/* bliako modified https://reverseengineering.stackexchange.com/a/1931 for https://perlmonks.org/?node_id=3333;parent=1229102 KILL it with SIGKILL (kill -9) 29/01/2019 */ #include #include #include #include #include #include void intHandler(int sig) { printf("got signal %d\n", sig); } int main(void){ printf("my pid: %d\n", getpid()); char *e; if( (e=getenv("TRACEME")) != NULL && (strcmp(e,"0")==0) ){ printf("Will not be traced...\n"); signal(SIGSTOP, intHandler); if (ptrace(PTRACE_TRACEME, 0, 1, 0) == -1) { printf("don't trace me !!\n"); return 1; } } // normal execution for(int i=0;;i++){ printf("i=%d\n", i); sleep(1); } return 0; } #### gcc tracee.c -o tracee && TRACEME=0 tracee strace -p strace: attach: ptrace(PTRACE_SEIZE, 11091): Operation not permitted #### TRACEME=1 tracee strace -p