On May 2, 2012, at 12:04 AM, Don Quixote de la Mancha wrote: > On Tue, May 1, 2012 at 6:28 PM, Kyle Sluder <k...@ksluder.com> wrote: > >>> I was just wondering if this is still true or true in general...that it is >>> not possible to conceal an application from DTrace. > >> On May 1, 2012, at 6:04 PM, Eric Gorr <mail...@ericgorr.net> wrote: >> It is true and will be true as long as your are able to compile your own >> kernel. Think about it. > > Even if you couldn't compiler your own kernel there are all kinds of > ways to defeat this: > [... snip ...]
My recollection is that it was even easier to defeat. You just start the target program with the debugger, as opposed to attaching to it already running, break on ptrace() where it attempts to deny attaching, and simply short-circuit the call. Regards, Ken _______________________________________________ Cocoa-dev mailing list (Cocoa-dev@lists.apple.com) Please do not post admin requests or moderator comments to the list. Contact the moderators at cocoa-dev-admins(at)lists.apple.com Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/cocoa-dev/archive%40mail-archive.com This email sent to arch...@mail-archive.com
