Process Reflection

• US 20090327815A1
• Filed: 06/25/2008
• Published: 12/31/2009
• Est. Priority Date: 06/25/2008
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Schmelcher, Tristan P.K., Khambatti, Mujtaba S., Morrison, Jonathan D., Sridharan, Baskar, Lorelli, Anthony J., Heddaya, Abdelsalam A.
• Granted Patent: US 7,908,521 B2
• Time in Patent Office: Days
• US Class Current: 714/38.11
• CPC Class Codes: G06F 11/0715 in a system implementing multitasking multitasking per se G06F9/46
• CPC Class Codes: G06F 11/0766 Error or fault reporting or storing
• CPC Class Codes: G06F 11/366 using diagnostics G06F11/0703 takes precedence

Abstract

Process reflection techniques are described in which a reflected process is created to facilitate analysis of a process. Events are detected to initiate reflection of a target process. Process reflection of a target process may be initiated by an external process or by the target process itself. A reflected process of the target process is created. In an implementation, data defining the target process is replicated, copied, or otherwise collected from the target process to create the reflected process. Then, analysis may be performed on the reflected process while execution of the target process continues.

Claims

1. One or more computer-readable media storing instructions which, when executed, cause a computing device to:

detect an event to trigger reflection of a target process;

create a reflected process of the target process; and

analyze the reflected process while execution of the target process continues.

2. One or more computer-readable media as recited in claim 1, wherein the reflected process is initiated through injection of a thread into the target process by a monitor process that is separate from the target process.

3. One or more computer-readable media as recited in claim 1, wherein the reflected process is initiated by the target process.

4. One or more computer-readable media as recited in claim 1, wherein creating the reflected process further comprises including an executable thread in the reflected process configured to execute code within the reflected process.

5. One or more computer-readable media as recited in claim 1, wherein the reflected process is independent of the target process from which the reflected process is derived.

6. One or more computer-readable media as recited in claim 1, wherein creating the reflected process further comprises:

collecting data to define the target process; and

calling an application programming interface (API) with the collected data to cause creation of the reflected process through functionality integrated with an operating system.

7. One or more computer-readable media as recited in claim 1, wherein to analyze includes online diagnosis of the reflected process.

8. One or more computer-readable media as recited in claim 1, wherein to analyze includes debugging of test code using the reflected process to collect data regarding code errors.

9. One or more computer-readable media as recited in claim 1, wherein to analyze includes creating a process dump from the reflected process.

10. One or more computer-readable media as recited in claim 1, wherein to analyze includes online process recovery using the reflected process to obtain recovered data.

11. One or more computer-readable media as recited in claim 1, wherein to analyze include scanning of the reflected process to detect memory leaks caused by the target process.

12. One or more computer-readable media as recited in claim 1, wherein to analyze includes process migration of the target process through the reflected process from one computing device to another computing device.

13. A method comprising:

detecting an event to initiate process reflection of a target process;

collecting data to define the target process; and

communicating the collected data to an application programming interface to create a reflected process according to the collected data.

14. A method as recited in claim 13, wherein collecting data to define the target process includes copying a virtual address space associated with the target process.

15. A method as recited in claim 13, wherein collecting data to define the target process includes:

allocating memory in the target process;

loading parameters to enable the process reflection to the allocated memory;

injecting a thread into the target process;

in the injected thread, populating the parameters with data that defines the target process; and

copying the allocated memory including the populated parameters.

16. A method as recited in claim 13, wherein the detecting is performed by a monitor process separate from the target process.

17. A method comprising:

initiating by a target process a reflection of the target process;

allocating a parameter block in memory of the target process;

populating parameters in the parameter block with data describing the target process; and

calling an application programming interface with the parameters to cause an operating system to create a reflected process according to the parameters.

18. A method as recited in claim 17, further comprising performing analysis on the reflected process to troubleshoot the target process while execution of the target process continues.

19. A method as recited in claim 18, further comprising copying a virtual address space associated with the target process to collect the data defining the target process.

20. A method as recited in claim 19, wherein populating parameters in the parameter block with data describing the target process includes designating one or more handles as inheritable and copying the one or more handles to the parameters to share with the reflected process.