8

I am trying to reverse engineer a Linux binary that makes several fork() calls. I am using GDB 7.5 on Ubuntu. What I am trying to do with GDB is attach to a certain fork() (say the second call). Is the only way to do this to set follow-fork-mode to child and catch all calls to fork and manually switch it each time?

5

You can also use set detach-on-fork off, as said in the documentation:

set detach-on-fork MODE Tells gdb whether to detach one of the processes after a fork, or retain debugger control over them both.

The documentation says also this:

If you choose to set detach-on-fork mode off, then GDB will retain control of all forked processes (including nested forks). You can list the forked processes under the control of GDB by using the info inferiors command, and switch from one fork to another by using the inferior command

To quit debugging one of the forked processes, you can either detach from it by using the detach inferiors command (allowing it to run independently), or kill it using the kill inferiors command.

2

What you describe is how I've typically approached this. Setting a breakpoint on fork itself provides a nice spot to change this mode, if necessary.

Or, if the child threads / processes are "stable", you can switch to them after the fact with the inferior command.

http://sourceware.org/gdb/onlinedocs/gdb/Forks.html

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.