Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add ptrace anti-debug method in release mode in Android #2627

Closed
Closed
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Add ptrace anti-debug method in release mode in Android
  • Loading branch information
DoranekoSystems committed Jun 7, 2024
commit 212e6cc21d239f90c5ffb1f44296c21fa7529bef
Original file line number Diff line number Diff line change
Expand Up @@ -466,12 +466,15 @@ Let's look at a simple improvement for the method above. After the initial `fork
- In release mode: The call to ptrace fails and the child crashes immediately with a segmentation fault (exit code 11).
- In debug mode: The call to ptrace works and the child should run indefinitely. Consequently, a call to `waitpid(child_pid)` should never return. If it does, something is fishy and we would kill the whole process group.

To handle errors in release mode, by calling `prctl(PR_SET_DUMPABLE, 1, 0, 0, 0)` before forking, it is possible to implement anti-debugging regardless of the value of `android:debuggable`.

The following is the complete code for implementing this improvement with a JNI function:

```c
#include <jni.h>
#include <unistd.h>
#include <sys/ptrace.h>
#include <sys/prctl.h>
#include <sys/wait.h>
#include <pthread.h>

Expand All @@ -491,6 +494,9 @@ void *monitor_pid() {

void anti_debug() {

/* Set PR_SET_DUMPABLE to 1 to allow tracing. */
prctl(PR_SET_DUMPABLE, 1, 0, 0, 0);

child_pid = fork();

if (child_pid == 0)
Expand Down
Loading