20. Notes on Bypassing ptrace Anti-Debugging

A reverse-engineering target will often terminate immediately when it detects a debugger with ptrace(PTRACE_TRACEME). The key is to control the call site and return value.

Quick Bypass Routes

• Wrap ptrace with LD_PRELOAD and always return 0
• Inspect the syscall sequence with strace -f, then locate the patch site
• Patch the binary by NOPing the branch around cmp eax, -1

Practical Tips

• If seccomp blocks LD_PRELOAD, patching the binary is more reliable
• PIE binaries require accounting for the runtime base address
• Also bypass any integrity checks, such as hashes or CRCs, after patching

In CTFs, the outcome often depends on a bypass that is both fast and reproducible. Script the routine in advance.