encrypted executables

[Joerg Sonnenberger]

On Wed, Feb 20, 2008 at 09:39:03PM -0500, ari edelkind wrote:
> Mind you, it's true that disabling core dumps with a resource limit
> doesn't keep one from creating a core image using gcore, but since gcore
> generally must either attach to a process using ptrace() or access
> mapped code segments in the original binary (depending on the
> implementation), it won't help in such a case, either.

What prevents me from patching the kernel (!) to just ignore the
resource limit? Nothing.

Joerg