3 ms·

> Thankfully this is easy to circumvent: have your debugger catch the ptrace syscall and lie about the result. Yeah, Apple iTunes did that IIRC, and it was sup

by lapcat 3y ago

> Thankfully this is easy to circumvent: have your debugger catch the ptrace syscall and lie about the result. Yeah, Apple iTunes did that IIRC, and it was super easy to bypass.

sjtgraham 3y ago
On Apple platforms ptrace supports an additional flag "PT_DENY_ATTACH", which is what iTunes uses. It causes the target process to exit.
- lapcat 3y ago
  Yeah, that's it. Also DVD Player, for example. Pretty trivial to work around.