Tracing and Coverage - measures and countermeasures

#include <stdio.h>

#include <sys/ptrace.h>

int main() {

    if (ptrace(PTRACE_TRACEME, 0, 1, 0) == -1) {

        printf("Debugger\n");

    } else {

        printf("Normal\n");

    }

    return 0;

}

$ qira ./superSimplePtrace

Debugger

$ qira --pin ./superSimplePtrace

Normal

$ bin64/drrun -t drcov -- ./superSimplePtrace

#include <stdio.h>

#include <sys/ptrace.h>

int main() 

{

    if (ptrace(PTRACE_TRACEME, 0, 1, 0) == -1) // first call

        {

        printf("Debugger (first check)\n");

        } 

    else 

        {

        if (ptrace(PTRACE_TRACEME, 0, 1, 0) == -1) // second call

            {

            printf("Normal\n");

            } 

        else 

            {

            printf("Debugger (second check)\n");

            }

        }

return 0;

}

$ qira ./lessSimplePtrace

Debugger (first check)

$ qira --pin ./lessSimplePtrace 

Normal

$ bin64/drrun -t drcov -- ./lessSimplePtrace

Normal

#include <unistd.h>

#include <sys/ptrace.h>

#include <sys/wait.h>

#include <stdio.h>

int main()

{

 pid_t child;

 int status;

 switch((child = fork()))

 {

 case 0:

  ptrace(PTRACE_TRACEME);

 // this is the actual 'useful' program code should run for a while - simulate with delay

 usleep(1000000);

 printf("no debugger detected!");

 return 2;

 case -1:

        perror("fork");

        return 1;

 default:

        if (ptrace(PTRACE_ATTACH, child))

 {

  kill(child, SIGKILL);

  printf("ptrace_attach failed - debugger?");

  return 3;

 }

 while (waitpid(child, &status,0) != -1)

  ptrace(PTRACE_CONT,child,0,0);

 return 0;

 }

  return 0;

}

$ qira ./selfdebug

ptrace_attach failed - debugger?

$ qira --pin ./selfdebug

no debugger detected!

$ bin64/drrun -t drcov -- ./selfdebug

no debugger detected!

$ qira ./ch28.bin 

So you want to trace me?!

Wrong! try hard! :)

$ qira --pin ./ch28.bin 

Please input the flag:

Hummmmmmm NO WAY.

$ bin64/drrun -t drcov -- ./ch28.bin  

Please input the flag:

Hummmmmmm NO WAY.

$ sudo python frida-drcov.py ch28.bin

[*] Attaching to pid '6171' on device 'local'...

[+] Attached. Loading script...

[+] Got module info.

Starting to stalk threads...

Stalking thread 6171.

Done stalking threads.

[*] Now collecting info, control-D to terminate....

$ ./ch28.bin 

Please input the flag:

Hummmmmmm NO WAY.

$ ./ch28.bin 

Please input the flag:

POOOOOOOOOOOOOOOOOOOOOOOOO God damn!! You won!