Question

I have running process but it’s executable file has got deleted.
If I try to attach gdb I got following error

/home/vivek/binary/releases/20120328101511/bin/app.exe (deleted): No such file or directory.

How can I attach gdb to this process ?

Sample Test case:
Source code:

#include<stdio.h>
#include<stdlib.h>
int main(){
  for (;;){
    printf("Sleeping");
    sleep(1);
  }
}

compile it

 gcc main.cc -o a.out
 gcc main.cc -o b.out

Run
./a.out

Now from different terminal delete a.out.
And fire gdb attach pgrep a.out file b.out
It doesn’t work.

GDB shows following error:

/tmp/temp/a.out (deleted): No such file or directory.
A program is being debugged already.  Kill it? (y or n) n
Program not killed.

Answer 1

Try using /proc/<pid>/exe as the executable. It appears as a symbolic link these days, however, in the past it was possible to extract the deleted executable from it.

See Detecting deleted executables.

We can use following command to attach gdb

gdb <path-to-binary> <pid>