This question already has an answer here:
- (linux) How to debug a “debugger”? 2 answers
I have found this question (linux) How to debug a "debugger"? It is an anti debug technique, the parent creates a forked process and ptrace it. Now gdb can not attach top the child process. I would like to know how efficient this technique is: is there a way to bypass this method and to attach a debugger to the child? (for example - if possible - by detaching it first) I met this method reading about Apriorit, but they also use nanomites.
EDIT: There are some advices at (linux) How to debug a "debugger"? but I would like to see some real examples.
EDIT2: If somebody can show how easy or hard is to bypass it that would also show how effective is it.