Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Production code that checks if a debugger is attached should be illegal.

Ideally there would be a way to get the debugger to lie to the process that a debugger is indeed not attached. Sure, maybe there's a reason today why you actually need to know a debugger isn't attached but at least give future-developers an escape hatch if they need it.



On Linux, you can "lie" to the process by running it with the LD_PRELOAD environment variable set to a library that hijacks ptrace(PTRACE_TRACEME, ...) to return 0. If the process is smart enough to check for LD_PRELOAD as well, you might be able to use something like seccomp to hijack the return value at the OS level.


You don't need LD_PRELOAD; the ptrace mechanism by itself can intercept system calls and modify them on the fly.


It's mostly an attempt at stopping someone attaching a debugger to an application you've shipped




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: