All Questions
Tagged with anti-debugging linux
7 questions
1
vote
0
answers
86
views
How to develop an anti-debug library which allow users to debug their own programs but not the library?
I'm going to publish a library which guarded by anti-debug ,(ptrace_trackme for Linux and isDebuggerPresent for windows).
The down side of this library is: users would be abled to debug their own ...
- 81
1
vote
1
answer
812
views
Fork and Waitpid calls in a CTF linux binary
I'm doing one of my first linux crackmes.
In the first blocks of code, it goes inside some anti-debug routine and inside one of those it forks and after it calls a waitpid routine. I can verify it ...
- 439
7
votes
3
answers
4k
views
Debugging forked child in an anti-debug protected crackme
I am interested in the anti-debugging method implemented in the crackme called trace-p. A child process is forked, which communicates with the parent using int3 instructions. I would like to debug the ...
- 897
3
votes
1
answer
1k
views
using GDB and dealing with breakpoint detection
I am trying to solve a reverse engineering challenge using using gdb. I can run the program inside it but when I set a breakpoint at main then I get
Program received signal SIGSEGV, Segmentation ...
- 115
2
votes
0
answers
190
views
How can one debug a program that can only be started by other processes?
I am now trying to figure out the innards of a custom made program that I've found difficult to debug using a debugger.
The program starts by using a bash script wrapper to process input parameters, ...
2
votes
2
answers
970
views
Find sigtrap function
I'm reversing a program that uses a lot of BREAK/int 3 (Linux). I guess that the code contains something like:
void sigtrap_func(int sig) { (some stuff..) }
int main()
{
signal(SIGTRAP, ...
- 23
22
votes
3
answers
19k
views
Detecting tracing in Linux
Under Linux it's possible to trace exactly the kernel system calls with strace.
ltrace can be used also to trace library calls.
I wonder if it's possible to detect if my executable is running under ...
- 4,845