I am developing an OS X application that I would like to conceal from inspection by DTrace. I'm aware of the P_LNOATTACH
flag, but everything I've read tells me that there are ways around it. Is it possible?
Yes, it's possible. Try running DTrace against iTunes; it doesn't work.
You have to call the ptrace function with PT_DENY_ATTACH.
http://developer.apple.com/library/mac/#documentation/Darwin/Reference/ManPages/man2/ptrace.2.html
However, there are ways around it with various kext's. Google around and you'll find some of them.
for 10.6 & 10.7: https://github.com/dwalters/pt_deny_attach
Hmm, Looks like it's broken with 10.8 due to ASLR: Detecting, and Shirking Off, the Debugger