Detailed introduction to the principles and cleanup methods of system zombie files

A zombie file is a file generated by a computer hacker to attack a large server or a large computer by using a network tool or a self-prepared tool, if a user browses a webpage with the file they have written, your computer will be like a virus. Most of the functions are the ability to perform DDOS operations on a specified remote computer.

A zombie process is a parent process that has exited and is not accepted by the dead process. It becomes a zombie process.

How to generate botnets:

When a process calls the exit command to end its own life, it is not actually destroyed, but it leaves a data structure called Zombie (the system calls exit, it is used to exit a process, but it is only limited to converting a normal process into a zombie process and cannot completely destroy it ). In the status of a Linux Process, a zombie process is a very special one. It has abandoned almost all the memory space, no executable code, and cannot be scheduled, only one location is retained in the process list, and information such as the exit status of the process is recorded for collection by other processes. In addition, zombie processes no longer occupy any memory space. It requires its parent process to collect dead parts for it. If its parent process does not have the SIGCHLD signal processing function installed, it calls wait or waitpid () to wait until the child process ends, if the signal is not explicitly ignored, it will remain in zombie state. If the parent process ends, the init process will automatically take over the child process and send a zombie to it, it can still be cleared. However, if the parent process is a loop and does not end, the child process will remain zombie, which is why many zombie processes sometimes exist in the system.

How to view botnets:

Using the command ps, we can see that the process marked as Z is a zombie process.

How to clear zombie processes:

1. Rewrite the parent process and send it to the dead after the child process dies. The specific method is to take over the SIGCHLD signal. After a child process dies, it sends a SIGCHLD signal to the parent process. After receiving the signal, the parent process executes the waitpid () function to collect the child process. This is based on the principle that even if the parent process does not call wait, the kernel will send SIGCHLD messages to it, even though the default processing is ignored. If you want to respond to this message, you can set a processing function.

2. Kill the parent process. After the death of the parent process, the zombie process becomes an "orphan process". After it passes through to the init process on process 1, init will always be responsible for cleaning up the zombie process. All the zombie processes it generates will also disappear.