Friday, February 16, 2018

Anti GDB ( debugger ) Program


Anti GDB ( debugger ) Program 

GDB use ptrace system call to attach to running program , this little trick below can
terminate the process as soon as it detects the program is ran using GDB.
Since Debugger can only one PTRACE another instance will fail.
#include
#include
void anti_debug(void)
{
        if(ptrace(PTRACE_TRACEME,0,0,0))
        {
                printf("Attached to debugger with terminate\n");
                kill(getpid());
                exit(0);
        }
}
main()
{
anti_debug();
printf("Anti GDB Code\n");
}


root@embsys-VirtualBox:~/github/intx/usrc/antigdb# ./a.out
Anti GDB Code

root@embsys-VirtualBox:~/github/intx/usrc/antigdb# gdb a.out
..
Reading symbols from a.out...(no debugging symbols found)...done.
(gdb) r
Starting program: /home/embsys/github/intx/usrc/antigdb/a.out
Attached to debugger with terminate-----------------------------------> Exit from the Program
[Inferior 1 (process 12902) exited normally]

Good Read:
https://majantali.net/2016/10/how-breakpoints-are-set/

No comments:

Post a Comment

Featured Post

XDP - Getting Started with XDP (Linux)