Hacker News Reader

The malware will then rely on actual ptrace behaviour as a check. You could instead use seccomp_unotif and let the target ptrace itself as much as it wants: https://man.archlinux.org/man/seccomp_unotify.2.en

I don't know reverse engineering. But, I guess the ultimate solution would be running a custom OS to fake ptrace results in the kernel level?

You can just use LD_PRELOAD to load your own version of ptrace. Not as stealthy though.

Another way is to load a eBPF program or kernel module for this purpose.

> Thankfully this is easy to circumvent: have your debugger catch the ptrace syscall and lie about the result.

Yeah, Apple iTunes did that IIRC, and it was super easy to bypass.

On Apple platforms ptrace supports an additional flag "PT_DENY_ATTACH", which is what iTunes uses. It causes the target process to exit.

Yeah, that's it. Also DVD Player, for example. Pretty trivial to work around.

> have your debugger catch the ptrace syscall

Cat + mouse: Have your program catch any signals/stops (which debuggers do on Linux when they attach I believe)