1

I have found this question (linux) How to debug a "debugger"? It is an anti debug technique, the parent creates a forked process and ptrace it. Now gdb can not attach top the child process. I would like to know how efficient this technique is: is there a way to bypass this method and to attach a debugger to the child? (for example - if possible - by detaching it first) I met this method reading about Apriorit, but they also use nanomites.

EDIT: There are some advices at (linux) How to debug a "debugger"? but I would like to see some real examples.

EDIT2: If somebody can show how easy or hard is to bypass it that would also show how effective is it.

Improve this question
3
  • "is there a way to bypass this method and to attach a debugger to the child?" - The answer to your question is the answer to the question to which you linked.
    – Jason Geffner
    Commented Nov 13, 2015 at 14:06
  • @peterferrie, if that post contains a detailed answer with example, than yes.
    – robert
    Commented Nov 13, 2015 at 16:21
  • @JasonGeffner, can you show me how?
    – robert
    Commented Dec 8, 2015 at 5:42

0

Reset to default

Browse other questions tagged or ask your own question.