Linux Process Evasion: ptrace & prctl

Short summary

Demonstrates Linux process self-defense mechanisms using ptrace and prctl system calls. Shows how to block external debuggers (gdb, strace) via ptrace self-attach, leveraging the kernel's single-tracer rule, and prevent memory dumps via core dump disabling with prctl. Includes practical x64 assembly implementations with syscall obfuscation techniques for bypassing static analysis tools.

• •ptrace self-attach blocks external debuggers by leveraging kernel enforcement of single-tracer rule
• •prctl PR_SET_DUMPABLE=0 prevents core dumps and restricts forensic analysis of process memory
• •Syscall obfuscation (calculating numbers at runtime) evades static signature scanners like YARA

Generated with AI, which can make mistakes.