On 18 March 2010 18:03, Kyle Sluder <kyle.slu...@gmail.com> wrote: > On Thu, Mar 18, 2010 at 4:48 AM, Peter Hudson <peter.hud...@mac.com> wrote: >> Does this code report on my app being debugged by any third party, even when >> the app has been stripped of symbols ? > > It does precisely what it claims to do: asks the kernel if the > P_TRACED flag is set on your process, which means a debugger has used > the kernel to attach to your process. > >> Would it work irrespective of the debugging tool used ? > > If you think this is going to help you avoid piracy, it's not. OS X > has a flag (PT_DENY_ATTACH) that the kernel checks for when a debugger > asks to attach to a process. If that flag is set, the kernel refuses > to allow the debugger to attach. iTunes famously does this to prevent > people from inspecting the operations of the DRM system. It's a > trivial matter to patch the kernel to not respect this flag, and it > would be equally trivial to patch the kernel to not inform you of a > debugger's presence even if you asked.
Can't you just set a breakpoint on ptrace() that just automatically returns 0, or has that stopped working? I used to use that trick to debug my iTunes visualizer, no kernel hacking needed. _______________________________________________ Cocoa-dev mailing list (Cocoa-dev@lists.apple.com) Please do not post admin requests or moderator comments to the list. Contact the moderators at cocoa-dev-admins(at)lists.apple.com Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/cocoa-dev/archive%40mail-archive.com This email sent to arch...@mail-archive.com
