IDA remote linux Debugger attach to a running process

Question

I usually use remote linux debugger as shown below:

./linux_server bin

And in IDA Pro, I select Remote Linux Debugger as the debugger and set the process options accordingly with the IP address and port of the Linux machine. The default port is 23946.

This works alright.

However, if I already have a process running on the Linux Machine with PID: 400. How can I attach Remote Linux debugger to this already running process?

I can see that linux_server provides only the following options:

$ ./linux_server --help
  -i...  IP address to bind to (default to any)
  -v     verbose
  -p...  port number
  -P...  password
  -k     keep broken connections

Thanks.

Answer 1

IDA allows remote process debugging as shown in the fourth page here

Note that you need to run the server with sudo so it could attach to the remote process.
Also note that you need to have the executable (more precisely, the database) that you want to debug in IDA.

You can see what I did on the linux machine:

I've compiled the code you can see in the background. It's an endless loop to simulate a running process that you want to debug.

On the connecting machine (Windows in my case):
In debugger -> process options you need to configure everything as you would normally do to a regular remote debugging. You said you already have this step completed so that's ok.

After that, press debugger -> attach to process and you'll be presented with a list of processes (for me it showed all of the running process, you might see only the processes that match the database, atleast that what I would expect). Select the process you want to debug:

After a couple of single steps, I'm back to main and can debug the process: