Under linux, can I use GDB to debug a process that is currently running?
8 Answers
Yes. Use the attach
command. Check out this link for more information. Typing help attach
at a GDB console gives the following:
(gdb) help attach
Attach to a process or file outside of GDB.
This command attaches to another target, of the same type as your last
"target
" command ("info files
" will show your target stack).
The command may take as argument a process id, a process name
(with an optional process-id as a suffix), or a device file.
For a process id, you must have permission to send the process a signal,
and it must have the same effective uid as the debugger.
When using "attach
" to an existing process, the debugger finds the
program running in the process, looking first in the current working
directory, or (if not found there) using the source file search path
(see the "directory
" command). You can also use the "file
" command
to specify the program, and to load its symbol table.
NOTE: You may have difficulty attaching to a process due to improved security in the Linux kernel - for example attaching to the child of one shell from another.
You'll likely need to set /proc/sys/kernel/yama/ptrace_scope
depending on your requirements. Many systems now default to 1
or higher.
The sysctl settings (writable only with CAP_SYS_PTRACE) are:
0 - classic ptrace permissions: a process can PTRACE_ATTACH to any other
process running under the same uid, as long as it is dumpable (i.e.
did not transition uids, start privileged, or have called
prctl(PR_SET_DUMPABLE...) already). Similarly, PTRACE_TRACEME is
unchanged.
1 - restricted ptrace: a process must have a predefined relationship
with the inferior it wants to call PTRACE_ATTACH on. By default,
this relationship is that of only its descendants when the above
classic criteria is also met. To change the relationship, an
inferior can call prctl(PR_SET_PTRACER, debugger, ...) to declare
an allowed debugger PID to call PTRACE_ATTACH on the inferior.
Using PTRACE_TRACEME is unchanged.
2 - admin-only attach: only processes with CAP_SYS_PTRACE may use ptrace
with PTRACE_ATTACH, or through children calling PTRACE_TRACEME.
3 - no attach: no processes may use ptrace with PTRACE_ATTACH nor via
PTRACE_TRACEME. Once set, this sysctl value cannot be changed.
-
does this also work for a pid of a process on a remote target? Commented Mar 8, 2018 at 9:20
-
You have to run a debug server on the remote target then; after that it should be the same. Commented Mar 8, 2018 at 19:49
-
3The flag may be changed using
echo 0 | sudo tee /proc/sys/kernel/yama/ptrace_scope
. Commented Mar 1, 2019 at 13:13 -
Alternatively
sudo setcap CAP_SYS_PTRACE=+eip /usr/bin/gdb
to avoid the error "ptrace: Operation not permitted". See also this. Commented Nov 27, 2023 at 21:53
Yes. You can do:
gdb program_name program_pid
A shortcut would be (assuming only one instance is running):
gdb program_name `pidof program_name`
-
I don't know what that does but it sure as hell doesn't work for me. It says that <program_pid> does not exist.– OwlCommented Feb 27, 2016 at 19:37
-
2I find that this works best as it loads the symbol table in addition to attaching to the process. It should be noted that
program_name
works if you are in the same directory as the binary. I think a path to the binary would work if you are in a different directory. Commented May 18, 2016 at 17:49 -
3Didn't you forget the
-p
in front ofprogram_id
? Also, it might be necessary to run gdb with sudo to attach to a running process.– mxmlnknCommented Mar 5, 2019 at 9:27 -
The command to use is gdb attach pid
where pid is the process id of the process you want to attach to.
-
That's a misuse of gdb arguments. The manual said that the 2nd argument should be a filename, but when <pid> is supplied, gdb ignored the filename. (Equivalent to
gdb -p <pid>
) Commented Jul 14, 2023 at 5:17
Easiest way is to provide the process id.
gdb -p `pidof your_running_program_name`
Please get the full list of option in man gdb
command.
In case there are multiple process for the same program running, then the following command will list the processes.
ps -C program -o pid h
<number>
Then the output process id (number) can be used as argument to gdb.
gdb -p <process id>
Yes you can. Assume a process foo
is running...
ps -elf | grep foo look for the PID number gdb -a {PID number}
-
6What distribution are you running on? Using a recent version of Fedora, 'gdb -a' prints an "option -a is ambiguous" error. Commented Feb 22, 2010 at 14:16
-
1
If one want to attach a process, this process must have the same owner. The root is able to attach to any process.
ps -elf doesn't seem to show the PID. I recommend using instead:
ps -ld | grep foo
gdb -p PID