How would I go about taking a snapshot of a process to preserve its state for future investigation? Is this possible?

Question

Whether this is possible I don't know, but it would mighty useful!

I have a process that fails periodically (running in Windows 2000). I then have just one chance to react to it before having to restart it and painfully wait for it to fail again. I didn't write the process so don't have the source to debug. The failure is seemingly random.

With a snapshot of the process I could repeatedly and quickly test reactions to the failure.

I had thought of running inside a VM but this isn't possible in this instance.

EDIT: @Jon Cage asked:

When you say a snapshot, you mean capturing a process when it's about to fail (including memory, program state etc. etc.) ...and then replaying it's final few seconds repeatedly to see what effect it has on some other component?

This is exactly what I mean!

Answer 1

My best bet is to start the process in a debugger (OllyDbg being my preferred tool). The process will pause on an exception, and you can try to figure out what happened shortly before that.

This needs some understanding of assembler and does not allow to create a snapshot of the process for later analysis. You would need to write your own debugger for that - it should be theoretically possible.

Answer 2

Does this process write any data to event logs of OS in case it fails or succeeds ?

Answer 3

I think minidump is what you are looking for.

You can also used Userdump:

The User Mode Process Dumper (userdump) dumps any running Win32 processes memory image (including system processes such as csrss.exe, winlogon.exe, services.exe, etc) on the fly, without attaching a debugger, or terminating target processes. Generated dump file can be analyzed or debugged by using the standard debugging tools.

This article shows you how to use it.

Answer 4

What are you trying to capture? UDP/TCP messages? Some inter-process communication?

The reason I ask is that it is probably easier to capture what the software is outputting (rather than the process itself) and then writing a new process to simulate those same interactions? I've being doing just that with a small python script in some of my current projects...