to it.
This is the Title of the Book, eMatter Edition
Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.
Detecting Unix Debuggers | 683