Fork and Waitpid calls in a CTF linux binary

Question

I'm doing one of my first linux crackmes.

In the first blocks of code, it goes inside some anti-debug routine and inside one of those it forks and after it calls a waitpid routine. I can verify it and understand purely the code but I can't get why the creators put this code and how it can be an anti-debug technique. These are the interesting blocks.

Answer 1

Basically, the process calls fork, on the child side it'll try to attach a debugger to the parent process:

ptrace(PTRACE_ATTACH, getppid(), 0, 0);

If this syscall failed, it probably means a debugger is already attached to the parent process, this is your anti-debugger. To notify the parent process, the developer relies on the exit code. It's 1 if a debugger is attached, 0 otherwise.

On the parent side, it retrieves the exit code with the macro WEXITSTATUS. In C this is defined as:

#define WEXITSTATUS(x)  (_W_INT(x) >> 8)

Which gives in assembly:

sar     eax, 8
movzx   eax, al
test    eax, eax
jz      short no_debugger

This is another way to do a PTRACE_TRACEME. :)