I am trying to run ltrace on this file:

./launcher: ELF 32-bit LSB shared object, Intel 80386, version 1 (SYSV), dynamically linked, interpreter /lib/ld-linux.so.2, for GNU/Linux 2.6.32, BuildID[sha1]=f6f8cf3307e0ee26723f4d03ec68f022d15e56b6, stripped

When I pop it open in ghidra, and view the decompiled c, I can see that it changes the program flow to somewhere I don't want to be when ltrace is running.

  attached_to_ptrace = ptrace(PTRACE_TRACEME,0,1,0);
  if (attached_to_ptrace == -1) {
    puts("I am not your property!");
    exit_code = 1;
  else {
    // execute main loop

Looking at the man page for ptrace, I see:

long ptrace(enum __ptrace_request request, pid_t pid,
                   void *addr, void *data);

Meaning that if the program? or ltrace? were to run with a different PID, I would be able to successfully run my program using ltrace.

This is the current output I get when running the program with ltrace:

~/ctf/cyberstart/level13/04 [master|…1] $ ltrace ./launcher
__libc_start_main(0x565a86f0, 1, 0xff837be4, 0x565a8970 <unfinished ...>
ptrace(0, 0, 1, 0)                                                     = 0xffffffff
puts("I am not your property!"I am not your property!
)                                        = 24
+++ exited (status 1) +++

Without ltrace:

~/ctf/cyberstart/level13/04 [master|…1] $ ./launcher

Enter the password:
Away now, you anklebiter!

[1]+  Stopped                 ./launcher

(This is my second buffer overflow CTF challenge, where the main goal is to mess with this block of code:)

  int iVar1;
  char local_1e [10];
  int local_14;
  int local_10;
  local_10 = 0;
  puts("\nEnter the password: ");
  iVar1 = strcmp(local_1e,"PAssw0rd");
  if (iVar1 == 0) {
    puts("Well done! Unfortunately, you have to try harder.");
    local_10 = 0;
  else {
    puts("Away now, you anklebiter!");
  if (local_10 != 0) {
    printf("Unexpected error condition. Control char is %d\n",local_10);
    local_14 = param_2 * local_10;
    (*(code *)(local_14 + param_1))();

How can I run ltrace in a way such that it isn't detected?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.