Reverse Engineering Stack Exchange is a question and answer site for researchers and developers who explore the principles of a system through analysis of its structure, function, and operation. It only takes a minute to sign up.
Sign up to join this community
The code that I'm analyzing calls fork and I was wondering if there was a way to trace the child process that is created. I've looked in The IDAPro Book and there's nothing on the topic (if there is I can't find it). Perhaps it's not possible with IDAPro. Also if it's helpful I'm debugging an elf executable remotely from a windows machine. Thanks in advance.
some basic documentation https://www.hex-rays.com/products/ida/support/idadoc/index.shtml
This isn't IDA problem, per se. It's more to do with the debugger you're using. I assume you're using remote GDB through IDA. The debugger will attach itself to a specific process, and that process only. Fortunately, GDB has an option to follow child processes, using the debugging option:
set follow-fork-mode child
Type that in the GDB prompt at the bottom of the Output Window in IDA, and the debugger should follow the path of execution of the forked child process.
See this page for more info on debugging forks.
IDA does not support multi-process debugging at the moment (as of 2013). To debug the new process, you'll need to either detach from the current one, or use a new instance of IDA.
