Implementing and Detecting Anti-Debugging with Fork()

Re:Implementing and Detecting Anti-Debugging with Fork() by a_t48 on Thursday September 26, 2024 @11:16PM (#41665923)

Does follow-fork-mode in lldb not also defeat this?

[ Parent | on HN ]

Re:Implementing and Detecting Anti-Debugging with Fork() by cryptonector on Friday September 27, 2024 @12:13AM (#41666178)

Yes.

[ Parent | on HN ]

Re:Implementing and Detecting Anti-Debugging with Fork() by tonygo on Friday September 27, 2024 @03:58AM (#41667530)

I tried with LLDB using `settings set target.process.follow-fork-mode child` but for some reasons I feel like it still exit from the parent process.

I also tried with a long living process: https://github.com/tony-go/antidebug-examples/tree/main/swif...

And I got this:

``` (lldb) run Process 14345 launched: '/anti-debug/swift/build/anti_debug' (arm64) start pid = 14345 exit parent process for child pid = 14348 continue as child process pid = 14348 Process 14345 exited with status = 0 (0x00000000) ```

The UI did not even appeared as it should.

Maybe I miss something in my LLDB config...

[ Parent | on HN ]

Re:Implementing and Detecting Anti-Debugging with Fork() by tonygo on Friday September 27, 2024 @04:02AM (#41667542)

Also it could come from a messy thing in the code.

[ Parent | on HN ]

Re:Implementing and Detecting Anti-Debugging with Fork() by cassepipe on Friday September 27, 2024 @08:01AM (#41669366)

The main reason for using dlsym instead of calling fork directly is to make it harder for an ‘attacker’ to detect or set breakpoints on the fork function, thus obfuscating the anti-debugging mechanism. You have to more checks before being able to understand why you cannot attach the debuger.

You may still think that mode could be still able to catch a new child process but apparently people have tried and the answer is no

[ Parent | on HN ]

Re:Implementing and Detecting Anti-Debugging with Fork() by a_t48 on Sunday September 29, 2024 @06:10AM (#41686273)

Ah, I never considered how follow forks mode might actually work/

[ Parent | on HN ]

Re:Implementing and Detecting Anti-Debugging with Fork() by tonygo on Friday October 04, 2024 @03:52AM (#41738894)

I tried, but I was not able to determine so far...

[ Parent | on HN ]

Re:Implementing and Detecting Anti-Debugging with Fork() by tonygo on Monday October 14, 2024 @04:43AM (#41835525)

I try to transform my C program into a long living one (just adding a sleep).

https://github.com/tony-go/antidebug-examples/pull/1

At first, it appears that the follow fork mode works nicely. But at some point it did not ... If I run it 10 times consequtively in LLDB. Sometimes it works, sometimes not ...

[ Parent | on HN ]

Re:Implementing and Detecting Anti-Debugging with Fork() by tonygo on Wednesday October 02, 2024 @03:55AM (#41718241)

> You may still think that mode could be still able to catch a new child process but apparently people have tried and the answer is no

Not sure I got this. IIUC there is a link between the fact that we used dlsym and the fact the child process is not catched by lldb in the follow fork mode?

[ Parent | on HN ]