I'm reversing an ELF x86 binary which apparently has anti-reversing/anti-debuging protections, and one of the first thing the ELF does is to call a sys_signal with a SIGTRAP value :
.text:08048063 mov eax, 48 ; sys_signal .text:08048068 mov ebx, 5 ; SIGTRAP .text:0804806D mov ecx, offset sub_80480E2 .text:08048072 int 80h ; LINUX - sys_signal .text:08048074 jmp short loc_8048077
I have three questions :
- First, am I right to think that the purpose of this is to create a handler for the SIGTRAP signal, probably in order to prevent any debuger use
- Second, if this is creating a SIGTRAP handler, I should find a
sub_80480E2, according to this x86 syscall table. How can I setup IDA so that it recognizes it as a __sighandler_t struct?
- Third, I could not find any detailed information about this structure. What is its composition?
I found in
signal.h those lines :
/* Type of a signal handler. */ typedef void (*__sighandler_t) (int);
Is __sighandler_t only a ptr to a function?
Thanks ! Feel free to tell me if I'm not beeing clear or if I forgot a usefull information.