ptrace internals How it prevents debugger attachment

[carlospolop]

Blog URL

https://blog.reversesociety.co/blog/2024/anti-debugging-using-ptrace

Blog Title

ptrace internals: How it prevents debugger attachment

Blog high summary

ptrace(PT_DENY_ATTACH) is a macOS anti-debugging control. LLDB uses PT_ATTACHEXC, causing XNU to set P_LTRACED; the target then exits with ENOTSUP/45. If the target sets P_LNOATTACH first, a later attach sends SIGSEGV to the attaching parent and LLDB loses its connection. Hopper bypasses the control by changing ARM64 movz w0, #0x1f to movz w0, #0x0 (PT_TRACE_ME).

PR changes

• src/macos-hardening/macos-security-and-privilege-escalation/macos-apps-inspecting-debugging-and-fuzzing/README.md: Added or revised coverage of XNU state and call ordering; ARM64 static identification and bypass.

Errors

mdbook build unavailable

[carlospolop]

merge

[carlospolop]

Conflict repair: resolved
Head: a94c5a4cefefd58a2d393a7b10e36752215de8cf

Resolved the macOS anti-debugging documentation conflict.

• Restored the PR’s missing ARM64 identification text verbatim while retaining the default branch’s _sysctl detail.
• Verified that examples from both conflict sides remain present and the edited file has no conflict markers or whitespace errors.