1

This question already has an answer here:

I have found this question (linux) How to debug a "debugger"? It is an anti debug technique, the parent creates a forked process and ptrace it. Now gdb can not attach top the child process. I would like to know how efficient this technique is: is there a way to bypass this method and to attach a debugger to the child? (for example - if possible - by detaching it first) I met this method reading about Apriorit, but they also use nanomites.

EDIT: There are some advices at (linux) How to debug a "debugger"? but I would like to see some real examples.

EDIT2: If somebody can show how easy or hard is to bypass it that would also show how effective is it.

marked as duplicate by Jason Geffner, peter ferrie, jvoisin, Dominik Antal, ixje Nov 18 '15 at 5:54

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

  • "is there a way to bypass this method and to attach a debugger to the child?" - The answer to your question is the answer to the question to which you linked. – Jason Geffner Nov 13 '15 at 14:06
  • @peterferrie, if that post contains a detailed answer with example, than yes. – robert Nov 13 '15 at 16:21
  • @JasonGeffner, can you show me how? – robert Dec 8 '15 at 5:42

Browse other questions tagged or ask your own question.