2

I'm reverse engineering a malware that creates a number of child processes and I'm trying to do dynamic analysis of the ELF binary with IDA Pro and IDA's Local Linux Debugger, but I can't get IDA to attach to the child process.

Is there some way to force IDA to follow the child process instead of the parent one?

I've tried using gdbserver which seems to lack the follow-fork-mode functionality of gdb and I couldn't find any information on child processes and the IDA Pro Linux Debugger.

1

AFAIK IDA does not have that feature, so you'll have to do that yourself by breakpointing or stepping to calls to process creation functions (usually execve, fork, etc), and then forcibly debugging them either by using other IDA instances or creating gdb instances.

You won't be able to debug multiple processes in a single IDA instance.

If you want to debug such processes, you could replace the execve with spawning the process yourself, attaching to the process, etc. There are plenty of answers online, if you're not limiting to IDA specifically.

Once you debugged a process, a common trick you could use is to put the debugged process into a JMP $-2 infinite loop (EB FC on x86 CPUs), detach your original debugger, re-attach with IDA and restore the original instruction sequence you replaced with JMP $-2.

  • Thanks for your answer, but could you explain a bit more what you mean by "forcibly debugging them"? – m-strasser Jun 13 '17 at 9:04
  • I didn't mean anything special, just the usual attaching and following childs in GDB – NirIzr Jun 13 '17 at 15:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.