Debugging forked child in an anti-debug protected crackme

Question

I am interested in the anti-debugging method implemented in the crackme called trace-p. A child process is forked, which communicates with the parent using int3 instructions. I would like to debug the child. gdb has set follow-fork-mode, however gdb does not recognize the file as executable (probably because of deleted sections related information). With radare2 I can disassemble and even debug, but I do not know how to follow the child after the fork takes place. I want to do this because the child contains instructions like:

0x0804898a    jmp dword [edx*4 + 0x8049334]

I want to stop there and examining edx, in order to see where the jump takes.

I am interested in any tool or method which is able to debug the child process.

Answer 1

Use dbg.forks=true to stop the debugger when a fork happens. and then just use dp to list and select the pid you want to follow.

Answer 2

The first thing with radare2 is to make sure that you're running the latest git version.

To get help about commands in radare2, you can use the ? character. For help about configuration variables, you can use e?? (since e? would give you help about how to use them, not list them). Since there are many variables, you can filter them with the internal grep command : ~.

[0x00000000]> e??dbg
          dbg.args: Set the args of the program to debug
       dbg.backend: Select the debugger backend
           dbg.bep: break on entrypoint (loader, entry, constructor, main)
      dbg.bpinmaps: Force breakpoints to be inside a valid map
        dbg.bpsize: Size of software breakpoints
        dbg.btalgo: Select backtrace algorithm
       dbg.btdepth: Depth of backtrace
         dbg.clone: Stop execution if new thread is created
         dbg.execs: Stop execution if new thread is created
        dbg.follow: Follow program counter when pc > core->offset + dbg.follow
         dbg.forks: Stop execution if fork() is done (see dbg.threads)
          dbg.libs: If set stop when loading matching libname
       dbg.profile: Path to RRunProfile file
 dbg.shallow_trace: While tracing, avoid following calls outside specified range
          dbg.slow: Show stack and regs in visual mode in a slow but verbose mode
        dbg.status: Set cmd.prompt to '.dr*' or '.dr*;drd;sr PC;pi 1;s-'
        dbg.swstep: Force use of software steps (code analysis+breakpoint)
       dbg.threads: Stop all threads when debugger breaks (see dbg.forks)
         dbg.trace: Trace program execution (see asm.trace)
     dbg.trace.tag: Trace tag
        dbg.unlibs: If set stop when unloading matching libname
[0x00000000]>

You could aslo have use e dbg.<tab>, since there is autocompletion.

Obviously, the variale you're looking for is dbg.fork, to set it to true: this will stop the process when it encounters a fork(). You can the change the pid with a d-command:

[0x00000000]> d?~process
| dH [handler]            Transplant process to a new handler
| do                      Open process (reload, alias for 'oo')
| dp[?]                   List, attach to process or thread id
| dx[?]                   Inject and run code on target process (See gs)

[0x00000000]> dp?
|Usage: dp # Process commands
| dp                  List current pid and childrens
| dp             List children of pid
| dp*                 List all attachable pids
| dp=            Select pid
| dp-            Dettach select pid
| dpa            Attach and select pid
| dpe                 Show path to executable
| dpf                 Attach to pid like file fd // HACK
| dpk    Send signal to process
| dpn                 Create new process (fork)
| dpnt                Create new thread (clone)
| dpt                 List threads of current pid
| dpt            List threads of process
| dpt=        Attach to thread

[0x00000000]

Answer 3

Radare2 has a configuration variable dbg.follow.child which is equivalent to set follow-fork-mod.

 e??~fork
    dbg.follow.child: Continue tracing the child process on fork. By default the parent process is traced

Set it to debug the child process with the command

e dbg.follow.child = true

or when launching radare with -e :

r2 -e dbg.follow.child=true -d ./my_binary