Patent ID: 11960406
Assignee: MICROSOFT TECHNOLOGY LICENSING, LLC
Field: Computer technology (Electrical engineering)
Classification: CPC G | IPC G

Claim 16:
17. The method of claim 16, wherein determining that the memory values corresponding to the particular range of memory addresses within the memory space for the process can be reconstructed or predicted separately from logging memory accesses by instructions that execute as part of the process comprises at least one of:
determining that the particular range of memory addresses maps to data of a file;
determining that the particular range of memory addresses corresponds to a memory-mapped device having a known behavioral pattern;
determining that the particular range of memory addresses stores a result of a software routine having a known behavioral pattern;
determining that the particular range of memory addresses corresponds to at least one of a binary import table or a binary export table;
determining that the particular range of memory addresses corresponds to a memory page stored in a memory page file or partition;
determining that the particular range of memory addresses corresponds to data that is separately log-able; or
determining that the particular range of memory addresses corresponds to data that can be reconstructed through replay of traced executable instructions.