/usr/share/doc/radare-doc/html/Section20.3.4.html is in radare-doc 1:1.5.2-6.
This file is owned by root:root, with mode 0o644.
The actual contents of the file can be viewed below.
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 | <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN"
"http://www.w3.org/TR/html4/strict.dtd">
<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=US-ASCII">
<title>Threads and processes</title>
<link rel="previous" href="Section20.3.3.html">
<link rel="ToC" href="contents.html">
<link rel="next" href="Section20.3.5.html">
</head>
<body>
<h1><a name="thprocs"></a>20.3.4 Threads and processes</h1>
<p>
The list of child processes of the target process can be listed with '!pid' command.
</p>
<pre><code>$ radare -d /bin/sh
[0x13B8C0]> !run
To cleanly stop the execution, type: "^Z kill -STOP 1527 && fg"
sh-3.2$ ls
pid: 1611. new process created!
- Use !pid for processes, and !th for threads
CLONE HAS BEEN INVOKED
debug_dispatch_wait: RET = 0 WS(event)=6 INT3_EVENT=2 INT_EVENT=3 CLONE_EVENT=6
=== cont: tid: 1611 event: 6, signal: 19 (SIGSTOP). stop at 0x4ab95eb3
[0x4A13B8C0]> !pid
pid : 1527 0x4ab95eb3 (stopped)
pid : 1611 0x4ab95eb3 (stopped)
`- 1611 : /bin/sh (stopped)
</code></pre>
<p>
The /bin/sh while calling 'ls'. This event has been catched by radare and prompts you again. Now we can choose which process we want to follow. The parent or the child.
</p>
<pre><code>[0x4A13B8C0]> !pid 1527
Current selected thread id (pid): 1527
</code></pre>
<p>
The same operations can be done by using the '!th' command for the threads.
</p>
<p>
In the same way you can hackily 'attach' and 'detach' from to a pid.
</p>
<!-- version IDs:
$Id: radare.but 2009-04-25 pancake $
-->
</body>
</html>
|