Orphan and botnets [2]

 

In a UNIX system, a child process is finished, but its parent process is not waiting (wait/waitpid is called), then the child process will become a zombie process. However, if the parent process of the process has ended, the process will not become a zombie process, because at the end of each process, the system will scan all processes running in the current system, check whether a process is a child process of the process that has just ended. If yes, it will be taken over by Init (process number 1) to become its parent process, this process is called an orphan process, and its status collection is the responsibility of the init process.

 

The following is an example of a zombie process. In this program, the parent process exits but does not process the child process. Then, the parent process calls the system function to list the information of the current foreground process. The source code is as follows:

 

 

# Include <unistd. h>

# Include <stdio. h>

# Include <stdlib. h>

Main ()

{

Pid_t pid;

If (pid = fork) =-1)

Perror ("fork ");

Else if (pid = 0 ){

Printf ("child_pid pid = % d, ppid = % d \ n", getpid (); // print the pid

Exit (0 );

}

Sleep (3 );

System ("ps ");

Exit (0)

}

The compilation and running result of the above program is:

Child_pid pid = 1108

PID TTY TIME CMD

847 pts/1 00:00:00 bash

1107 pts/1 00:00:00 a. out

1108 pts/1 00:00:00 a. out <defunct>

1109 pts/1 00:00:00 ps from the new column