Linked by Eugenia Loli on Wed 23rd Jan 2008 22:04 UTC, submitted by Tyr.
General Development PT_DENY_ATTACH is a non-standard ptrace() request type that prevents a debugger from attaching to the calling process. Adam Leventhal recently discovered that Leopard extends PT_DENY_ATTACH to prevent introspection into processes using dtrace. This article will cover disabling PT_DENY_ATTACH for all processes on Mac OS X 10.5. Over the previous few years, I've provided similar hacks for both Mac OS X 10.4, and 10.3.
Permalink for comment 297474
To read all comments associated with this story, please click here.
RE: Im off to crack now ...
by Cass on Thu 24th Jan 2008 00:52 UTC in reply to "Im off to crack now ..."
Cass
Member since:
2006-03-17

Damn edit expired on me .. apologies for the double post .. This patch works it seems, Adams test d script shows the probe firing every 10 secs even with iTunes running, only 5 mins to compile and attach teh extension too, dmesg shows exactly what Landon says :-)


Macintosh-2:Deployment Cass$ ps -ef |grep iTunes|egrep -v "Helper|grep"
501 34206 141 0 0:01.14 ?? 0:04.11 /Applications/iTunes.app/Contents/MacOS/iTunes -psn_0_1511793


Macintosh-2:Deployment Cass$ sudo dtrace -s test.d |grep tick
dtrace: script 'test.d' matched 2 probes
0 22128 :tick-10s
0 22128 :tick-10s
0 22128 :tick-10s
0 22128 :tick-10s
0 22128 :tick-10s


acintosh-2:Deployment Cass$ sudo dtrace -s test2.d
dtrace: script 'test2.d' matched 2 probes
CPU ID FUNCTION:NAME
0 22196 :tick-1s
2000

0 22196 :tick-1s
1998

0 22196 :tick-1s
1997

0 22196 :tick-1s
1996

0 22196 :tick-1s
1997


Nice work Landon

Edited 2008-01-24 00:56 UTC

Reply Parent Score: 2