title: Bypassing ptrace in gdb
body: <p>I found the following trick to use if a program uses <code>ptrace</code> to detect whether it is running in a debugger:</p>
  
  <pre><code>catch syscall ptrace
  commands 1
  set ($eax) = 0
  continue
  end
  </code></pre>
  
  <p>Can somebody explain me how is it working? I have tried to insert <code>i r eax</code> after <code>commands 1</code>, however I do not understand the negative values I have got:</p>
  
  <pre><code>Catchpoint 1 (call to syscall ptrace), 0x00007ffff778af1e in ptrace (request=PTRACE_TRACEME) at ../sysdeps/unix/sysv/linux/ptrace.c:45
  45  ../sysdeps/unix/sysv/linux/ptrace.c: No such file or directory.
  eax            0xffffffda   -38
  
  Catchpoint 1 (returned from syscall ptrace), 0x00007ffff778af1e in ptrace (request=PTRACE_TRACEME) at ../sysdeps/unix/sysv/linux/ptrace.c:45
  45  in ../sysdeps/unix/sysv/linux/ptrace.c
  eax            0xffffffff   -1
  </code></pre>