Full state session reviving, forking, and snapshoting based on an application data dump

Patent metadata

Field	Value
Publication number	US-10430266-B2
Application number	US-201615181010-A
Country	US
Kind code	B2
Filing date	Jun 13, 2016
Priority date	Jun 13, 2016
Publication date	Oct 1, 2019
Grant date	Oct 1, 2019

Abstract

Systems and methods are described for capturing and reproducing the full state of an application session. An application is captured by performing a dump of various components of the session and storing the components in an application session capture. Captured components include a memory image, CPU register values, open handles to kernel objects, and loaded libraries. The session is reproduced when requested based on the session capture. In cases where locations or references to certain items (e.g., memory locations, open handle references, library addresses, etc.) are different when the session is restored, a driver is used to remap the old locations or references to the new locations or references.

First claim

What is claimed is:

1. A method, comprising:
receiving an instruction to capture a session of an application executing on a computing device by an agent for capturing application sessions, the agent executing on the computing device;
in response to the instruction to capture the session of the application, producing an application session capture file by the agent, the application session capture file containing application memory corresponding to the session but not containing the application itself, wherein producing the session capture file comprises:
sending by the agent to an operating system of the computing device a request to dump the application memory, the application memory comprising information sufficient to capture a full state of the application session including a memory image containing one or more memory pages associated with the application and one or more CPU register values associated with the application;
in response to the request from the agent, dumping by the operating system the application memory comprising information sufficient to capture the full state of the application session including the memory image containing one or more memory pages associated with the application and the one or more CPU register values associated with the application;
recording the dumped memory image in the session capture file; and
recording the dumped CPU register values in the session capture file;

receiving a request to restore the application session on the computing device;
launching the application on the computing device and reproducing the full state of the captured session in the executing application based on the session capture file, such that the application resumes executing in the same exact place in execution as when the session was captured by:
loading the memory image of the application from the session capture file into live memory; and
setting values in one or more CPU registers based on the CPU register values recorded in the session capture file.

2. The method of claim 1 , wherein reproducing the application session further comprises:
during a loading of the memory image into a memory location of the live memory, detecting that the memory location in the live memory is being used by a process associated with a different application; and
loading the memory image into a new memory location.

3. The method of claim 2 , further comprising:
remapping the memory location to the new memory location by a driver operating on the computing device.

4. The method of claim 1 , wherein:
producing the session capture file further comprises recording information regarding open handles to kernel objects; and
reproducing the application session further comprises remapping open handles in the reproduced session to new open handles in response to detecting that the session is reproduced on a second computing device.

5. The method of claim 1 , wherein:
producing the session capture further comprises dumping information regarding loaded libraries and capturing the information regarding the loaded libraries; and
reproducing the application session further comprises remapping loaded library addresses in the reproduced session to new loaded library addresses.

6. The method of claim 4 , wherein the open handles to kernel objects include open handles to files, open handles to locks, open handles to monitors, and open handles to pipes.

7. The method of claim 2 , wherein the application session is captured on one computing device and reproduced on another computing device.

8. A computing system, comprising:
at least one processor; and
memory including instructions that, when executed by the at least one processor, cause the computing device to perform the steps of:
receiving an instruction to capture a session of an application executing on a computing device by an agent for capturing application sessions, the agent executing on the computing device;
in response to the instruction to capture the session of the application, producing an application session capture file by the agent, the application session capture file containing application memory corresponding to the session but not containing the application itself, wherein producing the session capture file comprises:
sending by the agent to an operating system of the computing device a request to dump the application memory, the application memory comprising information sufficient to capture a full state of the application session including a memory image containing one or more memory pages associated with the application and one or more CPU register values associated with the application;
in response to the request from the agent, dumping by the operating system the application memory comprising information sufficient to capture the full state of the application session including the memory image containing one or more memory pages associated with the application and the one or more CPU register values associated with the application;
recording the dumped memory image in the session capture file; and
recording the dumped CPU register values in the session capture file;

receiving a request to restore the application session on the computing device;
launching the application on the computing device and reproducing the full state of the captured session in the executing application based on the session capture file, such that the application resumes executing in the same exact place in execution as when the session was captured by:
loading the memory image of the application from the session capture file into live memory; and
setting values in one or more CPU registers based on the CPU register values recorded in the session capture file.

9. The computing system of claim 8 , wherein reproducing the application session further comprises:
during a loading of the memory image into a memory location of the live memory, detecting that the memory location in the live memory is being used by a process associated with a different application; and
loading the memory image into a new memory location.

10. The computing system of claim 9 , wherein the memory further includes instructions that when executed by the at least one processor, cause the computing device to perform the steps of:
remapping the memory location to the new memory location by a driver operating on the computing device.

11. The computing system of claim 8 , wherein:
producing the session capture file further comprises recording information regarding open handles to kernel objects; and
reproducing the application session further comprises remapping open handles in the reproduced session to new open handles in response to detecting that the session is reproduced on a second computing device.

12. The computing system of claim 8 , wherein:
producing the session capture further comprises dumping information regarding loaded libraries and capturing the information regarding the loaded libraries; and
reproducing the application session further comprises remapping loaded library addresses in the reproduced session to new loaded library addresses.

13. The computing system of claim 11 , wherein the open handles to kernel objects include open handles to files, open handles to locks, open handles to monitors, and open handles to pipes.

14. The computing system of claim 9 , wherein the application session is captured on one computing device and reproduced on another computing device.

15. A non-transitory computer readable storage medium comprising one or more sequences of instructions, the instructions when executed by one or more processors causing the one or more pr

Assignees

• Vmware Inc

Inventors

• Adler Nir
• Golbert Dima
• Lupovitz Or
• Shougaev Kosta

Classifications

• G06F11/0778 Primary

  Dumping, i.e. gathering error/state information after a fault for later diagnosis · CPC title