Reverse Engineering Stack Exchange is a question and answer site for researchers and developers who explore the principles of a system through analysis of its structure, function, and operation. It only takes a minute to sign up.
Sign up to join this community
I'm reverse engineering a malware that creates a number of child processes and I'm trying to do dynamic analysis of the ELF binary with IDA Pro and IDA's Local Linux Debugger, but I can't get IDA to attach to the child process.
Is there some way to force IDA to follow the child process instead of the parent one?
I've tried using gdbserver which seems to lack the follow-fork-mode functionality of gdb and I couldn't find any information on child processes and the IDA Pro Linux Debugger.
AFAIK IDA does not have that feature, so you'll have to do that yourself by breakpointing or stepping to calls to process creation functions (usually execve, fork, etc), and then forcibly debugging them either by using other IDA instances or creating gdb instances.
You won't be able to debug multiple processes in a single IDA instance.
If you want to debug such processes, you could replace the execve with spawning the process yourself, attaching to the process, etc. There are plenty of answers online, if you're not limiting to IDA specifically.
Once you debugged a process, a common trick you could use is to put the debugged process into a JMP $-2 infinite loop (EB FC on x86 CPUs), detach your original debugger, re-attach with IDA and restore the original instruction sequence you replaced with JMP $-2.
