[adtac]

The malware will then rely on actual ptrace behaviour as a check. You could instead use seccomp_unotif and let the target ptrace itself as much as it wants: https://man.archlinux.org/man/seccomp_unotify.2.en

[harryfyx]

I don't know reverse engineering. But, I guess the ultimate solution would be running a custom OS to fake ptrace results in the kernel level?

[scandinavian]

You can just use LD_PRELOAD to load your own version of ptrace. Not as stealthy though.

[pizzapim]

Another way is to load a eBPF program or kernel module for this purpose.