A static-library proxy based on ptrace (X86-only)
- Run without the proxy:
task run:no-proxy- Run with the proxy:
task run:proxyUsing /proc/[PID]/maps and
libelf, it's possible to calculate a symbol's address in
memory (Note: this should even work with ASLR). Once a symbol's address is known,
ptrace can be used to insert debugging
trap/breakpoint instruction inside of the target function. Then, whenever the target function is
called, the process emits a SIGTRAP which is easily detected by the parent. See
Eli Bendersky's website
for more information.