3 ms·

Does follow-fork-mode in lldb not also defeat this?

by a_t48 2y ago

cryptonector 2y ago
Yes.
tonygo 2y ago
I tried with LLDB using `settings set target.process.follow-fork-mode child` but for some reasons I feel like it still exit from the parent process. I also tried with a long living process: https://github.com/tony-go/antidebug-examples/tree/main/swift https://github.com/tony-go/antidebug-examples/tree/main/swif... And I got this: ``` (lldb) run Process 14345 launched: '/anti-debug/swift/build/anti_debug' (arm64) start pid = 14345 exit parent process for child pid = 14348 continue as child process pid = 14348 Process 14345 exited with status = 0 (0x00000000) ``` The UI did not even appeared as it should. Maybe I miss something in my LLDB config...
- tonygo 2y ago
  Also it could come from a messy thing in the code.
cassepipe 2y ago
The main reason for using dlsym instead of calling fork directly is to make it harder for an ‘attacker’ to detect or set breakpoints on the fork function, thus obfuscating the anti-debugging mechanism. You have to more checks before being able to understand why you cannot attach the debuger. You may still think that mode could be still able to catch a new child process but apparently people have tried and the answer is no
- a_t48 2y ago
  Ah, I never considered how follow forks mode might actually work/
  - tonygo 2y ago
    I tried, but I was not able to determine so far...
    - tonygo 2y ago
      I try to transform my C program into a long living one (just adding a sleep). https://github.com/tony-go/antidebug-examples/pull/1 https://github.com/tony-go/antidebug-examples/pull/1 At first, it appears that the follow fork mode works nicely. But at some point it did not ... If I run it 10 times consequtively in LLDB. Sometimes it works, sometimes not ...
- tonygo 2y ago
  > You may still think that mode could be still able to catch a new child process but apparently people have tried and the answer is no Not sure I got this. IIUC there is a link between the fact that we used dlsym and the fact the child process is not catched by lldb in the follow fork mode?

Does follow-fork-mode in lldb not also defeat this?

by a_t48 2y ago

Does follow-fork-mode in lldb not also defeat this?

cryptonector 2y ago

Yes.

tonygo 2y ago

I tried with LLDB using `settings set target.process.follow-fork-mode child` but for some reasons I feel like it still exit from the parent process. I also tried with a long living process: https://github.com/tony-go/antidebug-examples/tree/main/swift https://github.com/tony-go/antidebug-examples/tree/main/swif... And I got this: ``` (lldb) run Process 14345 launched: '/anti-debug/swift/build/anti_debug' (arm64) start pid = 14345 exit parent process for child pid = 14348 continue as child process pid = 14348 Process 14345 exited with status = 0 (0x00000000) ``` The UI did not even appeared as it should. Maybe I miss something in my LLDB config...

tonygo 2y ago
Also it could come from a messy thing in the code.

cassepipe 2y ago

The main reason for using dlsym instead of calling fork directly is to make it harder for an ‘attacker’ to detect or set breakpoints on the fork function, thus obfuscating the anti-debugging mechanism. You have to more checks before being able to understand why you cannot attach the debuger. You may still think that mode could be still able to catch a new child process but apparently people have tried and the answer is no

a_t48 2y ago
Ah, I never considered how follow forks mode might actually work/
- tonygo 2y ago
  I tried, but I was not able to determine so far...
  - tonygo 2y ago
    I try to transform my C program into a long living one (just adding a sleep). https://github.com/tony-go/antidebug-examples/pull/1 https://github.com/tony-go/antidebug-examples/pull/1 At first, it appears that the follow fork mode works nicely. But at some point it did not ... If I run it 10 times consequtively in LLDB. Sometimes it works, sometimes not ...
tonygo 2y ago
> You may still think that mode could be still able to catch a new child process but apparently people have tried and the answer is no Not sure I got this. IIUC there is a link between the fact that we used dlsym and the fact the child process is not catched by lldb in the follow fork mode?