FUNCTION EVALUATION USING LIGHTWEIGHT PROCESS SNAPSHOTS

摘要

A debugger creates a lightweight process snapshot of a debuggee target process and performs in-process or function evaluation (func-eval) inspection against the copy. This allows most state in the debuggee process to stay intact because changes made by the func-eval are local to the process snapshot. Debugger operations that are too destructive to the original debuggee process can be performed on the process snapshot without threatening the real process. Process snapshots allow the debugger to perform a func-eval while isolating the debuggee process and not losing the actual state of the original debuggee process. A new process snapshot of the debuggee process is created when the current snapshot is corrupt due to a func-eval side effect. The debugger may also use a lightweight machine snapshot of the host debuggee machine and perform func-evals against that machine snapshot to further isolate kernel and other side effects.