4

The code that I'm analyzing calls fork and I was wondering if there was a way to trace the child process that is created. I've looked in The IDAPro Book and there's nothing on the topic (if there is I can't find it). Perhaps it's not possible with IDAPro. Also if it's helpful I'm debugging an elf executable remotely from a windows machine. Thanks in advance.

some basic documentation https://www.hex-rays.com/products/ida/support/idadoc/index.shtml

3

This isn't IDA problem, per se. It's more to do with the debugger you're using. I assume you're using remote GDB through IDA. The debugger will attach itself to a specific process, and that process only. Fortunately, GDB has an option to follow child processes, using the debugging option:

set follow-fork-mode child

Type that in the GDB prompt at the bottom of the Output Window in IDA, and the debugger should follow the path of execution of the forked child process.

See this page for more info on debugging forks.

1

IDA does not support multi-process debugging at the moment (as of 2013). To debug the new process, you'll need to either detach from the current one, or use a new instance of IDA.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy