Linux Anti-Debugging & Memory Dump Prevention: ptrace + prctl in x64 Assembly | EDR Evasion
Two syscalls, zero libc: PTRACE_TRACEME (sys_ptrace 101) self-traces the process to block gdb/strace with EPERM, PR_SET_DUMPABLE=0 (sys_prctl 157) kills core dump creation at OS level. Syscall numbers are calculated dynamically at runtime to evade YARA static analysis. Full x64 Assembly implementation with eBPF detection surface analysis.
