I am trying to reverse engineer a Linux binary that makes several fork()
calls. I am using GDB 7.5 on Ubuntu. What I am trying to do with GDB is attach to a certain fork()
(say the second call). Is the only way to do this to set follow-fork-mode
to child
and catch all calls to fork
and manually switch it each time?
2 Answers
You can also use set detach-on-fork off
, as said in the documentation:
set detach-on-fork MODE
Tells gdb whether to detach one of the processes after a fork, or retain debugger control over them both.
The documentation says also this:
If you choose to set
detach-on-fork
mode off, then GDB will retain control of all forked processes (including nested forks). You can list the forked processes under the control of GDB by using theinfo inferiors
command, and switch from one fork to another by using theinferior
commandTo quit debugging one of the forked processes, you can either detach from it by using the
detach inferiors
command (allowing it to run independently), or kill it using thekill inferiors
command.
What you describe is how I've typically approached this. Setting a breakpoint on fork
itself provides a nice spot to change this mode, if necessary.
Or, if the child threads / processes are "stable", you can switch to them after the fact with the inferior
command.