Profiling anti-debugging checks in linux

Question

My main requirement is to profile the mentioned anti-debugging check program twice ( Once in the presence of a debugger and the other without it ) to collect some information for analysis during run-time (Assuming only the binary is available)

#include <stdio.h>
#include <sys/ptrace.h>

int i_am_debugged()
{
    if (ptrace(PTRACE_TRACEME, 0, 1, 0) < 0) 
     {  
            printf("Avoid debugging please");
        return 1;
     }

    return 0;
}

int main()
{
    if(i_am_debugged())
    {
        return 1;
    }

  printf("It's going well ! No debugging !\n");

return 0;

}

Currently , I wrote a Intel PIN tool for the same but I am unable to profile a run when a debugger is not attached because of the way PIN works and always executes 'It's going well ! No debugging !'.

So, my question:

Is there anything I can do (attach a debugger and run the pin tool or something) to profile both types of runs using my PIN tool or will any other type of profiling (for ex Binary translation, etc) help me in this case?

I want to collect specific information about instructions and not just Call graph,etc and hence would like some functionality similar to PIN's C++ programmer interface.

A detailed answer would be great, Thanks.

Answer 1

Pin uses ptrace to inject itself into the application. This means that using gdb won't be possible when attempting to launch an application with Pin, and also that Pin won't successfully attach to an application that is being debugged.

My suggestion is to start Pin with the -pause_tool knob, and then attach gdb to the process. This will make the application's ptrace call return what you want.