Re: How to protect a file from debugging

Oliver Welter
2007-06-11T09:25:16Z

[-- Attachment #1: Type: text/plain, Size: 1132 bytes --]

Hi Tavis

> The short answer is no, any tricks you attempt to use to prevent
> ptrace() can be defeated (some more easily than others), however if you
> explain what the "troubles" are there may be a better solution.
>
damn ;)

Ok here is what I am planing:

I have an application, lets say a simple text editor, that is used to
read/write sensitive information.
Now I start gdb, attach it to the process and call "gcore" which - for
my understanding - dumps the entire memory of the process to a file. So
the core dump reveals my secret data.

What I want to do is, to either prevent gdb from attaching and capturing
the memory or at least find a way to recognize when a program attaches
another. I am a noob regarding the internal system structure, so I dont
know exactly what gdb does to attach to a program, but I guess there is
a syscall or similar that is used to pass the memory location to gdb and
if I block/supervise that, I might find a way around....