Bugging Debuggers - Revision history

IAdam1n: Piracy note.

2013-11-10T19:15:02Z

Piracy note.

2012-03-21T16:16:37Z

2011-06-23T13:46:25Z

Yay, just learned to avoid using "here" in links. Thanks!

2011-06-21T16:13:17Z

please rephrase that, here is what makes google hate us

2011-06-21T13:27:20Z

Added an intro, since not everyone understands what the problem is. It's generally good to always state the problem before providing the solution.

2010-11-27T19:32:54Z

doesn't exist anymore

2009-11-08T06:44:10Z

Worked around.

2009-05-24T14:00:49Z

2009-05-24T14:00:28Z

2009-05-24T05:10:13Z

@@ Line 1: / Line 1: @@
 Background:
-On jailbroken iOS devices crackers have made it possible to remove the DRM from sold applications so that they can be copied to any device without having to pay for them.
+On jailbroken iOS devices crackers have made it possible to remove the DRM from sold applications so that they can be copied to any device without having to pay for them. NOTE that this is illegal as it is piracy.
 As explained in [[Copy Protection Overview]], apps protected by DRM are encrypted, making it usually impossible to transfer and run them on other devices.

@@ Line 5: / Line 5: @@
 As explained in [[Copy Protection Overview]], apps protected by DRM are encrypted, making it usually impossible to transfer and run them on other devices.
-On of the methods used by crackers is to let the application run in a debugger (gdb) and then save the then unencrypted app image to disk.
+One of the methods used by crackers is to let the application run in a debugger (gdb) and then save the then unencrypted app image to disk.
 This page explains how to foil this method.

@@ Line 3: / Line 3: @@
 On jailbroken iOS devices crackers have made it possible to remove the DRM from sold applications so that they can be copied to any device without having to pay for them.
-As explained [[Copy Protection Overview|here]], apps protected by DRM are encrypted, making it usually impossible to transfer and run them on other devices.
+As explained in [[Copy Protection Overview]], apps protected by DRM are encrypted, making it usually impossible to transfer and run them on other devices.
 On of the methods used by crackers is to let the application run in a debugger (gdb) and then save the then unencrypted app image to disk.

@@ Line 3: / Line 3: @@
 On jailbroken iOS devices crackers have made it possible to remove the DRM from sold applications so that they can be copied to any device without having to pay for them.
-As explained [Copy_Protection_Overview|here], apps protected by DRM are encrypted, making it usually impossible to transfer and run them on other devices.
+As explained [[Copy Protection Overview|here]], apps protected by DRM are encrypted, making it usually impossible to transfer and run them on other devices.
 On of the methods used by crackers is to let the application run in a debugger (gdb) and then save the then unencrypted app image to disk.

← Older revision		Revision as of 13:27, 21 June 2011
Line 1:		Line 1:
		+	Background:
−	'''IMPORTANT NOTE: This trick has been worked around by pirates. Don't rely on it!'''
		+
		+	On jailbroken iOS devices crackers have made it possible to remove the DRM from sold applications so that they can be copied to any device without having to pay for them.
		+
		+	As explained [Copy_Protection_Overview\|here], apps protected by DRM are encrypted, making it usually impossible to transfer and run them on other devices.
		+
		+	On of the methods used by crackers is to let the application run in a debugger (gdb) and then save the then unencrypted app image to disk.
		+
		+	This page explains how to foil this method.

	== The ptrace() Trick ==		== The ptrace() Trick ==
		+
		+	'''IMPORTANT NOTE: This trick has been worked around by pirates. Don't rely on it!'''

	GDB is the stock debugger used by most hackers. On darwin (OSX and iPhone OS), GDB will not attach to processes that have asked not to be attached to. Instead, it will crash or crash the target process. This is useful for defeating Crackulous and most tutorial-followers.		GDB is the stock debugger used by most hackers. On darwin (OSX and iPhone OS), GDB will not attach to processes that have asked not to be attached to. Instead, it will crash or crash the target process. This is useful for defeating Crackulous and most tutorial-followers.

← Older revision		Revision as of 19:32, 27 November 2010
Line 34:		Line 34:
	* disable_gdb() should return for debug builds (hint: preprocessor macros)		* disable_gdb() should return for debug builds (hint: preprocessor macros)
	* the string "ptrace" is a dead giveaway, and should probably be obfuscated a bit		* the string "ptrace" is a dead giveaway, and should probably be obfuscated a bit
−
−	Apple approved [http://github.com/costan/zergsupport/blob/master/ZergSupport/CryptoSupport/ZNDebugIntegrity.m this implementation], when it was submitted with [http://istockplay.com StockPlay] version 0.5.

← Older revision		Revision as of 06:44, 8 November 2009
Line 1:		Line 1:
		+	'''IMPORTANT NOTE: This trick has been worked around by pirates. Don't rely on it!'''
−	== The ptrace Trick ==
		+
		+	== The ptrace() Trick ==

	GDB is the stock debugger used by most hackers. On darwin (OSX and iPhone OS), GDB will not attach to processes that have asked not to be attached to. Instead, it will crash or crash the target process. This is useful for defeating Crackulous and most tutorial-followers.		GDB is the stock debugger used by most hackers. On darwin (OSX and iPhone OS), GDB will not attach to processes that have asked not to be attached to. Instead, it will crash or crash the target process. This is useful for defeating Crackulous and most tutorial-followers.

← Older revision		Revision as of 14:00, 24 May 2009
Line 33:		Line 33:
	* the string "ptrace" is a dead giveaway, and should probably be obfuscated a bit		* the string "ptrace" is a dead giveaway, and should probably be obfuscated a bit

−	Apple approved [[http://github.com/costan/zergsupport/blob/master/ZergSupport/CryptoSupport/ZNDebugIntegrity.m this implementation]], when it was submitted with [http://istockplay.com StockPlay] version 0.5.	+	Apple approved [http://github.com/costan/zergsupport/blob/master/ZergSupport/CryptoSupport/ZNDebugIntegrity.m this implementation], when it was submitted with [http://istockplay.com StockPlay] version 0.5.

← Older revision		Revision as of 05:10, 24 May 2009
Line 33:		Line 33:
	* the string "ptrace" is a dead giveaway, and should probably be obfuscated a bit		* the string "ptrace" is a dead giveaway, and should probably be obfuscated a bit

−	Apple approved this code, when it was submitted with [http://istockplay.com\|StockPlay] version 0.5.	+	Apple approved this code, when it was submitted with [http://istockplay.com StockPlay] version 0.5.