ptrace_killer
A simple Linux LKM (Loadable Kernel Module) that detects any process that's utilizing ptrace and its tracees.
Background:
- This kernel module relies upon the Linux kernel
task_struct'sptracemember to detect whether a debugger is present or not. - Once any process starts "ptracing" another, the tracee gets added into ptraced that's located in
task_struct, which is simply a linked list that contains all the tracees that the process is "ptracing". - Once a tracer is found, the module lists all its tracees and sends a
SIGKILLsignal to each of them including the tracer. This results in killing both the tracer and its tracees. - Once the module is attached to the kernel, the module's "core" function will run periodically through the advantage of workqueues. Specifically, the module runs every
JIFFIES_DELAY, which is set to 1. That is, the module will run every one jiffy. This can be changed through modifying the macroJIFFIES_DELAYdefined in the module.
Testing the module:
- First, you should make sure that GCC and kernel headers are already installed:
- Debian-based distributions:
$ sudo apt-get install build-essential linux-headers-$(uname -r)
- Clone the repo:
$ git clone https://github.com/omr00t/ptrace_killer
- Compile the module:
$ cd ptrace_killer && make
- If everything went all right, the module would be compiled into a
.kofile. - The module can be loaded through:
$ sudo insmod ptrace_killer.ko # Module is enabled by default once it's loaded.
$ sudo insmod ptrace_killer.ko enabled=0 # Load the module as disabled. Must be manually enabled. See below.
- Enable/Disable the module:
$ echo -n "1" | sudo tee /sys/module/ptrace_killer/parameters/enabled # Enable the module.
$ echo -n "0" | sudo tee /sys/module/ptrace_killer/parameters/enabled # Disable the module.
- You can test the module through trying to debug a binary file with any debugger (gdb for example):
$ gdb --pid=27931
GNU gdb (Ubuntu 9.1-0ubuntu1) 9.1
Copyright (C) 2020 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.
Type "show copying" and "show warranty" for details.
This GDB was configured as "x86_64-linux-gnu".
Type "show configuration" for configuration details.
For bug reporting instructions, please see:
<http://www.gnu.org/software/gdb/bugs/>.
Find the GDB manual and other documentation resources online at:
<http://www.gnu.org/software/gdb/documentation/>.
For help, type "help".
Type "apropos word" to search for commands related to "word".
Attaching to process 27931
Reading symbols from /tmp/test2...
(No debugging symbols found in /tmp/test2)
Killed
- You can check the module's log through
dmesg:
$ dmesg
...
ptrace_killer: Loaded!
ptrace_killer: ptracer -> comm: gdb pid: 27960
tgid: 27960 ptrace: 0
ptrace_killer: ptracee -> comm: test2 pid: 27931
tgid: 27931 ptrace: 1
ptrace_killer: All tracees have been killed.
ptrace_killer: Tracer's been killed.
...
- As soon as gdb tried to "ptrace" the target process, gdb's got killed in addition to its tracee(s), of course.
- A gif showing the process:
- Remove the module from the kernel entirely:
$ sudo rmmod ptrace_killer
React
Typescript
Django
Laravel
Facebook
Microsoft
Google
Alibaba
D3
Tencent