0

I usually use remote linux debugger as shown below:

./linux_server bin

And in IDA Pro, I select Remote Linux Debugger as the debugger and set the process options accordingly with the IP address and port of the Linux machine. The default port is 23946.

This works alright.

However, if I already have a process running on the Linux Machine with PID: 400. How can I attach Remote Linux debugger to this already running process?

I can see that linux_server provides only the following options:

$ ./linux_server --help
  -i...  IP address to bind to (default to any)
  -v     verbose
  -p...  port number
  -P...  password
  -k     keep broken connections

Thanks.

1

IDA allows remote process debugging as shown in the fourth page here

Note that you need to run the server with sudo so it could attach to the remote process.
Also note that you need to have the executable (more precisely, the database) that you want to debug in IDA.

You can see what I did on the linux machine:

linux machine screenshot

I've compiled the code you can see in the background. It's an endless loop to simulate a running process that you want to debug.

On the connecting machine (Windows in my case):
In debugger -> process options you need to configure everything as you would normally do to a regular remote debugging. You said you already have this step completed so that's ok.

debugger->process options

After that, press debugger -> attach to process and you'll be presented with a list of processes (for me it showed all of the running process, you might see only the processes that match the database, atleast that what I would expect). Select the process you want to debug:

processes list

After a couple of single steps, I'm back to main and can debug the process:

ida debug view

  • Thanks. I had to run Linux remote debugging server as sudo for this to work properly. – Neon Flash Nov 28 '18 at 0:19

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.