TGViewer
ReverseEngineering ReverseEngineering @reverseengine · 1.34K subscribers
Post #1734 52
ReverseEngineering exit وقتی یک Process کارش تموم میشه چه اتفاقی میوفته تا اینجا با fork و exec و wait و حتی Zombie Process آشنا شدیم حالا فرض کنید یه Process داریم که کارش رو انجام داده و دیگه کاری برای انجام دادن نداره مثلا یه برنامه خیلی ساده داریم: int main() { …
exit

What happens when a Process finishes its work

So far we have been introduced to fork, exec, wait and even Zombie Process

Now suppose we have a Process that has done its work and has nothing more to do

For example, we have a very simple program:

int main() {
printf("Hello");
return 0;
}


When main finishes, the program must also tell the operating system that

My work is finished

This is where the concept of exit comes into play

What exactly does exit do

To put it simply,

exit
tells the operating system that this Process has nothing more to do and wants to finish its execution

For example:

exit(0);

That number 0 usually means that the program has completed successfully

That is

exit(0)
↓
Successful execution

But if we give a non-zero value, it usually means that another situation has occurred

For example, an error

Of course, the exact meaning of that number is determined by the program itself

So the Kernel is not supposed to understand what exactly the number 1 means

This number is more of an information that the Process gives to the Parent

What happens after exit

Here we have an important point

When the Process reaches exit, it is no longer supposed to continue the normal program commands

That means the program execution is finished

But the Kernel still has to do a few things

For example, the resources that the Process used must be managed

Such as:

Memory

File Descriptor

I O resources

And information about the Process itself

But a very important point

Not everything is finished right away

This is where the Zombie Process enters the story again

Suppose we have this situation

Parent
│
└──── Child
│
▼
exit()
│
▼
Child execution is finished
│
▼
Zombie

Child is no longer running

CPU
does not give it CPU Time to run the program

But some information about its termination is still kept by the Kernel

Why

Because Parent needs to be able to understand how Child terminated

For example, what was its Exit Status

Then Parent comes and waits

Child
│
▼
exit()
│
▼
Zombie
│
▼
Parent calls wait()
│
▼
Exit Status is received
│
▼
Reaping
│
▼
Zombie is destroyed

We call this last step

Reaping

That is, Parent gets the termination status of Child and Kernel no longer needs the remaining information about that Child

So remember one very important point

Termination is not the same as Reaping

Termination

That is, Process is no longer running

Reaping

That is, Parent gets the termination status of Process and the remaining information about That Process is collected from Process Management Structures

This difference is exactly why Zombie Process exists

What is Exit Status

When a Process terminates, it can have a value as its exit status

For example

exit(0);




Exit Status = 0


or

exit(1);


That is

Exit Status = 1


In Unix and Linux, it is usually 0, meaning everything is fine

And non-zero values ​​are usually used for other states

Parent
can get this value with wait or waitpid

Now let's put the whole story together

So far, we have learned some important parts of the Process cycle

Parent
│
fork()
│
▼
Child
│
exec()
│
▼
New Program
│
exit()
│
▼
Zombie
│
wait()
│
▼
Reaped

That is, first Parent creates a Child

Then Child can execute a new Program with exec

Program does its job

Then exits

Process is no longer running

It may become Zombie for a short time

Then Parent gets its state with wait

And finally Child Reaps

Now an important question

Does exit mean that Process is deleted from everywhere at once?

No

This is one of those places where the operating system is a little more complicated than it seems at first glance

When a process terminates

it no longer runs

but the kernel may retain a limited amount of information about it

The most important reason is that the parent needs to be able to understand the termination status of the child

so don't mix the two

Termination
↓
Process no longer runs

Reaping
↓
Parent
gets the state of the process
↓
Remaining information is collected

Another point about resources
More from @reverseengine
  1. Oct 15, 2026Reverse Engineer Anything v6.5.0 A tool for reverse engineering that allows AI agents to a…
  2. Oct 15, 2026Someone Used AI to Reverse-Engineer PS5 Security in Weeks: What Is REA? https://pub.toward…
  3. Oct 15, 2026How Dangerous Is REA (Reverse Engineer Anything) for Your App? https://21zerixpm.medium.co…
  4. Oct 15, 2026REA Is Impressive. But Reverse Engineering Was Never the New Part https://crizantlai.mediu…
  5. Oct 15, 2026QuarkslaB Dynamic binary Instrumentation https://qbdi.quarkslab.com/introduction @reversee…
  6. Oct 15, 2026angr’s documentation https://docs.angr.io/en/latest/search.html?q=Document&check_keywords=…
Threads Profile ViewerView any public Threads profile without an account.Open ThreadLook →Writing with AI? Make it sound human.Metric37 rewrites AI drafts so they read naturally. Free AI detector, 1,500 words free.Try Metric37 →