News for hackers. Stuff that matters.

A comment on Implementing and Detecting Anti-Debugging with Fork().

Re:Implementing and Detecting Anti-Debugging with Fork() by visil on Friday September 27, 2024 @09:57AM (#41670547)
The patch code looks like a rather convoluted way of patching out the function code. Can we not just replace conditional branch with a regular one and nop out the rest? Or at least set w8 to 1 manually? I know next to nothing about ARM assembly, so I'm most likely missing something.
[ Parent | on HN ]
Re:Implementing and Detecting Anti-Debugging with Fork() by tonygo on Wednesday October 02, 2024 @03:59AM (#41718260)
Hi :)

I am not really experienced with ARM haha :) So the way that I approached it was: - how could I remove the call of fork (because I don't want to fork) - how could I patch the register that should contains the result of the fork operation

I guess that it sounds like a naive approach haha

Feel free to propose an alternative I patch, I could update the post and credit you :)

[ Parent | on HN ]