Reading stderr from a linux device, after writing to it from c++ - c++

When i write to a linux driver / device, in this case i want to put the embedded linux device to sleep:
echo "mem" > /sys/power/state
I get an error on the terminal if the above command fails
[ 2593.061030] dpm_run_callback(): elan_touch_suspend+0x0/0x114 returns 1
[ 2593.067578] PM: Device 0-0015 failed to suspend: error 1
[ 2593.072994] PM: Some devices failed to suspend, or early wake event detected
[ 2593.107845] ==== calc_soc_by_voltageMethod E60U22 ====
And i do this the same in c++:
int fd2 = open("/sys/power/state", O_RDWR);
write(fd2, "mem", 3);
close(fd2);
If the above command fails, i get the same error on the terminal. now i want to get this error as a string in c++, in shell i can do something like this:
echo "mem" > /sys/power/state 2>/tmp/sleep_error
But i cant figure this out in c++, I need to to try one more time if it fails
What I tryied:
Capturing cerr of the whole program, with freopen doesn't work. When I write to the device from another terminal, and do cat /dev/stderr from another, i get the output in the second one, I tryied to use it:
char byte[1000];
int stderrdevice = open("/dev/stderr", O_RDONLY | O_NOCTTY);
int fd2 = open("/sys/power/state", O_RDWR);
write(fd2, "mem", 3);
close(fd2);
ssize_t size = read(stderrdevice, &byte, 1000);
printf("Read byte %s\n", byte);
This doesn't work too. Any resources, documentation related to this are welcome

Thanks everyone for help and responding. user17732522 and Nate Eldredge were right. What i was trying to get was the kernel ring buffer, that was printing out to the serial connection. The same thing was in dmesg. I ended up using klogctl to get the errors. I couldn't get only the last line of dmesg with other klogctl options, and the code is a bit chaotic, but here is what I finally used:
bool continueSleeping = true;
int count = 0;
while (continueSleeping == true) {
// https://linux.die.net/man/3/klogctl
klogctl(5, NULL, 0);
log("Trying sleep");
std::this_thread::sleep_for(std::chrono::milliseconds(100));
int fd2 = open("/sys/power/state", O_RDWR);
int status = write(fd2, "mem", 3);
close(fd2);
std::this_thread::sleep_for(std::chrono::milliseconds(500));
log("After sleep");
// get dmesg, and then only lines containing <3>
char *logs_data;
ssize_t len = klogctl(10, NULL, 0);
logs_data = (char *)malloc(len);
klogctl(3, logs_data, len);
vector<string> dmesgErrorsVec;
boost::split(dmesgErrorsVec, logs_data, boost::is_any_of("\n"),
boost::token_compress_on);
// to show whole dmesg
//log("dmesg: " + (string)logs_data);
free(logs_data);
string dmesgErrors;
for (string line : dmesgErrorsVec) {
if (line.find("<3>") != std::string::npos) {
// tesdt
dmesgErrors.append(line);
dmesgErrors.append("\n");
}
}
dmesgErrorsVec.clear();
if (status == -1 or
dmesgErrors.find("PM: Some devices failed to suspend") != std::string::npos) {
log("Failed to suspend, dmesg errors:\n" + dmesgErrors);
log("status: " + to_string(status));
CEG();
count = count + 1;
if (count == 5) {
log("5 failed attemts at suspending, sleep a little longer...");
smartWait(10000);
} else if (count == 15) {
log("15 failed attempts at sleeping...");
// Write to fbink here a sad message
} else {
smartWait(3000);
}
} else {
// Exiting this sleeping hell
log("Tryied going to sleep " + to_string(count) + "times");
continueSleeping = false;
}
}
log("Sleep finished, Exiting going to sleep");

Related

How to convert the system call to fork in C++ linux

This is the code for playing sound file in C++ linux code
string str1 = "aplay ";
str1 = str1 + " out.wav" + " & ";
const char *command = str1.c_str();
system(command);
** Entire code is available here : Playing sound C++ linux aplay : device or resource busy
I just want to know how to play this in a fork() as I read that system call is too taxing on cpu, which ofcourse is in my case.
Please help
fork will make a copy of your process, so you can easily write:
// fork the current process: beyond this point, you will have 2 process
int ret = fork();
if (ret == 0) {
// in child: execute the long command
system("aplay out.wav");
// exit the child process
exit(0);
}
// child process will not go here
if (ret < 0) {
perror("fork");
}
After, you should know that system will do for you fork + exec + wait. Since you don't want your parent process to wait the child, you can write:
// fork the current process: beyond this point, you will have 2 process
int ret = fork();
if (ret == 0) {
// in child: execute the long command
char program[] = "/usr/bin/aplay";
char *args[] = {"/usr/bin/aplay", "out.wav" };
ret = execv(program, args);
// this point will be reach only if `exec` fails
// so if we reach this point, we've got an error.
perror("execv");
exit(0);
}
// child process will not go here
if (ret < 0) {
perror("fork");
}

Program terminates, when master terminal is closed

In my program, when I was trying to close the master file descriptor, suddenly my program got crashed and I haven't seen any cores. Could someone help me with this? I am providing the code that I have used. This is the code I copied from the internet(http://www.rkoucha.fr/tech_corner/pty_pdip.html), The only difference is that instead of fork I spawn a thread. I know some small info I miss. Could someone please shed the light?
Thanks in advance!!!
int ScalingCommandReceiver::execute_ptcoi_commands_sequence(const char * bc_name, std::vector<cmd_output_pair>& cmd_seq, std::string& output_str)
{
int fdm, fds;
int rc;
output_str.clear();
fdm = posix_openpt(O_RDWR);
if (fdm < 0)
{
output_str.append("Error on posix_openpt() \n");
return -1;
}
rc = grantpt(fdm);
if (rc != 0)
{
output_str.append("Error on grantpt() \n");
close(fdm);
return -1;
}
rc = unlockpt(fdm);
if (rc != 0)
{
output_str.append("Error on unlockpt() \n");
close(fdm);
return -1;
}
// Open the slave side ot the PTY
fds = open(ptsname(fdm), O_RDWR);
if (fds < 0)
{
output_str.append("Error on posix_openpt() \n");
close(fdm);
return -1;
}
std::string cp_name ("bc3");
pt_session_struct *file_refs = NULL;
file_refs = (pt_session_struct*) ::malloc(sizeof(pt_session_struct));
if (file_refs == NULL) {
output_str.append("ERROR: Failed to create the struct info for the thread! \n");
close(fdm);
close(fds);
return -1;
}
file_refs->fds = fds;
file_refs->cp_name = (char*)bc_name;
//Spawn a thread
if (ACE_Thread::spawn(ptcoi_command_thread, file_refs, THR_DETACHED) < 0) {
output_str.append("ERROR: Failed to start ptcoi_command_thread thread! \n");
close(fdm);
close(fds);
::free(file_refs);
return -1;
}
int i = 0;
while (i <= cmd_seq_dim)
{
char buffer[4096] = {'\0'};
ssize_t bytes_read = 0;
int read_res = 0;
do
{
// get the output in buffer
if((read_res = read(fdm, (buffer + bytes_read), sizeof(buffer))) > 0)
{
// The number of bytes read is returned and the file position is advanced by this number.
// Let's advance also buffer position.
bytes_read += read_res;
}
}
while((read_res > 0) && !strchr(buffer, cpt_prompt) && (std::string(buffer).find(ptcoi_warning) == std::string::npos));
if (bytes_read > 0) // No error
{
// Send data on standard output or wherever you want
//Do some operations here
}
else
{
output_str.append("\nFailed to read from master PTY \n");
}
if(i < cmd_seq_dim)
{
// Send data on the master side of PTY
write(fdm, cmd_seq[i].first.c_str(), cmd_seq[i].first.length());
}
++i;
} // End while
if(/*have some internal condition*/)
{
close(fdm); //Here I observe the crash :-(
return 0; // OK
}
else
{
output_str.append ("\nCPT printouts not expected.\n");
close(fdm);
return -1; // Failure
}
close(fdm);
return 0; // OK
}
ACE_THR_FUNC_RETURN ScalingCommandReceiver::ptcoi_command_thread(void* ptrParam)
{
pt_session_struct* fd_list = (pt_session_struct*) ptrParam;
struct termios slave_orig_term_settings; // Saved terminal settings
struct termios new_term_settings; // Current terminal settings
int fds = fd_list->fds;
char* cp_name = fd_list->cp_name;
::free (fd_list);
// Save the defaults parameters of the slave side of the PTY
tcgetattr(fds, &slave_orig_term_settings);
// Set RAW mode on slave side of PTY
new_term_settings = slave_orig_term_settings;
cfmakeraw (&new_term_settings);
tcsetattr (fds, TCSANOW, &new_term_settings);
int stdinCopy, stdoutCopy, stdErr;
stdinCopy = dup (0);
stdoutCopy = dup (1);
stdErr = dup (2);
// The slave side of the PTY becomes the standard input and outputs of the child process
close(0); // Close standard input (current terminal)
close(1); // Close standard output (current terminal)
close(2); // Close standard error (current terminal)
dup(fds); // PTY becomes standard output (0)
dup(fds); // PTY becomes standard output (1)
dup(fds); // PTY becomes standard error (2)
// Now the original file descriptor is useless
close(fds);
// Make the current process a new session leader
//setsid();
// As the child is a session leader, set the controlling terminal to be the slave side of the PTY
// (Mandatory for programs like the shell to make them manage correctly their outputs)
ioctl(0, TIOCSCTTY, 1);
// Execution of the program
char PTCOI [64] = {0};
snprintf(PTCOI, sizeof(PTCOI), "/opt/ap/mas/bin/mas_cptaspmml PTCOI -cp %s -echo 7", cp_name);
system(PTCOI); //my command
close(0); // Close standard input (current terminal)
close(1); // Close standard output (current terminal)
close(2); // Close standard error (current terminal)
dup2 (stdinCopy, 0);
dup2 (stdoutCopy, 1);
dup2 (stdErr, 2);
close (stdinCopy);
close (stdoutCopy);
close (stdErr);
return 0;
}
execute_ptcoi_commands_sequence seems to contain steps necessary to daemonize your process:
// The slave side of the PTY becomes the standard input and outputs of the child process
close(0); // Close standard input (current terminal)
close(1); // Close standard output (current terminal)
close(2); // Close standard error (current terminal)
. . .
Which means the fork and setsid were there to detach from the controlling terminal, so that your process can survive beyond your terminal session.
After you removed the fork your process remains associated with the controlling terminal and probably terminates when the terminal sends a SIGHUP on close.

Linux write to serial port in c++ returns bad file descriptor

I am writing a c++ program to send a receive data from a device located at /dev/ttyACM0. I am able to read from the device without a problem, I can write to it from the command line, but I can not write to it within my c++ program. Here is what I have so far:
#include "SerialComms.h"
#include <errno.h>
#include <string.h>
SerialComms::SerialComms() {
serial_filestream = -1;
//CONFIGURE THE PORT
//The flags (defined in /usr/include/termios.h - see http://pubs.opengroup.org/onlinepubs/007908799/xsh/termios.h.html):
// Baud rate:- B1200, B2400, B4800, B9600, B19200, B38400, B57600, B115200, B230400, B460800, B500000, B576000, B921600, B1000000, B1152000, B1500000, B2000000, B2500000, B3000000, B3500000, B4000000
// CSIZE:- CS5, CS6, CS7, CS8
// CLOCAL - Ignore modem status lines
// CREAD - Enable receiver
// IGNPAR = Ignore characters with parity errors
// ICRNL - Map CR to NL on input
// PARENB - Parity enable
// PARODD - Odd parity (else even)
tcgetattr(serial_filestream, &options);
options.c_cflag = B9600 | CS8 | CLOCAL | CREAD; //<Set baud rate
options.c_iflag = IGNPAR;
options.c_oflag = 0;
options.c_lflag = 0;
}
bool SerialComms::Init(string type){
//The flags (defined in fcntl.h):
// Access modes (use 1 of these):
// O_RDONLY - Open for reading only.
// O_RDWR - Open for reading and writing.
// O_WRONLY - Open for writing only.
//
// O_NDELAY / O_NONBLOCK (same function) - Enables nonblocking mode. When set read requests on the file can return immediately with a failure status
// if there is no input immediately available (instead of blocking). Likewise, write requests can also return
// immediately with a failure status if the output can't be written immediately.
//
// O_NOCTTY - When set and path identifies a terminal device, open() shall not cause the terminal device to become the controlling terminal for the process.
if (type == "USB"){ //if type equals USB, open USB
serial_filestream = open(USBSerial, O_RDWR | O_NOCTTY | O_NDELAY); //Open in non blocking read/write mode
}else if (type == "UART1"){
serial_filestream = open(UART1, O_RDWR | O_NOCTTY | O_NDELAY); //Open in non blocking read/write mode
}
if (serial_filestream == -1)
{
//ERROR - CAN'T OPEN SERIAL PORT
printf("Error - Unable to open: %s\n", type.c_str());
}else{
printf("Opened serial type: %s\n", type.c_str());
}
tcflush(serial_filestream, TCIFLUSH);
tcsetattr(serial_filestream, TCSANOW, &options);
printf("Serial Comms for type: %s intialized", type.c_str());
return 1;
}
bool SerialComms::Ping(){
WriteSerial("p,1,1;\n");
return true;
}
char* SerialComms::ReadSerial(){
if (serial_filestream != -1)
{
// Read up to 255 characters from the port if they are there
char rx_buffer[256];
int rx_length = read(serial_filestream, (void*)rx_buffer, 255); //Filestream, buffer to store in, number of bytes to read (max)
if (rx_length < 0)
{
//An error occured (will occur if there are no bytes)
}
else if (rx_length == 0)
{
//No data waiting
}
else
{
//Bytes received
rx_buffer[rx_length] = '\0';
int j = 0;
while (rx_buffer[j] != ';' && rx_buffer[j] != '\0' && rx_buffer[j] != '\n'){
j++;
}
char rx_return[j+1];
for(int i = 0; i < j+1; i++){
rx_return[i] = rx_buffer[i];
}
rx_return[j+1] = '\0';
return rx_return;
}
}
return '\0';
}
bool SerialComms::WriteSerial(string data_out){
const char * tx_buffer = data_out.c_str();
if (serial_filestream != -1)
{
int wr = write(serial_filestream, tx_buffer, strlen(tx_buffer));
if (wr < 0){
printf("Error writing to Serial: %s \n", strerror(errno));
return 0;
} else{
printf("WroteSerial: %s, %d \n", tx_buffer, strlen(tx_buffer));
return 1;
}
}else{
printf("Error writing to Serial filestream errors \n");
return 0;
}
return 1;
}
SerialComms::~SerialComms() {
close(serial_filestream);
}
If I use the command:
echo "p,1,1;\n" > /dev/ttyACM0
It works without a problem, and I receive back the expected data from the serial device.
However, my main loop in the c++ program calls the WriteSerial function once a minute like so:
void Ping(SerialComms serialLine){
serialLine.WriteSerial("p,1,1;\n");
printf("pinged at: %s \n", ctime(&now));
}
The first time the write is performed it doesn't give an error, but it doesn't seem to work, and the second write returns a bad file descriptor error. Also, it screws up reading from the port as well. Here is my program output:
WroteSerial: p,1,1;
, 7
pinged at: Wed Dec 30 19:08:05 2015
Error writing to Serial: Bad file descriptor
pinged at: Wed Dec 30 19:09:06 2015
I'm really not sure where to go from here so any suggestion would be appreciated. I'm pretty sure I'm missing something basic but I can't see it at the moment.

Detect USB hardware keylogger

I need to determine is there hardware keylogger that was plugged to PC with USB keyboard. It needs to be done via software method, from user-land. However wiki says that it is impossible to detect HKL using soft, there are several methods exists. The best and I think only one overiew that present in net relating that theme is "Detecting Hardware Keyloggers, by Fabian Mihailowitsch - youtube".
Using this overview I am developing a tool to detect USB hardware keyloggers. The sources for detecting PS/2 keyloggers was already shared by author and available here. So my task is to make it worked for USB only.
As suggested I am using libusb library to interfere with USB devices in system.
So, there are methods I had choosen in order to detect HKL:
Find USB keyboard that bugged by HKL. Note that HKL is usually
invisible from device list in system or returned by libusb.
Detect Keyghost HKL by: Interrupt read from USB HID device, send usb reset (libusb_reset_device), read interrupt again. If data returned on last read is not nulls then keylogger detected. It is described on page 45 of Mihailowitsch's presentation
Time measurement. The idea is measure time of send/receive packets using control transfer for original keyboard for thousands times. In case HKL has been plugged, program will measure time again and then compare the time with the original value. For HKL it have to be much(or not so much) greater.
Algorithm is:
Send an output report to Keyboard(as Control transfer) (HID_REPORT_TYPE_OUTPUT 0x02 )
Wait for ACKed packet
Repeat Loop (10.000 times)
Measure time
Below is my code according to steps of detection.
1. Find USB keyboard
libusb_device * UsbKeyboard::GetSpecifiedDevice(PredicateType pred)
{
if (_usbDevices == nullptr) return nullptr;
int i = 0;
libusb_device *dev = nullptr;
while ((dev = _usbDevices[i++]) != NULL)
{
struct libusb_device_descriptor desc;
int r = libusb_get_device_descriptor(dev, &desc);
if (r >= 0)
{
if (pred(desc))
return dev;
}
}
return nullptr;
}
libusb_device * UsbKeyboard::FindKeyboard()
{
return GetSpecifiedDevice([&](libusb_device_descriptor &desc) {
bool isKeyboard = false;
auto dev_handle = libusb_open_device_with_vid_pid(_context, desc.idVendor, desc.idProduct);
if (dev_handle != nullptr)
{
unsigned char buf[255] = "";
// product description contains 'Keyboard', usually string is 'USB Keyboard'
if (libusb_get_string_descriptor_ascii(dev_handle, desc.iProduct, buf, sizeof(buf)) >= 0)
isKeyboard = strstr((char*)buf, "Keyboard") != nullptr;
libusb_close(dev_handle);
}
return isKeyboard;
});
}
Here we're iterating through all USB devices in system and checks their Product string. In my system this string for keyboard is 'USB keyboard' (obviously).
Is it stable way to detect keyboard through Product string? Is there other ways?
2. Detect Keyghost HKL using Interrupt read
int UsbKeyboard::DetectKeyghost(libusb_device *kbdev)
{
int r, i;
int transferred;
unsigned char answer[PACKET_INT_LEN];
unsigned char question[PACKET_INT_LEN];
for (i = 0; i < PACKET_INT_LEN; i++) question[i] = 0x40 + i;
libusb_device_handle *devh = nullptr;
if ((r = libusb_open(kbdev, &devh)) < 0)
{
ShowError("Error open device", r);
return r;
}
r = libusb_set_configuration(devh, 1);
if (r < 0)
{
ShowError("libusb_set_configuration error ", r);
goto out;
}
printf("Successfully set usb configuration 1\n");
r = libusb_claim_interface(devh, 0);
if (r < 0)
{
ShowError("libusb_claim_interface error ", r);
goto out;
}
r = libusb_interrupt_transfer(devh, 0x81 , answer, PACKET_INT_LEN,
&transferred, TIMEOUT);
if (r < 0)
{
ShowError("Interrupt read error ", r);
goto out;
}
if (transferred < PACKET_INT_LEN)
{
ShowError("Interrupt transfer short read %", r);
goto out;
}
for (i = 0; i < PACKET_INT_LEN; i++) {
if (i % 8 == 0)
printf("\n");
printf("%02x, %02x; ", question[i], answer[i]);
}
printf("\n");
out:
libusb_close(devh);
return 0;
}
I've got such error on libusb_interrupt_transfer:
libusb: error [hid_submit_bulk_transfer] HID transfer failed: [5] Access denied
Interrupt read error - Input/Output Error (LIBUSB_ERROR_IO) (GetLastError() - 1168)
No clue why 'access denied', then IO error, and GetLastError() returns 1168, which means - Element not found (What element?). Looking for help here.
Time measurement. Send output report and wait for ACK packet.
int UsbKeyboard::SendOutputReport(libusb_device *kbdev)
{
const int PACKET_INT_LEN = 1;
int r, i;
unsigned char answer[PACKET_INT_LEN];
unsigned char question[PACKET_INT_LEN];
for (i = 0; i < PACKET_INT_LEN; i++) question[i] = 0x30 + i;
for (i = 1; i < PACKET_INT_LEN; i++) answer[i] = 0;
libusb_device_handle *devh = nullptr;
if ((r = libusb_open(kbdev, &devh)) < 0)
{
ShowError("Error open device", r);
return r;
}
r = libusb_set_configuration(devh, 1);
if (r < 0)
{
ShowError("libusb_set_configuration error ", r);
goto out;
}
printf("Successfully set usb configuration 1\n");
r = libusb_claim_interface(devh, 0);
if (r < 0)
{
ShowError("libusb_claim_interface error ", r);
goto out;
}
printf("Successfully claim interface\n");
r = libusb_control_transfer(devh, CTRL_OUT, HID_SET_REPORT, (HID_REPORT_TYPE_OUTPUT << 8) | 0x00, 0, question, PACKET_INT_LEN, TIMEOUT);
if (r < 0) {
ShowError("Control Out error ", r);
goto out;
}
r = libusb_control_transfer(devh, CTRL_IN, HID_GET_REPORT, (HID_REPORT_TYPE_INPUT << 8) | 0x00, 0, answer, PACKET_INT_LEN, TIMEOUT);
if (r < 0) {
ShowError("Control In error ", r);
goto out;
}
out:
libusb_close(devh);
return 0;
}
Error the same as for read interrupt:
Control Out error - Input/Output Error (LIBUSB_ERROR_IO) (GetLastError() - 1168
)
How to fix please? Also how to wait for ACK packet?
Thank you.
UPDATE:
I've spent a day on searching and debbuging. So currently my problem is only to
send Output report via libusb_control_transfer. The 2nd method with interrupt read is unnecessary to implement because of Windows denies access to read from USB device using ReadFile.
It is only libusb stuff left, here is the code I wanted to make work (from 3rd example):
// sending Output report (LED)
// ...
unsigned char buf[65];
buf[0] = 1; // First byte is report number
buf[1] = 0x80;
r = libusb_control_transfer(devh, CTRL_OUT,
HID_SET_REPORT/*0x9*/, (HID_REPORT_TYPE_OUTPUT/*0x2*/ << 8) | 0x00,
0, buf, (uint16_t)2, 1000);
...
The error I've got:
[ 0.309018] [00001c0c] libusb: debug [_hid_set_report] Failed to Write HID Output Report: [1] Incorrect function
Control Out error - Input/Output Error (LIBUSB_ERROR_IO) (GetLastError() - 1168)
This error occures right after DeviceIoControl call in libusb internals.
What means "Incorrect function" there?

Chain of fork() output

I'm totally newbie in Unix environment and i faced some problems with plain example from Unix Systems Programming book by Robbins.
It's plain chain of processes and each process prints some info to log file and stderr
#define BUFSIZE 1024
#define CREATE_FLAGS (O_WRONLY | O_CREAT | O_APPEND)
#define CREATE_PERMS (S_IRUSR | S_IWUSR| S_IRGRP | S_IROTH)
int main (int argc, char *argv[]) {
char buf[BUFSIZE];
pid_t childpid = 0;
int i, n;
if (argc != 3){ /* check for valid number of command-line arguments */
fprintf (stderr, "Usage: %s processes filename\n", argv[0]);
return 1;
}
/* open the log file before the fork */
n = atoi(argv[1]); /* create a process chain */
for (i = 1; i < n; i++)
if (childpid = fork())
break;
if (childpid == -1) {
fprintf(stderr, "Failed to fork");
return 1;
}
auto fd = open(argv[2], CREATE_FLAGS, CREATE_PERMS);
if (fd < 0) {
fprintf(stderr,"Failed to open file");
return 1;
}
sprintf(buf, "i:%d process:%ld parent:%ld child:%ld\n",
i, (long)getpid(), (long)getppid(), (long)childpid);
fprintf(stderr, buf);
write(fd, buf, strlen(buf));
return 0;
}
It's compiled on Netbeans 7.1 with g++ 4.7 and run command is "${OUTPUT_PATH}" 10 /home/maxim/testlog.log
So the problems are:
When i run or debug project it prints out only 2 or 3 lines of info in both console and file. But if i traverse with "Step Over" through childpid = fork(), it prints info about all 10 processes. Is that some compiler optimization or just my fault?
Even when it prints all lines, the output looks like
i:2 process:6571 parent:6566 child:6572
i:3 process:6572 parent:1 child:6573
i:4 process:6573 parent:6572 child:6574
...
i:9 process:6578 parent:1 child:6579
i:10 process:6579 parent:6578 child:0
Parent pid values for some processes are 1, which seems to be wrong
If the processes each open the same output file there will be a race condition causing the processes to overwrite each other. That is why it only happens when you run at full speed.
When the parent process ends any children that are still alive are either killed or get a new parent depending on a setting in Linux. In your case they seem to get a new parent. That new parent is process 1.