Anti-Debug 小试牛刀

最新推荐文章于 2024-06-26 09:45:47 发布

狼_夏天

最新推荐文章于 2024-06-26 09:45:47 发布

阅读量3.3k

点赞数

分类专栏： iOS/objective-c

iOS/objective-c 专栏收录该内容

32 篇文章 0 订阅

订阅专栏

Anti-Debug 小试牛刀

本文整理了日常生活中遇到的一些Anti-Debug技术,除非特殊说明，均适用于Mac/iOS开发
作为第一篇正式博文，会不定期更新，谢谢大家.

禁止附加或调试-ptrace

PT_DENY_ATTACH¹ is an Apple-specific constant that can prevent debuggers (gdb, DTrace, etc.) from debugging your binary in kernel-level.
通过调用ptrace函数，并传入PT_DENY_ATTACH参数，可以实现禁止调试，示例代码如下：

 
  #define PT_DENY_ATTACH  31
#include <stdio.h>

int main()
{
  ptrace(PT_DENY_ATTACH, 0, 0, 0);
  printf("Hello\n");
  return 0;
}
 
 

程序正常运行，会输出hello
但是程序加载到gdb中，就不能正常运行，输出如下：

GNU gdb (GDB) 7.6
Copyright (C) 2013 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.  Type "show copying"
and "show warranty" for details.
This GDB was configured as "x86_64-apple-darwin13.0.0".
For bug reporting instructions, please see:
<http://www.gnu.org/software/gdb/bugs/>.
(gdb) file ./anti-debug-1.o
Reading symbols from /Users/ioshack/Desktop/anti-debug-1.o...(no debugging symbols found)...done.
(gdb) r
Starting program: /Users/ioshack/Desktop/anti-debug-1.o 
[Inferior 1 (process 7639) exited with code 055]
(gdb) q

看，程序直接退出了。

中断检测-int3

通过在程序中设置信号处理函数，并主动触发中断，也可以检测是否被调试，先来看代码：

 
  #include <stdio.h>
#include <signal.h>

void handler(int signo)
{
    printf("You can do something here!\n");
}

int main(int argc, const char * argv[])
{
    signal(SIGTRAP,handler);
    __asm__("int3");
    printf("Always say: Hello\n");
    return 0;
}
 
 

通过主动执行__asm__("int3"),我们触发了一个SIGTRAP的中断信号，然后我们又安插了一个信号处理函数，来捕获这个中断。
正常运行的结果输出如下：

ioshackdeMacBook-Pro:Desktop ioshack$ ./anti-debug-2.o
You can do something here!
Always say: Hello

而如果在调试状态中，我们触发的中断信号会被调试器捕获，是不会执行我们的异常处理函数的。

GNU gdb (GDB) 7.6
Copyright (C) 2013 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.  Type "show copying"
and "show warranty" for details.
This GDB was configured as "x86_64-apple-darwin13.0.0".
For bug reporting instructions, please see:
<http://www.gnu.org/software/gdb/bugs/>.
(gdb) file ./anti-debug-2.o
Reading symbols from /Users/ioshack/Desktop/anti-debug-2.o...(no debugging symbols found)...done.
(gdb) r
Starting program: /Users/ioshack/Desktop/anti-debug-2.o 

Program received signal SIGTRAP, Trace/breakpoint trap.
0x0000000100000f24 in main ()
(gdb) c
Continuing.
Always say: Hello
[Inferior 1 (process 7686) exited normally]

这样，我们可以在信号处理函数中干一些事情，嘻嘻。

检测lldb

再来介绍一种专门针对lldb调试器的检测手段，代码如下：

 
  #include <stdio.h>
#include <unistd.h>
#include <termios.h>
#include <sys/ioctl.h>

int main() {
  struct winsize win;
  puts ((isatty (1) && !ioctl (1, TIOCGWINSZ, &win) && !win.ws_col)?
          "You are being traced by lldb": "Everything is fine");
  return 0;
}
 
 

程序正常运行，输出：

ioshackdeMacBook-Pro:Desktop ioshack$ ./anti-debug-lldb.o 
Everything is fine

程序加载到lldb中，输出如下：

ioshackdeMacBook-Pro:Desktop ioshack$ lldb anti-debug-lldb.o
Current executable set to 'anti-debug-lldb.o' (x86_64).
(lldb) r
Process 7701 launched: '/Users/ioshack/Desktop/anti-debug-lldb.o' (x86_64)
You are being traced by lldb
Process 7701 exited with status = 0 (0x00000000)

注意，这种方法对gdb不管用。

所有的检测手段在你拿到解密的二进制文件之后都是可以破解的，这是一个矛与盾的双面。
没有最好，只有更好。
检测的方式有很多，遇到了再慢慢补充，希望本博文对你有所帮助，再次感谢你的耐心阅读。
大牛们手下留情，多给点鼓励啊~~