GDB attaching to a process where executable is deleted

Question

I have running process but it's executable file has got deleted. If I try to attach gdb I got following error

/home/vivek/binary/releases/20120328101511/bin/app.exe (deleted): No such file or directory.

How can I attach gdb to this process ?

Sample Test case: Source code:

#include<stdio.h>
#include<stdlib.h>
int main(){
  for (;;){
    printf("Sleeping");
    sleep(1);
  }
}

compile it

 gcc main.cc -o a.out
 gcc main.cc -o b.out

Run ./a.out

Now from different terminal delete a.out. And fire gdb attach pgrep a.out file b.out It doesn't work.

GDB shows following error:

/tmp/temp/a.out (deleted): No such file or directory.
A program is being debugged already.  Kill it? (y or n) n
Program not killed.

score 9 · Accepted Answer · edited Oct 12 '12 at 09:47

9

Try using /proc/<pid>/exe as the executable. It appears as a symbolic link these days, however, in the past it was possible to extract the deleted executable from it.

See Detecting deleted executables.

We can use following command to attach gdb

gdb <path-to-binary> <pid>

edited Oct 12 '12 at 09:47

Vivek Goel

22,942
29
114
186

answered Apr 02 '12 at 09:59

Maxim Egorushkin

131,725
17
180
271

That works under linux (I just tested it, intending to post same), I didn't see anyone mention cygwin here. – Hasturkun Apr 02 '12 at 10:03
@maxim look at the command line. I'm guessing here, but it looks cygwin, not linux to me. – littleadv Apr 02 '12 at 10:05
@littleadv: I guess you got confused by `.exe`. Absolute path in cygwin would start with `/cygdrive/c/...`. – Maxim Egorushkin Apr 02 '12 at 10:06
@Maxim Yegorushkin I have original executable at other location. Can I use that in gdb to attach on current running process ? – Vivek Goel Apr 02 '12 at 12:56
1

That should work if the binary is the same. `gdb `. – Maxim Egorushkin Apr 02 '12 at 13:21

score 2 · Answer 2 · answered Apr 02 '12 at 09:56

2

You can't. GDB needs the symbol data that's in the executable and is not being loaded by the OS when running the program.

answered Apr 02 '12 at 09:56

littleadv

20,100
2
36
50

can't I specify same executable file but at different location? – Vivek Goel Apr 02 '12 at 10:13
but how if I give gdb process it says executable deleted. Program already debugged. – Vivek Goel Apr 02 '12 at 18:44
you should use the "attach" and the "file" command line options together. http://www.ofb.net/gnu/gdb/gdb_99.html#SEC99 – littleadv Apr 02 '12 at 18:45
It don't work it shows error. gdb attach 335 b.out. /tmp/temp/a.out (deleted): No such file or directory. – Vivek Goel Jul 30 '12 at 07:55

GDB attaching to a process where executable is deleted

2 Answers2

Linked