Fixing ptrace on Mac OS X 10.5 Leopard

PT_DENY_ATTACH is a non-standard ptrace() request type that prevents a debugger from attaching to the calling process. Adam Leventhal recently discovered that Leopard extends PT_DENY_ATTACH to prevent introspection into processes using dtrace. This article will cover disabling PT_DENY_ATTACH for all processes on Mac OS X 10.5. Over the previous few years, I’ve provided similar hacks for both Mac OS X 10.4, and 10.3.

5 Comments

  1. 2008-01-23 11:23 pm
  2. 2008-01-24 12:21 am
    • 2008-01-24 12:52 am
  3. 2008-01-24 3:25 pm
    • 2008-01-24 3:38 pm