News for hackers. Stuff that matters.

A comment on The Ptrace Anti-Re Trick. Parent comment

Re:The Ptrace Anti-Re Trick by harryfyx on Sunday August 27, 2023 @09:49PM (#37288718)
I don't know reverse engineering. But, I guess the ultimate solution would be running a custom OS to fake ptrace results in the kernel level?
[ Parent | on HN ]
Re:The Ptrace Anti-Re Trick by scandinavian on Monday August 28, 2023 @03:30AM (#37290956)
You can just use LD_PRELOAD to load your own version of ptrace. Not as stealthy though.
[ Parent | on HN ]
Re:The Ptrace Anti-Re Trick by pizzapim on Monday August 28, 2023 @03:44AM (#37291036)
Another way is to load a eBPF program or kernel module for this purpose.
[ Parent | on HN ]