1

I'm attempting to inspect memory of an httpd binary compiled statically with openssl. When I list the httpd processes, I get:

$ ps aux|grep httpd
root     58539  0.0  0.7  75364  3740 ?        Ss   14:49   0:00 /opt/httpd/bin/httpd
daemon   58850  0.0  0.5 364328  2556 ?        Sl   14:58   0:00 /opt/httpd/bin/httpd
daemon   58914  0.0  0.5 364328  2548 ?        Sl   14:59   0:00 /opt/httpd/bin/httpd
daemon   58942  0.0  0.5 364328  2544 ?        Sl   14:59   0:00 /opt/httpd/bin/httpd

I then tried attaching to each of the processes individually and applying a breakpoint to the function I am trying to debug. However, the breakpoint never gets triggered, although I know the function is being called. I assume this problem relates to something along the lines of httpd forking on a new process, but I'm a bit stuck on how to proceed. Is there a generic way to ensure my breakpoint is triggered even if the processes forks?

  • 1
    Assuming your httpd is apache, to debug something like this, it might be best to service httpd stop and gdb httpd -X. That way, httpd will serve requests, but never fork, which makes things much easier to debug. – Guntram Blohm supports Monica Oct 8 '14 at 9:09
1

Depending on the worker model your apache is configured to use its likely a new worker is being spawned to handle your request if your bp isnt hitting. Like Guntram said you can disable forking and put httpd in debug mode by using the -X flag and starting gdb with:

gdb httpd -X

If for some reason you need to debug the multiple worker configured httpd you should use the gdb options set follow-fork-mode ask or set follow-fork-mode child if you know you'd like to follow all forks in advance. (https://sourceware.org/gdb/onlinedocs/gdb/Forks.html). This would also be considered the 'generic approach' and would apply to programs that don't allow you to run single process in the foreground.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.