Patent ID: 8832684

Claim:
A method for achieving atomicity while inspecting a running computer process, comprising: initializing an atomic runtime inspection process; implementing, based at least in part on the atomic runtime inspection process, a copy-on-write (CoW) process on memory of a target including both kernel memory and all corresponding user space of the target, the CoW process being implemented in a supervisor to generate a copy of a target's memory page being written to, prior to executing a write, the copy along with any unwritten to memory pages in the target being used to reflect the state of the target at a particular moment in time which state when observed by a measurement agent (MA) provides an atomic runtime inspection, and the copy being generated in memory of the MA; and freeing the copy and scrubbing contents of the copy from memory of the MA based at least in part on termination of the atomic runtime inspection process, wherein the supervisor maps the copy of the target's memory page and any unwritten to memory pages to the MA, and wherein the implementing the CoW process further comprises, in response to a page fault that is a write fault on the copy, reverting a read/write flag of the copy to a state of the read/write flag prior to the initializing and updating a mapping of the target's memory page at the MA to point to the copy.