{"action":"created","issue":{"url":"https://api.github.com/repos/frida/frida-python/issues/50","labels_url":"https://api.github.com/repos/frida/frida-python/issues/50/labels{/name}","comments_url":"https://api.github.com/repos/frida/frida-python/issues/50/comments","events_url":"https://api.github.com/repos/frida/frida-python/issues/50/events","html_url":"https://github.com/frida/frida-python/issues/50","id":109072268,"number":50,"title":"About anti-debug","user":{"login":"acgmohu","id":2801072,"avatar_url":"https://avatars.githubusercontent.com/u/2801072?v=3","gravatar_id":"","url":"https://api.github.com/users/acgmohu","html_url":"https://github.com/acgmohu","followers_url":"https://api.github.com/users/acgmohu/followers","following_url":"https://api.github.com/users/acgmohu/following{/other_user}","gists_url":"https://api.github.com/users/acgmohu/gists{/gist_id}","starred_url":"https://api.github.com/users/acgmohu/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/acgmohu/subscriptions","organizations_url":"https://api.github.com/users/acgmohu/orgs","repos_url":"https://api.github.com/users/acgmohu/repos","events_url":"https://api.github.com/users/acgmohu/events{/privacy}","received_events_url":"https://api.github.com/users/acgmohu/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2015-09-30T11:57:55Z","updated_at":"2015-09-30T12:07:19Z","closed_at":null,"body":"Hi,\r\nIn Android, one sample has anti-debug code.  When my script attach the process, it will like this:\r\n```\r\nTraceback (most recent call last):\r\n  File \"crack3.py\", line 10, in <module>\r\n    session = frida.get_usb_device().attach(\"test.crackme\")\r\n  File \"/usr/local/Cellar/python3/3.4.2_1/Frameworks/Python.framework/Versions/3.4/lib/python3.4/site-packages/frida-5.0.2-py3.4-macosx-10.10-x86_64.egg/frida/core.py\", line 87, in attach\r\nfrida.PermissionDeniedError: unable to access process with pid 4973 due to system restrictions; try `sudo sysctl kernel.yama.ptrace_scope=0`, or run Frida as root\r\n```\r\n```\r\n```\r\nroot      8296  1     24724  20308 ffffffff 00000000 S ./frida-server\r\nroot      8378  8296  4760   1168  ffffffff 00000000 S /data/local/tmp/.frida-60bfdeca9cc8aef9bbd115a03efb8377/frida-helper-32\r\n```\r\n```\r\n\r\nI try to hook its father process zygote, but this will crash other applications.\r\n```\r\n Module.enumerateExports(\"libdvm.so\", {                \r\n      onMatch: function(e) {                            \r\n          if(e.type == 'function') {                    \r\n              if(e.name == \"_Z12dexFileParsePKhji\") {\r\n                  send(e.name);                         \r\n                  Interceptor.attach(e.address, {       \r\n                      onEnter: function(args) {         \r\n                          send(\"enter\");                \r\n                      },                                \r\n                      onLeave: function(retval){        \r\n                          send(\"leave\");                \r\n                      }                                 \r\n                  });                                                                   \r\n              }                                         \r\n          }                                             \r\n      },                                                \r\n      onComplete: function() {}                         \r\n  });                                                   \r\n```         \r\n\r\nSo I try to attach its children pid( /proc/_pid/task ), but I have not found the API.\r\n\r\nAny idea? \r\n\r\n            \r\n"},"comment":{"url":"https://api.github.com/repos/frida/frida-python/issues/comments/144375885","html_url":"https://github.com/frida/frida-python/issues/50#issuecomment-144375885","issue_url":"https://api.github.com/repos/frida/frida-python/issues/50","id":144375885,"user":{"login":"oleavr","id":735197,"avatar_url":"https://avatars.githubusercontent.com/u/735197?v=3","gravatar_id":"","url":"https://api.github.com/users/oleavr","html_url":"https://github.com/oleavr","followers_url":"https://api.github.com/users/oleavr/followers","following_url":"https://api.github.com/users/oleavr/following{/other_user}","gists_url":"https://api.github.com/users/oleavr/gists{/gist_id}","starred_url":"https://api.github.com/users/oleavr/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/oleavr/subscriptions","organizations_url":"https://api.github.com/users/oleavr/orgs","repos_url":"https://api.github.com/users/oleavr/repos","events_url":"https://api.github.com/users/oleavr/events{/privacy}","received_events_url":"https://api.github.com/users/oleavr/received_events","type":"User","site_admin":false},"created_at":"2015-09-30T12:07:19Z","updated_at":"2015-09-30T12:07:19Z","body":"Hi,\r\n\r\nInteresting problem. I think longer term Frida should support other injection strategies on Linux/Android by using a kernel driver as a fallback strategy. Until then I think you're limited to `spawn([package_name])` (or `enable_spawn_gating()` to hook all processes spawned by zygote), that way there's no need to use ptrace at all.\r\n\r\nCheers!"}}