↓ Skip to main content

Anti-debugging

The binary calls ptrace so you cannot attach to it. Break on the call, rewrite the register, carry on.

2013

patrik.re

iTunes anti-debugging bypass with GDB and LLDB

Defeating iTunes' ptrace-based anti-debugging on OS X by breaking on ptrace and rewriting the rdi register, and porting the bypass from Apple's GDB to LLDB to get a Python-capable debugger.