Has anyone tried ptrace_attaching android unity apps for anti debugging?

Question

I am trying to ptrace_attach the main process and its threads (/proc/<pid>/task) of an android unity app to avoid malicious users debugging the app(which is a game).

I developed a ndk library that forks from main process and ptrace_attach the parent process(being the main process) inside the JNI_OnLoad() function. After that periodically checks the /proc/<pid>/task folder to attach newly created threads.

The problem is, this works well in normal apps but when I try to run this inside an app made with unity, the main process stops and screen becomes black or white not responding. But if you delay attaching a few seconds just enough to see the animation working on the screen, attaching works fine.

Code is roughly something like this:

if(!fork())
{
     parentPid = getppid();

     // attach parent process
     if(ptrace(PTRACE_ATTACH,parentPid,0,0)<0)
          exit(-1);
     ptrace(PTRACE_SETOPTIONS, parentPid, 0, PTRACE_O_TRACEEXEC| PTRACE_O_TRACEVFORKDONE|PTRACE_O_TRACESYSGOOD |PTRACE_O_TRACEFORK |PTRACE_O_TRACEVFORK |PTRACE_O_TRACECLONE );

     while(true)
     {
          // get signal from processes
          stoppedPid = waitpid(-1,&stat_loc, 0);

          ...

          // check if stoppedPid need to be attached
          // if so, attach
          ptrace(PTRACE_ATTACH,stoppedPid,0,0);

          ...

          // else, just continue the stopped process
          ptrace(PTRACE_CONT,stoppedPid,0,0);
     }
 }

Maybe I should adjust the ptrace_setoptions ?

Thanks in advance :)

Answer 1

Well somethings I found out -

When I ptrace_attach the main process of the target app and wait for signals, I get SIGSEGV signal while app loads and just hangs there(because forked process cannot handle SIGSEGV). In the java code, it seems SIGSEGV occurs while calling View related functions.

I guess UnityPlayer or Android app loader handles SIGSEGV smoothly while app loading time. Therefore, if you get a SIGSEGV, simply detaching it and attaching again does not hang the app.