ptrace 防护

1.鉴于在iOS框架下无ptrace，工程中新建文件粘贴以下代码，在想要防护的文件引入ptrace 头文件，

#ifndef    _SYS_PTRACE_H_
#define    _SYS_PTRACE_H_

#include <sys/appleapiopts.h>
#include <sys/cdefs.h>

enum {
    ePtAttachDeprecated __deprecated_enum_msg("PT_ATTACH is deprecated. See PT_ATTACHEXC") = 10
};


#define    PT_TRACE_ME    0    /* child declares it's being traced */
#define    PT_READ_I    1    /* read word in child's I space */
#define    PT_READ_D    2    /* read word in child's D space */
#define    PT_READ_U    3    /* read word in child's user structure */
#define    PT_WRITE_I    4    /* write word in child's I space */
#define    PT_WRITE_D    5    /* write word in child's D space */
#define    PT_WRITE_U    6    /* write word in child's user structure */
#define    PT_CONTINUE    7    /* continue the child */
#define    PT_KILL        8    /* kill the child process */
#define    PT_STEP        9    /* single step the child */
#define    PT_ATTACH    ePtAttachDeprecated    /* trace some running process */
#define    PT_DETACH    11    /* stop tracing a process */
#define    PT_SIGEXC    12    /* signals as exceptions for current_proc */
#define PT_THUPDATE    13    /* signal for thread# */
#define PT_ATTACHEXC    14    /* attach to running process with signal exception */

#define    PT_FORCEQUOTA    30    /* Enforce quota for root */
#define    PT_DENY_ATTACH    31

#define    PT_FIRSTMACH    32    /* for machine-specific requests */

__BEGIN_DECLS


int    ptrace(int _request, pid_t _pid, caddr_t _addr, int _data);


__END_DECLS

#endif    /* !_SYS_PTRACE_H_ */

2.实现

     /*
     arg1:ptrace 要做的事情
     arg2:要操作的进程的id
     arg3(地址)\arg4(数据)：取决于第一个参数
     */
    ptrace(PT_DENY_ATTACH, 0, 0, 0);

即可实现防止程序通过工具“附加调试”。

3.通过Xcode附加调试显示如下：

断点示意图

4.自己书写汇编代码，防止反调试出ptrace

void func(int a,int b,int c,int d)
{
    asm(
        "mov x0,#31\n"
        "mov x1,#0\n"
        "mov x2,#0\n"
        "mov x3,#0\n"
        "mov w16,#26\n" //26是ptrace
        "svc #0x80" //0x80触发中断去找w16执行
        );
}
- (void)viewDidLoad {
    [super viewDidLoad];
    func(PT_DENY_ATTACH,0,0,0);
}