18:53 Sun, 20 Nov 2005 PST -0800

Fixing ptrace(pt_deny_attach, ...) on Mac OS X 10.4 Tiger

NOTE: For information on Mac OS X Leopard (10.5), refer to this article.

PT_DENY_ATTACH is a non-standard ptrace() request type available on Mac OS X that prevents a debugger from attaching to the calling process. This article will cover disabling PT_DENY_ATTACH for all processes on Mac OS X 10.4. For more information on how the request type is implemented, please refer to the previous article.

Click here to read more ...

[/code/macosx] permanent link

[/code/macosx] permanent link

18:48 Sun, 20 Nov 2005 PST -0800

Fixing ptrace(pt_deny_attach, ...)

NOTE: For information on Mac OS X Tiger, refer to this article.

In Mac OS X, Apple introduced an additional, non-standard request type to the ptrace() system call - PT_DENY_ATTACH. While an understandable addition, especially in terms of providing plausible defense for their DRM applications, PT_DENY_ATTACH has come to be used by a number of third party developers in an attempt to provide further copy protection.

This is unfortunate for those of us with a genuine need to attach a debugger; There are several circumstances when this ability is necessary, including working with libSystem, writing a runtime patch with APE, writing a kext, writing an input manager, or software auditing.

There are several possible ways to work around this behavior; breaking on ptrace(2) in gdb, recompiling your kernel, or writing a kext. I choose to write a kext that hooks ptrace(2).

Click here to read more ...

[/code/macosx] permanent link

20:12 Sun, 06 Nov 2005 PST -0800

Bacula Encryption - First Milestone Reached

File Daemon Signing Support Implemented

I just committed support for cryptographic signatures in the File Daemon. The signatures are stored using the ASN.1 syntax I previously outlined. The code supports multiple signers, but the configuration file only supports the specification of a single signing key. You can, however, specify multiple trusted public keys, and any signatures made with those keys will be accepted.

Click here to read more ...

[/code/bacula] permanent link