Abstract:
A debugging and diagnostics system allows users to take lightweight process snapshots of running debuggee processes so the users may analyze those snapshots at a later time. The snapshot mechanism allows diagnostic tools to compare an original process or one or more process snapshots or to compare any of a series of snapshots to each other. The snapshot mechanism further allows users to inspect a snapshot of process memory while allowing the original process to continue running with minimal impact. A user may do historical debugging using process snapshots of a debuggee process taken over time. This allows the user to view the state of the debuggee process as it existed when the snapshot was taken. The lightweight process snapshot is less invasive because it does not require a full copy of the memory and allows the original process to run un-interrupted while specific collections and inspections are completed.
Abstract:
A debugger creates a lightweight process snapshot of a debuggee target process and performs in-process or function evaluation (func-eval) inspection against the copy. This allows most state in the debuggee process to stay intact because changes made by the func-eval are local to the process snapshot. Debugger operations that are too destructive to the original debuggee process can be performed on the process snapshot without threatening the real process. Process snapshots allow the debugger to perform a func-eval while isolating the debuggee process and not losing the actual state of the original debuggee process. A new process snapshot of the debuggee process is created when the current snapshot is corrupt due to a func-eval side effect. The debugger may also use a lightweight machine snapshot of the host debuggee machine and perform func-evals against that machine snapshot to further isolate kernel and other side effects.