3 ms·
Production code that checks if a debugger is attached should be illegal. Ideally there would be a way to get the debugger to lie to the process that a debugger
by bentcorner 4y ago
Production code that checks if a debugger is attached should be illegal.
Ideally there would be a way to get the debugger to lie to the process that a debugger is indeed not attached. Sure, maybe there's a reason today why you actually need to know a debugger isn't attached but at least give future-developers an escape hatch if they need it.
- 10000truths 4y agoOn Linux, you can "lie" to the process by running it with the LD_PRELOAD environment variable set to a library that hijacks ptrace(PTRACE_TRACEME, ...) to return 0. If the process is smart enough to check for LD_PRELOAD as well, you might be able to use something like seccomp to hijack the return value at the OS level.
- virchau13 4y agoYou don't need LD_PRELOAD; the ptrace mechanism by itself can intercept system calls and modify them on the fly.
- mecha_ghidorah 4y agoIt's mostly an attempt at stopping someone attaching a debugger to an application you've shipped