3 ms·
The malware will then rely on actual ptrace behaviour as a check. You could instead use seccomp_unotif and let the target ptrace itself as much as it wants: htt
by adtac 3y ago
The malware will then rely on actual ptrace behaviour as a check. You could instead use seccomp_unotif and let the target ptrace itself as much as it wants: https://man.archlinux.org/man/seccomp_unotify.2.en https://man.archlinux.org/man/seccomp_unotify.2.en
- harryfyx 3y agoI don't know reverse engineering. But, I guess the ultimate solution would be running a custom OS to fake ptrace results in the kernel level?
- scandinavian 3y agoYou can just use LD_PRELOAD to load your own version of ptrace. Not as stealthy though.
- pizzapim 3y agoAnother way is to load a eBPF program or kernel module for this purpose.