6 ms·

Yes, and introducing bugs is not the only issue at stake. Imagine malware that could react differently when a debugger is attached.

kazinator 9y ago
The debugger could have a mode of "stealth attachment" under which that feature is not activated; the connection with that special interface is not made, and so the program is not informed that it's under a debugger, and those debug streams don't connect to anything.
stouset 9y ago
Malware already does this. Non-malware programs already do this to complicate analysis.
- kazinator 9y ago
  If those non-malware programs are fixed to use a proper API instead of side channel hacks, then it simplifies analysis.
  - saagarjha 9y ago
    > If those non-malware programs are fixed to use a proper API instead of side channel hacks, then it simplifies analysis. I think you’re missing the point as to why programs would do this. Usually it’s to protect some sort of DRM scheme through obscurity.
    - deleted 9y ago
      [deleted]
ChrisLomont 9y ago
Malware already does this on many platforms via many methods, and has done so for perhaps decades. Here's [1] the tip of the iceberg on this issue. [1] antukh.com/blog/2015/01/19/malware-techniques-cheat-sheet/
dustfinger 9y ago
Well, to be fair malware already exists that can detect when a system debugger is attached so maybe my concern is invalid. I guess the greater concern is the introduction of bugs after all. Edit - Other commenters beet me to this point :-P
- kazinator 9y ago
  The program is what it is and it has bugs. There is a risk that bugs are irreproducible under a debugger (no matter how transparent the debugger). Oh well; you have to debug those in some other way. That risk shouldn't paralyze us from innovating debuggers. There are bugs that won't reproduce when you debug via JTAG; so what. Simply pausing on a breakpoint can make a bug irreproducible. Programs can infer that they are being debugged via timings, and various side channels.
  - saagarjha 9y ago
    The issue is that by introducing this feature, you're increasing the number of programs that behave differently when a debugger is attached. Just because this can be an issue today doesn't mean that we should make it even more of an issue tomorrow.
jcelerier 9y ago
> Imagine malware that could react differently when a debugger is attached. that has been the case for a long time: simply timing some instructions is generally enough to tell you that you're running under a debugger. It's also helpful for copy protection.

kazinator 9y ago

The debugger could have a mode of "stealth attachment" under which that feature is not activated; the connection with that special interface is not made, and so the program is not informed that it's under a debugger, and those debug streams don't connect to anything.

stouset 9y ago

Malware already does this. Non-malware programs already do this to complicate analysis.

kazinator 9y ago
If those non-malware programs are fixed to use a proper API instead of side channel hacks, then it simplifies analysis.
- saagarjha 9y ago
  > If those non-malware programs are fixed to use a proper API instead of side channel hacks, then it simplifies analysis. I think you’re missing the point as to why programs would do this. Usually it’s to protect some sort of DRM scheme through obscurity.
  - deleted 9y ago
    [deleted]

ChrisLomont 9y ago

Malware already does this on many platforms via many methods, and has done so for perhaps decades. Here's [1] the tip of the iceberg on this issue. [1] antukh.com/blog/2015/01/19/malware-techniques-cheat-sheet/

dustfinger 9y ago

Well, to be fair malware already exists that can detect when a system debugger is attached so maybe my concern is invalid. I guess the greater concern is the introduction of bugs after all. Edit - Other commenters beet me to this point :-P

kazinator 9y ago
The program is what it is and it has bugs. There is a risk that bugs are irreproducible under a debugger (no matter how transparent the debugger). Oh well; you have to debug those in some other way. That risk shouldn't paralyze us from innovating debuggers. There are bugs that won't reproduce when you debug via JTAG; so what. Simply pausing on a breakpoint can make a bug irreproducible. Programs can infer that they are being debugged via timings, and various side channels.
- saagarjha 9y ago
  The issue is that by introducing this feature, you're increasing the number of programs that behave differently when a debugger is attached. Just because this can be an issue today doesn't mean that we should make it even more of an issue tomorrow.

jcelerier 9y ago

> Imagine malware that could react differently when a debugger is attached. that has been the case for a long time: simply timing some instructions is generally enough to tell you that you're running under a debugger. It's also helpful for copy protection.