Orphan and botnets [1]

 

In a UNIX system, a child process is finished, but its parent process is not waiting (wait/waitpid is called), then the child process will become a zombie process. However, if the parent process of the process has ended, the process will not become a zombie process, because at the end of each process, the system will scan all processes running in the current system, check whether a process is a child process of the process that has just ended. If yes, it will be taken over by Init (process number 1) to become its parent process, this process is called an orphan process, and its status collection is the responsibility of the init process.

 

The following is an example program of an orphan process. In this program, let the parent process exit first, and then the child process prints its parent process number again:

 

 

View plain

# Include <unistd. h>

# Include <stdio. h>

# Include <stdlib. h>

Main ()

{

Pid_t pid;

If (pid = fork) =-1)

Perror ("fork ");

Else if (pid = 0 ){

Printf ("pid = % d, ppid = % d \ n", getpid (), getppid (); // print pid, ppid

Sleep (2); // sleep to let the parent process quit first

Printf ("pid = % d, ppid = % d \ n", getpid (), getppid (); // print pid, ppid

}

Else exit (0 );

}

 

 

Note: The getpid function can obtain the pid of the current process, And the getppid function can obtain the parent process Number of the current process.

 

 

 

The output after the above programs are compiled and run is:

 

Pid = 1091, ppid = 1090

Pid = 1091, ppid = 1.

We can see that the sub-process 1091 was later taken over by the init process (pid = 1 ).

 

From the new column