News for hackers. Stuff that matters.

A comment on The Ptrace Anti-Re Trick. Parent comment

Re:The Ptrace Anti-Re Trick by lapcat on Sunday August 27, 2023 @07:37PM (#37287746)
> Thankfully this is easy to circumvent: have your debugger catch the ptrace syscall and lie about the result.

Yeah, Apple iTunes did that IIRC, and it was super easy to bypass.

[ Parent | on HN ]
Re:The Ptrace Anti-Re Trick by sjtgraham on Sunday August 27, 2023 @11:15PM (#37289305)
On Apple platforms ptrace supports an additional flag "PT_DENY_ATTACH", which is what iTunes uses. It causes the target process to exit.
[ Parent | on HN ]
Re:The Ptrace Anti-Re Trick by lapcat on Sunday August 27, 2023 @11:30PM (#37289382)
Yeah, that's it. Also DVD Player, for example. Pretty trivial to work around.
[ Parent | on HN ]