Problem - Kevin Tafuro

#include
#include
#include
#include
#include
#include
#include
int spc_detect_ptrace(void) {
int status, waitrc;
pid_t child, parent;
parent = getpid();
if (!(child = fork())) {
/* this is the child process */
if (ptrace(PT_ATTACH, parent, 0, 0)) exit(1);
do {
waitrc = waitpid(parent, &status, 0);
} while (waitrc == -1 && errno == EINTR);
ptrace(PT_DETACH, parent, (caddr_t)1, SIGCONT);
exit(0);
}
if (child == -1) return -1;
do {
waitrc = waitpid(child, &status, 0);
} while (waitrc == -1 && errno == EINTR);
return WEXITSTATUS(status);
}
The state of the art in anti-debugging on Unix is not very advanced, because all
widely used Unix debuggers are based on ptrace and do not require any special tricks
to detect; generally speaking, any method that detects or counters ptrace should succeed.
It is important to realize, however, that calls to ptrace( ) can be replaced with
nop instructions in the binary to defeat the debugger detection, so take care to disguise
them. For example, by using the system call interface instead of the C interface,
the ptrace( ) system call can also be hooked at the kernel level to force a
successful return.
See Also
“Linux Anti-Debugging Techniques” by Silvio Cesare (the techniques listed here
were published in that 1999 paper, http://vx.netlux.org/lib/vsc04.html.
684 | Chapter 12: Anti-Tampering
This is the Title of the Book, eMatter Edition
Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.