Process reflection
First Claim
Patent Images
1. One or more computer-readable storage devices storing instructions which, when executed, cause a computing device to:
- detect an event to trigger reflection of a target process;
create a reflected process of the target process by at least copying a virtual address space associated with the target process to collect data defining the target process and transfer the data to the reflected process; and
analyze the reflected process while execution of the target process continues.
2 Assignments
0 Petitions
Accused Products
Abstract
Process reflection techniques are described in which a reflected process is created to facilitate analysis of a process. Events are detected to initiate reflection of a target process. Process reflection of a target process may be initiated by an external process or by the target process itself. A reflected process of the target process is created. In an implementation, data defining the target process is replicated, copied, or otherwise collected from the target process to create the reflected process. Then, analysis may be performed on the reflected process while execution of the target process continues.
116 Citations
18 Claims
-
1. One or more computer-readable storage devices storing instructions which, when executed, cause a computing device to:
-
detect an event to trigger reflection of a target process; create a reflected process of the target process by at least copying a virtual address space associated with the target process to collect data defining the target process and transfer the data to the reflected process; and analyze the reflected process while execution of the target process continues. - View Dependent Claims (2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12)
-
-
13. A method comprising:
-
detecting an event to initiate process reflection of a target process; collecting data to define the target process by at least copying a virtual address space associated with the target process; and communicating the collected data to an application programming interface to create a reflected process according to the collected data. - View Dependent Claims (14, 15)
-
-
16. A method comprising:
-
initiating by a target process a reflection of the target process; allocating a parameter block in memory of the target process; populating parameters in the parameter block with data describing the target process wherein populating the parameters includes designating one or more handles as inheritable and copying the one or more handles to the parameters to share with the reflected process; and calling an application programming interface with the parameters to cause an operating system to create a reflected process according to the parameters. - View Dependent Claims (17, 18)
-
Specification