Analysis of linux botnets

A zombie process means that the parent process has exited, and the dead process becomes a zombie process without being accepted by the process. how a zombie process generates a zombie process: when a process calls the exit command to end its own life, it is not actually destroyed, instead, it leaves a data structure called Zombie (which calls exit by the system. It is used to exit the process, but it is only limited to converting a normal process into a Zombie process, it cannot be completely destroyed ). In the status of a Linux Process, a zombie process is a very special one. It has abandoned almost all the memory space, no executable code, and cannot be scheduled, only one bit is retained in the process list, and information such as the exit status of the process is recorded for collection by other processes. In addition, zombie processes no longer occupy any memory space. It requires its parent process to collect dead parts for it. If its parent process does not have the SIGCHLD signal processing function installed, it calls wait or waitpid () to wait until the child process ends, if the signal is not explicitly ignored, it will remain in zombie state. If the parent process ends, the init process will automatically take over the child process and send a zombie to it, it can still be cleared. However, if the parent process is a loop and does not end, the child process will remain zombie, which is why many zombie processes sometimes exist in the system. How to view zombie processes: using the command ps, we can see that a process marked as Z is a zombie process. How to clear zombie processes: 1. Rewrite the parent process and collect dead parts for it after the child process dies. The specific method is to take over the SIGCHLD signal. After a child process dies, it sends a SIGCHLD signal to the parent process. After the parent process receives the signal, it executes the waitpid () function to collect the child process. This is based on the principle that even if the parent process does not call wait, the kernel will send SIGCHLD messages to it, even though the default processing is ignored. If you want to respond to this message, you can set a processing function. 2. Kill the parent process. After the death of the parent process, the zombie process becomes an "orphan process". After it passes through to the init process on process 1, init will always be responsible for cleaning up the zombie process. All the zombie processes it generates will also disappear. ==================================================== In fork () in the/execve () process, assume that the parent process still exists at the end of the sub-process, and the SIGCHLD signal processing function is not installed before the parent process fork () and waitpid () is called to wait until the sub-process ends, if this signal is not explicitly ignored, the sub-process becomes a zombie process and cannot end normally. At this time, even if the root identity is kill-9, the zombie process cannot be killed. The remedy is to kill the parent process of the zombie process (the parent process of the zombie process must exist). The zombie process becomes an "orphan process" and passes the process init to process 1, init is always responsible for cleaning up zombie processes. ========================================================== === In Linux, you can use ps auwx to find the zombie process a all w/tty, including other users all windows and terminals, including processes of other users u user-oriented for users (user friendly)-w, w ide output wide format output x processes w/o controlling ttys will mark ps axf to view the process tree behind the zombie process, and the ps axm will list the threads in a tree-shaped realistic process list, in linux, processes and threads are unified. They are two lightweight processes. Ps axu displays the detailed process status ============================================== ========== killall kill-15 kill-9 generally cannot kill the defunct process with kill-15, after kill-9, more zombie processes will be added, and kill-kill pid fuser-k pid can be considered as killing its parent process, kill-9 its parent process ====================================== =========== a terminated, however, a parent Process that has not processed it well (obtains information about the child Process and releases the resources it still occupies) is called a dead Process (Zombie Process ). Avoid zombie: 1) In SVR4, IF signal or sigset is called to set the SIGCHLD configuration to ignore, no dead child process will be generated. In addition, you can set the SA_NOCLDWAIT flag to prevent sub-processes from freezing. You can also use this function in Linux, and call this function signal (SIGCHLD, SIG_IGN) at the beginning of a program; 2) Call fork twice. The Program 8-5 implements this. 3) Use waitpid to wait for the sub-process to return. ========================================================== === zombie processes are zombie processes. First, use functions such as wait and waitpid to obtain the termination status of the process to release resources. The other is fork twice ============================================== ========= defunct process only has a record in the process table, other resources are not occupied. Unless the number of processes in your system exceeds the limit, zombie processes will not have more disadvantages. The only possible method is that the reboot system can eliminate the zombie process. ========================================================== === Any program is in zombie state, it occupies a bit of memory resources (that is, there is a record in the Process Table). It is just a representation and you don't have to be afraid. If there is a problem with the program, the simple and effective way to solve a large number of botnets is to restart. Kill is the way in which some processes in Unix run fork and zombie/defunct without any effect. When a process dies, it does not completely disappear. The process is terminated, and it does not run any more, but there are some residual things waiting for the parent process to be withdrawn. These residual things include the returned values of sub-processes and other things. When the parent process fork () is a sub-process, it must use wait () or waitpid () to wait for the sub-process to exit. It is this wait () action that makes the child process residue disappear. Naturally, there is an exception in addition to the above rules: the parent process can ignore SIGCLD soft interruptions without wait (). You can do this (in a system that supports it, such as Linux): main () {signal (SIGCLD, SIG_IGN);/* now I don't have to wait ()! */. Fork ();/* Rabbits, rabbits, rabbits! */} Now, when the child process dies, the parent process does not have wait (). Generally, you can see it as "" In ps. It will always remain this way until the parent process wait (), or as follows. This is another rule you must know: when the parent process dies before its wait () child process (assuming it does not ignore SIGCLD), the child process will put init (pid 1) process as its parent process. This is not a problem if the sub-process works well and can be controlled. However, if the sub-process is already defunct, we will have a little trouble. Look, the original parent process can no longer wait (), because it has vanished. In this way, how does init know the zombie processes such as wait. Answer: unpredictable. In some systems, init periodically destroys all of its defunct processes. In other systems, it simply rejects the parent processes of any defunct process, but immediately destroys them. If you use one of the above systems, you can write a simple loop and fill in the table with the defunct process that belongs to init. This probably won't make your system administrator very happy, right? Your task: Make sure that your parent process does not ignore SIGCLD or wait () It fork () all processes. However, you do not need to always do this (for example, you want to start a daemon or something else), but you must be careful with programming if you are a newbie to fork. In addition, do not be psychologically bound. Summary: The child process becomes defunct until the parent process wait (), unless the parent process ignores SIGCLD. Furthermore, the child process (active or defunct) of the parent process that does not have wait () disappears (assuming that the parent process does not ignore SIGCLD) becomes the child process of init, init processes them in a heavy way. Author: kongweile