Search code examples
macosdtrace

Is it possible to conceal a OS X app from DTrace?

I am developing an OS X application that I would like to conceal from inspection by DTrace. I'm aware of the P_LNOATTACH flag, but everything I've read tells me that there are ways around it. Is it possible?

Solution

  • Yes, it's possible. Try running DTrace against iTunes; it doesn't work.

    You have to call the ptrace function with PT_DENY_ATTACH.

    http://developer.apple.com/library/mac/#documentation/Darwin/Reference/ManPages/man2/ptrace.2.html

    However, there are ways around it with various kext's. Google around and you'll find some of them.

    for 10.6 & 10.7: https://github.com/dwalters/pt_deny_attach

    Hmm, Looks like it's broken with 10.8 due to ASLR: Detecting, and Shirking Off, the Debugger