Hacker News new | ask | show | jobs
by lapcat 1024 days ago
> Thankfully this is easy to circumvent: have your debugger catch the ptrace syscall and lie about the result.

Yeah, Apple iTunes did that IIRC, and it was super easy to bypass.
1 comments
sjtgraham 1024 days ago
On Apple platforms ptrace supports an additional flag "PT_DENY_ATTACH", which is what iTunes uses. It causes the target process to exit.
link
lapcat 1024 days ago
Yeah, that's it. Also DVD Player, for example. Pretty trivial to work around.
link