Trace Detection
Protection ID: trace_detection
Trace Detection identifies when tracing or instrumentation tools are monitoring your application's execution. These tools allow analysts to observe system calls, function execution, and runtime behavior without modifying the code.
Configuration
Trace Detection is enabled through the rasp configuration:
{
"protections": {
"rasp": {
"enabled": true,
"trace_detection": true,
"action": "exit"
}
}
}{
"protections": {
"rasp": {
"enabled": true,
"trace_detection": true,
"action": "exit"
}
}
}How It Works
Tracing tools observe application behavior externally, recording function calls, system calls, and runtime events. Unlike debuggers that stop execution, tracing tools monitor passively, making them harder to detect but equally dangerous for application security.
Trace Detection identifies when the application process is being traced and responds according to your configured action. This complements Anti-Debug by covering a different class of analysis tools.
What Gets Detected
| Detection | Description |
|---|---|
| System-level tracing | Operating system tracing facilities monitoring the process |
| Instrumentation tools | Tools that instrument the binary to record execution flow |
| Passive monitoring | External processes observing application behavior |
When to Use
Trace Detection is recommended for applications where even passive observation could reveal sensitive information, such as encryption key usage, authentication token handling, or proprietary algorithm execution. It is most effective when combined with Anti-Debug and Hook Detection for comprehensive runtime protection.
Related
- Anti-Debug - Detect debugger attachment
- Hook Detection - Detect hooking frameworks
- Protections Overview - All available protections