GDB use ptrace system call to attach to running program , this little trick below can
terminate the process as soon as it detects the program is ran using GDB.
Since Debugger can only one PTRACE another instance will fail.
#include
#include
void anti_debug(void)
{
if(ptrace(PTRACE_TRACEME,0,0,0))
{
printf("Attached to debugger with terminate\n");
kill(getpid());
exit(0);
}
}
main()
{
anti_debug();
printf("Anti GDB Code\n");
}
root@embsys-VirtualBox:~/github/intx/usrc/antigdb# ./a.out
Anti GDB Code
root@embsys-VirtualBox:~/github/intx/usrc/antigdb# gdb a.out
..
Reading symbols from a.out...(no debugging symbols found)...done.
(gdb) r
Starting program: /home/embsys/github/intx/usrc/antigdb/a.out
Attached to debugger with terminate-----------------------------------> Exit from the Program
[Inferior 1 (process 12902) exited normally]
Good Read:
https://majantali.net/2016/10/how-breakpoints-are-set/