25 April 2011

Simple antidebugging methods (part 2)

This is a really old techine, but still works:

#include <signal.h>
#include <stdio.h>
#include <stdlib.h>

void handler(int theSignal)
        printf("No debugger found\n");

int main()
        signal(SIGTRAP, handler);
        printf("Debugger found\n");

When run normally:

riker3:tmp sharek$ ./test 
No debugger found
riker3:tmp sharek$

And with a debugger:

riker3:tmp sharek$ gdb ./test
(gdb) r
Program received signal SIGTRAP, Trace/breakpoint trap.
0x0000000100000eaf in main ()
(gdb) c
Debugger found

Program exited with code 01.
(gdb) q
riker3:tmp sharek$


Posted at BinaryCell


  1. Good post :)
    I'll go to try it so soon as I can, ty!

  2. This is very useful for debugging too.

    Sometimes it is hard (or simply cumbersome) to set a breakpoint in the debugger (because the problematic line of code is run a lot or because the condition itself is slow to be checked by the debugger).

    You just add an «if (condition-when-things-go-awry) __asm__ __volatile__("int3;")» where you want the debugger to stop, run the program inside the debugger. When the int3 instruction is executed the debugger will stop but will allow you to continue, as if nothing happened! :D

    Of course this is only for x86 and x86-64. No way for ARM.


Disclaimer: In no event shall the blog owner, be liable for any damages, including without limitation, special, indirect or consequential damages, or any damages, whatsoever resulting from access or use, or inability to access or use this Website or arising out of any materials, information, qualifications or recommendations on this Website.