Patent ID: 9552224
Date: 2017-01-24
CPC Classifications: G06F

Claim:
1. A method of capturing a state of a target program that is running within an environment of an operating system, comprising the steps of: identifying, by one or more processors, threads associated with the target program; suspending, by the one or more processors, threads associated with the target program; preserving, by the one or more processors, data characterising the threads; preserving, by the one or more processors, data accessible by the threads when in operation; detecting whether a thread has been suspended in a kernel mode due to a call to a first function implemented in the kernel mode; replacing an instruction immediately after the call to the first function in the suspended thread with a breakpoint, the breakpoint operating outside the kernel mode; and substituting the first function implemented in the kernel mode with a function that in turn is operable to implement a loop outside the kernel mode, and from within the loop call the first function to operate for a limited period of time.