How would I go about taking a snapshot of a process to preserve its state for future investigation? Is this possible?

Question

Whether this is possible I don't know, but it would mighty useful!

I have a process that fails periodically (running in Windows 2000). I then have just one chance to react to it before having to restart it and painfully wait for it to fail again. I didn't write the process so don't have the source to debug. The failure is seemingly random.

With a snapshot of the process I could repeatedly and quickly test reactions to the failure.

I had thought of running inside a VM but this isn't possible in this instance.

EDIT: @Jon Cage asked:

When you say a snapshot, you mean capturing a process when it's about to fail (including memory, program state etc. etc.) ...and then replaying it's final few seconds repeatedly to see what effect it has on some other component?

This is exactly what I mean!

Answer 1

I think minidump is what you are looking for.

You can also used Userdump:

The User Mode Process Dumper (userdump) dumps any running Win32 processes memory image (including system processes such as csrss.exe, winlogon.exe, services.exe, etc) on the fly, without attaching a debugger, or terminating target processes. Generated dump file can be analyzed or debugged by using the standard debugging tools.

This article shows you how to use it.

Answer 2

My best bet is to start the process in a debugger (OllyDbg being my preferred tool). The process will pause on an exception, and you can try to figure out what happened shortly before that.

This needs some understanding of assembler and does not allow to create a snapshot of the process for later analysis. You would need to write your own debugger for that - it should be theoretically possible.