3

Are there any tools that can "record" the memory space of a process and then be able to restore it from a certain timestamp? As in, the process is recreated in the exact same state as if "loading a saved game".

Context is that of a game that crashes either while attempting to save/load a game or certain conditions are met (e.g. unit count > 5000). There are no debug logs.

Improve this question
2
  • 1
    You want a whole VM snapshot. Capturing just the process memory isn't enough (you also need to capture OS objects etc). Commented May 1, 2023 at 18:51
  • @joshpoley But what binds the process' memory image to the rest of the os; sure there may be file descriptors, I/O, network states, but other than that the process should be "well" contained, shouldn't it? Commented May 4, 2023 at 17:47

1 Answer 1

Reset to default
4

What you want exists and is known -- among other terms -- under the term "time travel debugging" (TTD), "replay debugging" and "record and replay debugging". Your processor needs to support it.

  • WinDbgX (the one from the MS store) has support for that (i.e. winget install -e --id Microsoft.WinDbg).
  • GDB also has support for it.
  • rr is even dedicated to the whole concept.
  • VMware used to include the feature called "replay debugging" for a few major versions; unfortunately it got scrapped.

However, it's not possible to take a mere memory dump and "revive" a process based on that. The record & replay method involves a whole lot more than just the memory state. Also, memory dumps often are only an excerpt of the full memory space of a process.

Improve this answer
2
  • But do you know of a reference that goes over how the process is bound to the state of the os. Intuitively, it's not clear as to why a process can't be revived from a point during its run. Of course there are corner cases such as random algorithms that are seeded with input that's not covered by the "recorder" but other than that, no? Commented May 4, 2023 at 17:50
  • 1
    @Sebi No, I am not aware of such a reference. But consider memory layout alone, ASLR, randomly created base addresses for DLLs on Windows (and that's just the usermode view of the memory). On Windows, all "Windows subsystem" processes are registered with the subsystem at startup. Intel PT (the mentioned underlying CPU feature) probably doesn't need everything. But it needs a meaningful subset and the help of the OS/debugger to facilitate collection. Intel PT does allow that sort of revival. What I wrote was that a memory dump alone isn't sufficient. You need something like Intel PT. Commented May 4, 2023 at 19:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.