I am interested in the anti-debugging method implemented in the crackme called trace-p. A child process is forked, which communicates with the parent using int3 instructions. I would like to debug the child. gdb has set follow-fork-mode, however gdb does not recognize the file as executable (probably because of deleted sections related information). With radare2 I can disassemble and even debug, but I do not know how to follow the child after the fork takes place. I want to do this because the child contains instructions like:0x0804898a    jmp dword [edx*4 + 0x8049334]I want to stop there and examining edx, in order to see where the jump takes.I am interested in any tool or method which is able to debug the child process.
Debugging forked child in an anti-debug protected crackme
linux;anti debugging;radare2;crackme