The current implementation of AntiDebugging is simply inject Inline Assemblies at function start and only works on iOS.
Since it’s now possible to do sysent hook on (certain versions of) iOS. Inline ptrace()
alone is no longer safe.
Here is a few more ideas to be implemented.
Code Stolen From Places
1 | BOOL isDebuggerPresent(){ |
1 | dispatch_source_t source = dispatch_source_create(DISPATCH_SOURCE_TYPE_SIGNAL, SIGSTOP, 0, dispatch_get_main_queue()); |
1 | struct macosx_exception_info{ |
1 | if (isatty(1)) { |
1 | if (!ioctl(1, TIOCGWINSZ)) { |
Ideas from @jmpews
Register Custom EH Pad and intentionally throw exceptions,they should be handled by our very own block.