3 added 18 characters in body
source | link

ptraceptrace can be detected by the fact that an executablea process can only call ptraceptrace once. if ptrace()ptrace() was already called by the stracestrace executable or a debugger, we can detect it in runtime.

#include <stdio.h>
#include <sys/ptrace.h>

int main()
{
    if (ptrace(PTRACE_TRACEME, 0, 1, 0) == -1) 
    {
        printf("don't trace me !!\n");
        return 1;
    }
    // normal execution
    return 0;
}

However, it's not hard to break this code. first, it's possible just to NOP the ptrace() call. Second, it's possible to replace ptrace() call with our own ptrace() call using LD_PRELOAD

ptrace can be detected by the fact that an executable can only call ptrace once. if ptrace() was already called by the strace executable, we can detect it in runtime.

#include <stdio.h>
#include <sys/ptrace.h>

int main()
{
    if (ptrace(PTRACE_TRACEME, 0, 1, 0) == -1) 
    {
        printf("don't trace me !!\n");
        return 1;
    }
    // normal execution
    return 0;
}

However, it's not hard to break this code. first, it's possible just to NOP the ptrace() call. Second, it's possible to replace ptrace() call with our own ptrace() call using LD_PRELOAD

ptrace can be detected by the fact that a process can only call ptrace once. if ptrace() was already called by the strace executable or a debugger, we can detect it in runtime.

#include <stdio.h>
#include <sys/ptrace.h>

int main()
{
    if (ptrace(PTRACE_TRACEME, 0, 1, 0) == -1) 
    {
        printf("don't trace me !!\n");
        return 1;
    }
    // normal execution
    return 0;
}

However, it's not hard to break this code. first, it's possible just to NOP the ptrace() call. Second, it's possible to replace ptrace() call with our own ptrace() call using LD_PRELOAD

2 added 200 characters in body
source | link

ptrace can be detected by the fact that an executable can only call ptrace once. if ptrace() was already called by the strace executable, we can detect it in runtime.

#include <stdio.h>
#include <sys/ptrace.h>

int main()
{
    if (ptrace(PTRACE_TRACEME, 0, 1, 0) == -1) 
    {
        printf("don't trace me !!\n");
        return 1;
    }
    // normal execution
    return 0;
}

However, it's not hard to break this code. first, it's possible just to NOP the ptrace() call. Second, it's possible to replace ptrace() call with our own ptrace() call using LD_PRELOAD

ptrace can be detected by the fact that an executable can only call ptrace once. if ptrace() was already called by the strace executable, we can detect it in runtime.

#include <stdio.h>
#include <sys/ptrace.h>

int main()
{
    if (ptrace(PTRACE_TRACEME, 0, 1, 0) == -1) 
    {
        printf("don't trace me !!\n");
        return 1;
    }
    // normal execution
    return 0;
}

ptrace can be detected by the fact that an executable can only call ptrace once. if ptrace() was already called by the strace executable, we can detect it in runtime.

#include <stdio.h>
#include <sys/ptrace.h>

int main()
{
    if (ptrace(PTRACE_TRACEME, 0, 1, 0) == -1) 
    {
        printf("don't trace me !!\n");
        return 1;
    }
    // normal execution
    return 0;
}

However, it's not hard to break this code. first, it's possible just to NOP the ptrace() call. Second, it's possible to replace ptrace() call with our own ptrace() call using LD_PRELOAD

1
source | link

ptrace can be detected by the fact that an executable can only call ptrace once. if ptrace() was already called by the strace executable, we can detect it in runtime.

#include <stdio.h>
#include <sys/ptrace.h>

int main()
{
    if (ptrace(PTRACE_TRACEME, 0, 1, 0) == -1) 
    {
        printf("don't trace me !!\n");
        return 1;
    }
    // normal execution
    return 0;
}