US20020087949A1 - System and method for software diagnostics using a combination of visual and dynamic tracing - Google Patents

System and method for software diagnostics using a combination of visual and dynamic tracing Download PDF

Info

Publication number
US20020087949A1
US20020087949A1 US09/799,338 US79933801A US2002087949A1 US 20020087949 A1 US20020087949 A1 US 20020087949A1 US 79933801 A US79933801 A US 79933801A US 2002087949 A1 US2002087949 A1 US 2002087949A1
Authority
US
United States
Prior art keywords
information
trace
client
file
client program
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Abandoned
Application number
US09/799,338
Inventor
Valery Golender
Ido Moshe
Shlomo Wygodny
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
INDENTIFY SOFTWARE Ltd
Original Assignee
INDENTIFY SOFTWARE Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by INDENTIFY SOFTWARE Ltd filed Critical INDENTIFY SOFTWARE Ltd
Priority to US09/799,338 priority Critical patent/US20020087949A1/en
Assigned to MUTEK SOLUTIONS, LTD. reassignment MUTEK SOLUTIONS, LTD. ASSIGNMENT OF ASSIGNORS INTEREST (SEE DOCUMENT FOR DETAILS). Assignors: GOLENDER, VALERY, MOSHE, IDO BEN, WYGODNY, SHLOMO
Publication of US20020087949A1 publication Critical patent/US20020087949A1/en
Assigned to INDENTIFY SOFTWARE LTD. reassignment INDENTIFY SOFTWARE LTD. CHANGE OF NAME (SEE DOCUMENT FOR DETAILS). Assignors: MUTEK SOLUTIONS, LTD.
Assigned to PLENUS TECHNOLOGIES LTD. OF DELTA HOUSE reassignment PLENUS TECHNOLOGIES LTD. OF DELTA HOUSE SECURITY INTEREST (SEE DOCUMENT FOR DETAILS). Assignors: IDENTIFY SOFTWARE LTD.
Assigned to IDENTIFY SOFTWARE, LTD. reassignment IDENTIFY SOFTWARE, LTD. RELEASE OF SECURITY INTEREST Assignors: PLENUS TECHNOLOGIES LTD.
Priority to US12/575,357 priority patent/US8504994B2/en
Abandoned legal-status Critical Current

Links

Images

Classifications

    • GPHYSICS
    • G06COMPUTING; CALCULATING OR COUNTING
    • G06FELECTRIC DIGITAL DATA PROCESSING
    • G06F11/00Error detection; Error correction; Monitoring
    • G06F11/30Monitoring
    • G06F11/34Recording or statistical evaluation of computer activity, e.g. of down time, of input/output operation ; Recording or statistical evaluation of user activity, e.g. usability assessment
    • G06F11/3466Performance evaluation by tracing or monitoring
    • G06F11/3476Data logging
    • GPHYSICS
    • G06COMPUTING; CALCULATING OR COUNTING
    • G06FELECTRIC DIGITAL DATA PROCESSING
    • G06F11/00Error detection; Error correction; Monitoring
    • G06F11/30Monitoring
    • G06F11/32Monitoring with visual or acoustical indication of the functioning of the machine
    • G06F11/323Visualisation of programs or trace data
    • GPHYSICS
    • G06COMPUTING; CALCULATING OR COUNTING
    • G06FELECTRIC DIGITAL DATA PROCESSING
    • G06F11/00Error detection; Error correction; Monitoring
    • G06F11/30Monitoring
    • G06F11/34Recording or statistical evaluation of computer activity, e.g. of down time, of input/output operation ; Recording or statistical evaluation of user activity, e.g. usability assessment
    • G06F11/3466Performance evaluation by tracing or monitoring
    • GPHYSICS
    • G06COMPUTING; CALCULATING OR COUNTING
    • G06FELECTRIC DIGITAL DATA PROCESSING
    • G06F11/00Error detection; Error correction; Monitoring
    • G06F11/36Preventing errors by testing or debugging software
    • G06F11/362Software debugging
    • G06F11/366Software debugging using diagnostics
    • GPHYSICS
    • G06COMPUTING; CALCULATING OR COUNTING
    • G06FELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00Arrangements for program control, e.g. control units
    • G06F9/06Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/44Arrangements for executing specific programs
    • G06F9/451Execution arrangements for user interfaces
    • G06F9/453Help systems
    • GPHYSICS
    • G06COMPUTING; CALCULATING OR COUNTING
    • G06FELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00Arrangements for program control, e.g. control units
    • G06F9/06Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/46Multiprogramming arrangements
    • G06F9/54Interprogram communication
    • G06F9/547Remote procedure calls [RPC]; Web services

Definitions

  • the present invention relates to software tools for assisting software developers and help desk personnel in the task of monitoring and analyzing the execution of computer programs running on remote computers and detection and troubleshooting of execution problems.
  • the second problem is that some bugs give rise to actual errors only during specific execution conditions, and these conditions cannot always be reproduced during the debugging process.
  • a program error that occurs during normal execution may not occur during execution under the debugger, since the debugger affects the execution of the program.
  • This situation is analogous to the famous “Heizenberg effect” in physics: the tool that is used to analyze the phenomena actually changes its characteristics.
  • the Schuenberg effect is especially apparent during the debugging of time-dependent applications, since these applications rely on specific timing and synchronization conditions that are significantly altered when the program is executed step-by-step with the debugger.
  • the imbedded tracing code is designed to provide information regarding the execution of the application. Often, this imbedded code is no more than code to print messages which are conditioned by some flag that can be enabled in response to a user request.
  • the imbedded code solution depends on inserting the tracing code into the source prior to compiling and linking the shipped version of the application. To be effective, the imbedded code must be placed logically near a bug in the source code so that the trace data will provide the necessary information. Trying to anticipate where a bug will occur is, in general, a futile task. Often there is no imbedded code where it is needed, and once the application has been shipped it is too late to add the desired code.
  • Another drawback of current monitoring systems is the inability to correctly handle parallel execution, such as in a multiprocessor system.
  • the monitoring systems mentioned above are designed for serial execution (single processor) architectures.
  • serial techniques for parallel systems may cause several problems.
  • First, the sampling activity done in the various parallel entities (threads or processes) may interfere with each other (e.g., the trace data produced by one entity may be over written by another entity).
  • the function call graph in a serial environment is a simple tree. In a parallel processing environment, the function call graph is no longer a simple tree, but a collection of trees. There is a time-based relationship between each tree in the collection.
  • a “visual problem monitor” system includes an information-gathering module that gathers run-time information about program execution, program interaction with the operating system and the system resources. The information-gathering module also monitors user actions and captures screen output. In one embodiment, file interactions, DLL loading and/or registry accesses are monitored non-intrusively. In one embodiment, the relevant support information captured by the information-gathering module is saved in a log file.
  • the information-gathering module passes the gathered information to an information-display module.
  • the information-gathering module attaches to the running program using a hooking process.
  • the program being monitored need not be specially modified or adapted to allow the information-gathering module to attach.
  • the information-display module allows a support technician (e.g., a software developer, a help desk person, etc.) to see the user interactions with the program and corresponding reactions of the system. This eliminates the “questions and answers” game that support personnel often play with users in order to understand what the user did and what happened on the user's PC.
  • the information-display module allows the support technician to remotely view environment variables, file access operations, system interactions, and user interactions that occur on the user's computer.
  • the information-display module allows the support technician to remotely view crash information (in the event of a crash on the user's computer), system information from the user's computer, and screen captures from the user's computer.
  • One aspect of the present invention is a software system that facilitates the process of identifying and isolating bugs within a client program by allowing a developer to trace the execution paths of the client.
  • the tracing can be performed without requiring modifications to the executable or source code files of the client program.
  • the system interaction tracing can be performed even without any knowledge of the source code or debug information of the client.
  • the trace data collected during the tracing operation is collected according to instructions in a trace control dataset, which is preferably stored in a Trace Control Information (TCI) file.
  • TCI Trace Control Information
  • the developer generates the TCI file by using a trace options editor program having a graphical user interface.
  • the options editor displays the client's source code representation on a display screen together with controls that allow the software developer to interactively specify the source code and data elements to be traced.
  • the options editor may use information created by a compiler or linker, such as debug information, in order to provide more information about the client and thereby make the process of selecting trace options easier.
  • the developer then uses a trace analyzer program, also having a graphical user interface, to decode the trace information into a human-readable form, again using the debug information, and displays translated trace information on the display screen to allow the developer to analyze the execution of the client program.
  • the trace options editor and the trace analyzer are combined into a single program called the analyzer.
  • the analyzer is preferably configured to run under the control of a multi-process operating system and to allow the developer to trace multiple threads and multiple processes.
  • the tracing library is preferably configured to run in the same process memory space as the client thereby tracing the execution of the client program without the need for context switches.
  • the software system provides a remote mode that enables the client program to be traced at a remote site, such as by the customer at a remote customer site, and then analyzed at the developer site.
  • a remote mode the developer sends the TCI file for the particular client to a remote user site together with a small executable file called the tracing “agent.”
  • the agent is adapted to be used at the remote user site as a stand-alone tracing component that enables a remote customer, who does not have access to the source code of the client, to generate a trace file that represents execution of the client application at the remote site.
  • the trace file is then sent to the developer site (such as by email), and is analyzed by the software developer using the analyzer.
  • the remote mode thus enables the software developer to analyze how the client program is operating at the remote site, without the need to visit the remote site, and without exposing to the customer the source code or other confidential details of the client program.
  • the software system also preferably implements an online mode that enables the software developer to interactively trace and analyze the execution of the client.
  • the analyzer and agent are effectively combined into one program that a developer can use to generate trace options, run and trace the client, and display the trace results in near real-time on the display screen during execution of the client program.
  • the support technician typically uses a default TCI file that allows the trace system to trace interactions and other important API functions without access to source code and/or debug information. This is useful for troubleshooting commercial applications such Microsoft Office, Internet Information Server, CRM and ERP systems, and other legacy products and the like.
  • FIG. 1A is a block diagram illustrating the use of the system to create a trace control information file.
  • FIG. 1B is a block diagram illustrating the use of the system in remote mode.
  • FIG. 1C is a block diagram illustrating the use of the system to analyze a trace log file.
  • FIG. 2 is a block diagram illustrating the use of the system in online mode.
  • FIG. 3A is an illustration of a typical main frame window provided by the system's trace analyzer module.
  • FIG. 3B is an illustration of a typical main frame window showing multiple threads.
  • FIG. 4 illustrates a process list window that lists the processes to be traced.
  • FIG. 5 illustrates the trace options window that allows a developer to select the functions to be traced and the information to be collected during the trace.
  • FIG. 6 illustrates a file page window that provides a hierarchical tree of trace objects listed according to hierarchical level.
  • FIG. 7 illustrates a class page window that provides a hierarchical tree of trace objects sorted by class.
  • FIG. 8 illustrates the process page window that provides a hierarchical tree that displays the traced process, and the threads for each process.
  • FIG. 9 illustrates the running process window that allows the user to attach to and start tracing a process that is already running.
  • FIG. 10 illustrates the start process window that allows the user to load an executable file, attach to the loaded file, execute the loaded file, and start tracing the loaded file.
  • FIG. 11 shows a trace detail pane that displays a C++ class having several members and methods, a class derived from another classes, and classes as members of a class.
  • FIG. 12 illustrates a trace tree pane, showing a break (or tear) in the trace tree where tracing was stopped and then restarted.
  • FIG. 13 is a flowchart which illustrates the process of attaching to (hooking) a running process.
  • FIG. 14 is a flowchart which illustrates the process of loading an executable file and attaching to (hooking) the program.
  • FIG. 15 is a block diagram showing the architecture of the visual problem monitor system including the information-gathering module and the information-display module.
  • FIG. 16 shows a multi-window display provided by the information-display module.
  • FIG. 17 is a flowchart illustrating the use of the system to solve software support problems.
  • the present invention provides a new model for software diagnostics by tracing the execution path of a computer program and user interaction with the computer program.
  • this tracing model is implemented within a set of tracing and debugging tools that are collectively referred to as the BugTrapper system (“BugTrapper”).
  • the BugTrapper tools are used to monitor and analyze the execution of a computer program, referred to as a client.
  • One feature of the BugTrapper is that it does not require special instructions or commands to be imbedded within the source code of the client, and it does not require any modifications to be made to the source or executable files of the client.
  • Tracing refers generally to the process of using a monitoring program to monitor and record information about the execution of the client while the client is running.
  • a “trace” generally refers to the information recorded during tracing.
  • the BugTrapper tools collect data while the client is running.
  • Attaching the BugTrapper tools instrument the client by inserting interrupt instructions at strategic points defined by the developer (such as function entry points) in the memory image of the client. This instrumentation process is analogous to the process of connecting a logic analyzer to a circuit board by connecting probes to test points on the circuit board. When these interrupts are triggered, the BugTrapper collects trace information about the client without the need for a context switch, and then allows the client to continue running.
  • BugTrapper implementations described herein operate under, and are therefore disclosed in terms of, the Windows-NT/2000 and Windows-95/98 operating systems and the like. It will be apparent, however, that the underlying techniques can be implemented using other operating systems that provide similar services. Other embodiments of the invention will be apparent from the following detailed description of the BugTrapper.
  • the BugTrapper provides two modes of use, remote mode, and online mode.
  • remote mode a developer can trace the remote execution of a program that has been shipped to an end user (e.g. a customer or beta user) without providing a special version of the code to the user, and without visiting the user's site or exposing the source code level details of the program to the user.
  • end user e.g. a customer or beta user
  • the system can also be used in an online mode wherein the developer can interactively trace a program and view the trace results in real time.
  • Step 1 a developer 112 uses a program called the BugTrapper analyzer 106 to create a file called a trace control information (TCI) file 120 .
  • TCI trace control information
  • the TCI file 120 contains instructions that specify what information is to be collected from a program to be traced (the client).
  • the analyzer 106 obtains information about the client from a build (e.g., compile and link) by-product, such as a link map file, or, as in the preferred embodiment, a debug information file 121 .
  • the debug information file 112 will be created by a compiler and will contain information such as the names and addresses of software modules, call windows, etc.
  • the developer 112 then sends the TCI file 120 and a small tracing application called the agent 104 to a user 110 as shown in FIG. 1B.
  • the user 110 runs the agent 104 and the client 102 and instructs the agent 104 to attach to the client 102 .
  • the agent attaches to the client 102 by loading a client-side trace library 125 into the address space of the client 102 .
  • An agent-side trace library 124 is provided in the agent 104 .
  • the client-side trace library 125 and the agent-side trace library 124 are referred to collectively as the “trace library.”
  • the agent-side trace library 124 and the client-side trace library 125 exchange messages through normal interprocess communication mechanisms, and through a shared memory trace buffer 105 .
  • the agent-side trace library 124 uses information from the TCI file 102 to attach the client-side trace library 125 into the client 102 , and thereby obtain the trace information requested by the developer 112 .
  • a context can be a process, a thread, or any other unit of dispatch in a computer operating system.
  • the client 102 can be any type of software module, including but not limited to, an application program, a device driver, or a dynamic link library (DLL), or a combination thereof.
  • the client 102 can run in a single thread, or in multiple processes and/or multiple threads.
  • the agent 104 attaches to the client 102 using a process known as “attaching.”
  • the agent 104 attaches to the client 102 , either when the client 102 is being loaded or once the client 102 is running.
  • the agent 104 extracts trace information, such as execution paths, subroutine calls, and variable usage, from the client 102 .
  • the TCI file 120 contains instructions to the client-side trace library 125 regarding the trace data to collect.
  • the trace data collected by the client-side trace library 125 is written to the trace buffer 105 .
  • the agent 104 copies the contents of the trace buffer 105 to a trace log file 122 .
  • the log data is written to a file automatically, such as when the client terminates.
  • the user 110 sends the trace log file 122 back to the developer 112 .
  • the developer 112 uses the analyzer 106 to view the information contained in the trace log file 122 .
  • the analyzer 106 obtains information from the debug information file 121 . Since the analyzer 106 is used to create the TCI file 120 and to view the results in the trace log file 122 , the developer can edit the TCI file 120 or create a new TCI file 120 while viewing results from a trace log file 122 .
  • Remote mode is used primarily to provide support to users 110 that are located remotely relative to the developer 112 .
  • the agent 104 is provided to the user 110 as a stand-alone component that enables the user to generate a trace log file that represents the execution of the client.
  • the TCI file 120 and the trace log file 122 both may contain data that discloses secrets about the internal operation of the client 102 and thus both files are written using an encoded format that is not readily decipherable by the user 110 .
  • the developer 112 is not divulging information to the user that would readily divulge secrets about the client 102 or help the user 110 in an attempt to reverse engineer the client 102 .
  • the Agent traces the client without any need for modification of the client.
  • the developer 112 does not need to build a special version of the client 102 executable file and send it to the customer, neither does the customer need to pre-process the client executable file before tracing.
  • the agent 104 acts essentially as a black box that records the execution path of the client 102 .
  • the trace itself is not displayed on the screen, but immediately after the bug reoccurs in the application, the user 110 can dump the trace data to the trace log file 122 and send this file to the developer 112 (such as by email) for analysis.
  • the developer 112 uses the analyzer 106 to view the trace log file created by the user 110 and identify the problematic execution sequence.
  • the user 110 does not need access to the source code or the debug information.
  • the agent 104 , the TCI file 120 , and the trace log file 122 are preferably small enough to be sent via email between the developer 112 and the user 110 . Further details regarding the remote mode of operation are provided in the sections below.
  • the BugTrapper may also be used in an online mode rather than remote mode as shown in the previous figures.
  • the BugTrapper is used by the developer 112 to locally analyze a client 102 , which will typically be a program that is still being developed.
  • the online mode can be used as an aid during the development as a preliminary or complementary step to using a conventional debugger. In many cases it is hard to tell exactly where a bug resides and, therefore, where breakpoints should be inserted. Online mode provides the proper basis for setting these breakpoints. Later, if further analysis is required, a more conventional debugger can be used.
  • the analyzer 106 is used to perform all of its normal operations (e.g.
  • the agent 104 uses the analyzer 106 to run the client 102 and attach the client-side trace library 125 to the client 102 .
  • the analyzer 106 reads the trace buffer 105 in near real-time to provide near real-time analysis functionality.
  • the analyzer 106 immediately displays the trace information to the developer 112 .
  • the developer 112 uses the analyzer 106 to interactively create trace control information (TCI).
  • TCI may be sent to the client-side trace library 125 via file input/output operations or through conventional inter-process communication mechanisms such as shared memory, message passing or remote procedure calls.
  • the TCI indicates to the client-side trace library 125 what portions of the client 102 to trace, and when the tracing is to be performed.
  • the client-side trace library 125 collects the trace information and relays the information back to the analyzer 106 , which displays the information in near real-time within one or more windows of the BugTrapper.
  • the client 102 is run in conjunction with the client-side trace library 125 .
  • the client-side trace library 125 is attached to the in-memory image of the client 102 and generates trace information that describes the execution of the client 102 .
  • the TCI file 120 provided by the developer 112 , specifies where tracing is to take place and what information will be stored. Because the client is traced without the need for context switches, the effect of this tracing operation on the performance of the client 102 is minimal, so that even time-dependent bugs can be reliably diagnosed. As described below, this process does not require any modification to the source or object code files of the client 102 , and can therefore be used with a client 102 that was not designed to be traced or debugged.
  • the analyzer 106 is used to analyze the trace data and isolate the bug.
  • the developer 112 may either analyze the trace data as it is generated (online mode), or the developer 112 may analyze trace data stored in the trace log file 122 (mainly remote mode). As described below, the assembly level information in the trace log file is converted back to a source level format using the same debug information used to create the TCI file 120 .
  • the analyzer 106 provides the developer 112 with execution analysis options that are similar to those of conventional debuggers, including options for single stepping and running forward through the traced execution of the client 102 while monitoring program variables.
  • the analyzer 106 allows the developer 112 to step backward in the trace, and to search for breakpoints both in the future and in the past.
  • the attaching mechanism used to attach the client-side trace library 125 to the client 102 involves replacing selected object code instructions (or fields of such instructions) of the memory image of the client 102 with interrupt (INT) instructions to create trace points.
  • the locations of the interrupts are specified by the TCI file 122 that is created for the specific client 102 .
  • INT interrupt
  • the client-side trace library 125 logs the event of passing the trace point location and captures pre-specified state information, such as values of specific program variables and microprocessor registers.
  • the instructions that are replaced by the interrupt instructions are maintained within a separate data structure to preserve the functionality of the application.
  • the analyzer 106 comprises a User Interface module that reads trace data, either from the trace buffer 105 (during on-line mode tracing) or from the trace log file 122 (e.g. after remote tracing) and displays the data in a format, such as a trace tree, that shows the sequence of traced events that have occurred during execution of the client 102 .
  • Much of the trace data comprises assembly addresses.
  • the analyzer 106 uses the debug information 121 to translate the traced assembly addresses to comprehensive strings that are meaningful to the developer. In order to save memory and gain performance, this translation to strings is preferably done only for the portion of the trace data which is displayed at any given time, not the whole database of trace data.
  • the debug information 121 is preferably created by a compiler when the client is compiled. Using the debug information 121 the analyzer translates function names and source lines to addresses when creating the TCI file 120 . Conversely, the analyzer 106 uses the debug information 121 to translate addresses in the trace data back into function names and source lines when formatting a display for the user interface.
  • the analyzer 106 uses the debug information 121 to translate addresses in the trace data back into function names and source lines when formatting a display for the user interface.
  • build information may be used as well, including, for example, information in a linker map file and the Type Library information available in a Microsoft OLE-compliant executable.
  • the debug information is never used by the trace libraries 124 , 125 or the agent 102 , but only by the analyzer 106 .
  • This is desirable for speed because debug information access is typically relatively slow.
  • This is also desirable for security since there is no need to send to the user 110 any symbolic information that might disclose confidential information about the client 102 .
  • the analyzer 106 allows the developer 112 to open multiple trace tree windows and define a different filter (trace control instructions) for each of window.
  • each window filter is preferably examined separately to see if the record should be displayed.
  • the filters from the various windows are combined in order to create the TCI file 120 , which is read by the client-side trace library 125 .
  • the multiple windows with different filters are handled by the User Interface, and the client-side trace library 125 reads from a single TCI file 120 .
  • FIG. 3A is an illustration of a typical frame window 300 provided by the analyzer 106 .
  • the analyzer frame window 300 displays similar information both when performing online tracing (online mode) and when displaying a trace log file (remote mode).
  • the frame window 300 is a split frame having four panes.
  • the panes include a trace tree pane 310 , an “executable” pane 314 , a trace detail pane 316 , and a source pane 318 .
  • the analyzer frame 300 further provides a menu bar 304 , a dockable toolbar 306 , and a status bar 312 .
  • the menu bar 304 provides drop-down menus labeled “File,” “Edit,” “View,” “Executable,” and “Help.”
  • the trace tree pane 310 contains a thread caption bar 320 , described below in connection with the Analyzer. Below the thread caption bar 320 is a trace tree 330 .
  • the trace tree 330 is a hierarchical tree control that graphically displays the current trace information for the execution thread indicated in the thread caption bar 320 .
  • the trace tree 330 displays, in a hierarchical tree graph, the sequence of function calls and returns (the dynamic call tree) in the executable programs (collectively the client 102 ) listed in the executable pane 314 .
  • FIG. 3 illustrates a single thread header and thread tree combination (the items 320 and 330 ). However, multiple thread captions and thread tree combinations will be displayed when there are context switches between multiple threads or processes.
  • the executable pane 314 displays an “executable” listbox 361 .
  • Each line in the executable listbox 361 displays information about an executable image that is currently being traced.
  • Each line in the list box 361 displays a filename field 360 , a process id (PID) field 362 , and a status field 364 .
  • Typical values for the status field 364 include “running,” “inactive,” and “exited.”
  • the trace detail pane 316 contains a trace detail tree 350 , which that is preferably implemented as a conventional hierarchical tree control.
  • the trace detail tree 350 displays attributes, variables such as arguments in a function call window, and function return values of a function selected in the trace tree 330 .
  • the source pane 318 displays a source listing of one of the files listed in the source listbox 361 .
  • the source listing displayed in the source pane 318 corresponds to the source code of the function selected in the trace tree 330 of to the selected source line.
  • the source code is automatically scrolled to the location of the selected function.
  • the frame window 300 also contains a title bar which displays the name of the analyzer 106 and a file name of a log or Trace Control Information (TCI) file that is currently open. If the current file has not yet been saved, the string “-New” is concatenated to the file name display.
  • TCI Trace Control Information
  • the status bar 312 displays the status of the analyzer 106 (e.g. Ready), the source code file containing the source code listed in the source code pane 318 , and the line and column number of a current line in the source pane 318 .
  • the toolbar 306 provides windows tooltips and the buttons listed in Table 1.
  • FIG. 3B shows a typical frame window 300 with multiple threads in the trace tree pane 310 .
  • FIG. 3B shows a separate trace tree for each thread and a thread caption bar (similar to the thread caption bar 320 shown in FIG. 3A) for each thread.
  • TABLE 1 Buttons on the toolbar 306 Menu Button Equivalent Key Description “Open” File
  • “Find” Edit Find Ctrl+F Finds a specific string in the executable source code or trace tree.
  • Bookmark” Edit Adds or deletes a bookmark for Bookmark the currently selected function, or edits the name of an existing bookmark.
  • “Window” View New Opens a new instance of the Window analyzer.
  • Start/Stop Executable
  • the TCI file 120 specifies one or more clients 102 and the specific elements (functions, processes and so on) to be traced either in online or remote mode.
  • the TCI information is specified in a trace options window (described in the text associated with FIG. 5).
  • the TCI file 120 is used to save trace control information so that the same trace options can be used at a later time and to send trace control information to a user 110 to trace the client 102 .
  • the subsections that follow provide a general overview of selecting trace information for a TCI file 120 and descriptions of various trace options, different ways to access the trace options, and how to use the trace options to specify elements to be traced.
  • the TCI file 120 for a client 102 is interactively generated by the software developer 112 using the analyzer 106 .
  • the analyzer 106 displays the source structure (modules, directories, source files, C++ classes, functions, etc.) of the client 102 using the source code debug information 121 generated by the compiler during compilation of the client 102 .
  • debug information 121 may be in an open format (as with a COFF structure), or proprietary format (such as the Microsoft PDB format), and can be accessed using an appropriate application program interface (API).
  • API application program interface
  • trace points may be added to the memory image of the client 102 by scanning the image's object code “on the fly” for specific types of object code instructions to be replaced.
  • Trace control information is defined for a specific client 102 .
  • the developer 112 In order to access the trace tool, the developer 112 first adds the desired programs 110 to the list of executables shown in the executable pane 314 shown in FIG. 3.
  • the executable is preferably compiled in a manner such that debug information is available.
  • debug information may be included in an optimized “release” build such that creation of the debug information does not affect the optimization.
  • the debug information is stored in a PDB file. If during an attempt to add the executable to the Executable pane 314 a PDB file is not found by the analyzer 106 , the developer 112 is prompted to specify the location of the PDB file. Once an executable has been added to the Executable pane 314 , the developer 112 can set the trace control information using the available trace options described below.
  • the developer selects an executable file to run as the client 102 .
  • the developer 112 double-clicks the ⁇ New Executable> text 365 in the executable pane 314 to open a file selection window thus allowing the developer 112 to select the required executable.
  • the developer 112 can click the Run button on the toolbar 306 , or select the Run option from the “Executable” menu after selecting the ⁇ New Executable> text.
  • the file selection window provides a command line arguments text box to allow the developer 112 to specify command line arguments for the selected executable file.
  • a trace options window (as described below in connection with FIG. 5.) is displayed which allows the developer 112 to specify which functions to trace.
  • the executable starts running and BugTrapper starts tracing.
  • trace data is collected and the trace data are immediately displayed in the analyzer frame window 300 as shown in FIG. 3.
  • a process list window 400 is displayed, as shown in FIG. 4.
  • the process list window 400 displays either an applications list 402 or a process list (not shown).
  • an application is a process that is attached to a top level window.
  • the applications list 402 displays a list of all of the applications that are currently running.
  • the process list window 400 also provides a process list, which is a list of the processes that are currently running.
  • the applications list 402 is selected for display by an applications list tab and the process list is selected for display by pressing the applications list tab.
  • the developer 112 clicks the Applications tab or the Processes tab as required, and then selects the application or process to be traced.
  • the process list window 400 also provides a refresh button to refresh the application list and the process list, and an OK button to close the process list window 400 .
  • the analyzer 106 displays a trace options window 500 , as shown in FIG. 6 below.
  • the application or process selected in the process list window 400 becomes the client 102 .
  • the analyzer 106 can display trace data for multiple processes and applications (multiple clients); however, for the sake of simplicity, the operation of the analyzer 106 is described below primarily in terms of a single client 102 .
  • the trace options window 500 allows the developer 112 to select the functions to be traced. Selecting trace options is described below in the text in connection with FIG. 5.
  • the client-side trace library 125 After selecting trace options and closing the trace options window 500 , the client-side trace library 125 is attached to the client 102 , and the client 102 continues to run. The client-side trace library 125 thereafter collects trace information that reflects the execution of the client 102 and sends the trace information to the analyzer 106 for display.
  • the developer can also add an executable file (e.g. a windows .exe file) to the executable pane 314 without actually running the executable file.
  • an executable file e.g. a windows .exe file
  • the developer 112 selects the ⁇ New Executable> text 365 and then clicks the Add button on the toolbar 306 , whereupon a file selection window is displayed.
  • the developer 112 uses the file selection window to select the desired executable and closes the file selection window.
  • the file selection window provides a text field to allow the developer to enter command line arguments for the executable.
  • the trace options window 500 is displayed which enables the developer 112 to select the functions to trace.
  • the selected executable is inserted into the Executable pane 314 with the status “Inactive.”
  • the developer can then begin a trace on the inactive executable by selecting the executable in the executable pane 314 and clicking the “Run” or “Attach” buttons on the toolbar 306 .
  • the developer 112 can only create a new TCI file 120 when the executable list 361 contains the names of one or more executable files.
  • the developer 112 selects “Save” from the “File” menu.
  • the developer can also open a previously saved TCI file 120 and then modify the TCI file 120 using the trace options window 500 .
  • the developer 112 can select an executable from the executable pane and click the “Run” or “Attach” button from the toolbar to start tracing.
  • FIG. 5 illustrates the trace options window 500 .
  • the trace options window 500 is divided into two panes, a filter tree pane 501 and a source code pane 504 .
  • the filter tree pane 501 is a multi-page pane having four pages: a file page 602 which is selected by a file tab 510 ; a class page 702 which is selected by a class tab 512 ; a name page 502 which is selected by a name tab 514 ; and a process page 802 which is selected by a process tab 516 .
  • the name page 502 is shown in FIG. 5.
  • the file page 602 is shown in FIG. 6, the class page 702 is shown in FIG. 7, and the process page 802 is shown in FIG. 8.
  • the trace options window also provides an “advanced” button 520 and an “add DLL” button 522 .
  • the trace options window 500 allows the developer 112 to specify which functions to trace and what to display in the trace tree 330 .
  • the trace options window 502 allows the developer 112 to filter out functions which have already been traced. These functions will be redisplayed where they were traced if they are later re-select for tracing. If a function is not selected for tracing in the trace options window 500 , it will not be displayed in the trace tree 330 . If a function that was not traced is filtered in again, it will not appear in that portion of the information that has already been displayed.
  • Step 4 depicts the elements that are displayed in the trace window, with the symbol ⁇ ⁇ ⁇ representing a tear in the trace as described below in connection with FIG. 12.
  • Step 6 the trace appears as follows: main f1 f2 ⁇ ⁇ ⁇ ⁇ ⁇ ( Step ⁇ ⁇ 4 ) f1 ⁇ ⁇ ⁇ ⁇ ⁇ ⁇ f1 f2 ( Step ⁇ ⁇ 5 )
  • the process tab 516 corresponding to the process page 802 , is not displayed prior to activating a process.
  • Each of the four pages in the filter tree pane 501 displays a tree that the developer 112 can use to select the functions to be traced and analyzed.
  • the source code pane 504 displays a source code fragment that contains the source code for the selected function and enables the developer 112 to select the specific source lines to be traced.
  • Each line of executable source in the source code pane 504 is provided with a check box displayed along the left edge of the pane 504 . The developer 112 checks the box to select the corresponding source line for tracing.
  • the “advanced” button 520 opens a window which allows the developer 112 to specify which elements to display during the trace (e.g. arguments, pointers, “this” class members and return values) and the maximum string length to be traced.
  • the add DLL button 522 opens a window which allows the developer 112 to specify DLL files to be traced. This is useful when a DLL is loaded dynamically, as described below.
  • the developer 112 uses the filter tree pane 501 to select functions to be traced.
  • Four page selection tabs at the top of the filter tree pane 501 enable the developer 112 to view the functions classified (sorted) according to file (on the file page 602 ), class (on the class page 702 ), name (on the name page 502 ) or process (on the process page 802 ).
  • the way the functions are organized is different for each classification tab.
  • the tree structure that is displayed in each of the four pages operates in the same way, even though the data elements in the tree are different for each page.
  • the following discussion relating to the filter tree applies to any of the four pages of the filter tree pane 502 .
  • the filter tree is a tree of function names with check boxes to the left of each name. Function check boxes appear blank, checked or dimmed as follows:
  • the developer 112 uses the check boxes to selected the functions to trace and then closes the trace options window by clicking an OK button.
  • the file page 602 shown in FIG. 6, provides a hierarchical tree that lists the objects according to their hierarchical level in the following order: + The Process that is traced. + The executable and DLL files which comprise the process. + Static Libraries + Source file directories. + Source files residing in these directories. + Classes contained in each source file and functions in each source file that do not belong to any class. + Functions belonging to the classes.
  • the source file structure is taken from the debug information (e.g., .PDB) files 121 for the client 102 . If the full path name of the source file is not contained in the .PDB file, then the functions contained in that source file are located in a separate branch of the trace tree 330 under the title ⁇ Unknown Directory>. Functions that are included in the .PDB file, but whose source file is unknown, are located in a separate branch of the trace tree 330 under the title ⁇ Unknown Source File>.
  • debug information e.g., .PDB
  • the class page 702 shown in FIG. 7, provides a hierarchical tree that lists the trace objects sorted by class, ignoring their distribution amongst source files. Functions, which do not belong to a specific class are located in a separate branch of the trace tree 330 under the title ⁇ Functions>.
  • the name page 502 shown in FIG. 5, provides a hierarchical tree that lists functions sorted alphabetically by name. Leading underscores and class names for methods are ignored.
  • the process page 802 shown in FIG. 8, provides a hierarchical tree that displays each process that has been selected for tracing. Under each process is a list of the threads for that process.
  • DLL files that are not linked with the executable but rather are loaded dynamically are not shown by default in the trace options window 500 .
  • the dynamically loaded DLL file should be added to the list of DLL files using the Add DLL button 522 in the Trace Options window 500 . Clicking the add DLL button 522 displays a file selection window. Using the file selection window, the developer 112 then selects the required DLL file. The selected DLL file is added to the filter tree in the filter tree pane 502 of the trace options window 500 .
  • the BugTrapper can also trace DLL files loaded by an executable, even when the executable does not contain debug information. For example, if the developer 112 writes a DLL file as an add-on (e.g., an ActiveX control) to a commercial program (e.g. Microsoft Internet Explorer), the developer 112 can activate BugTrapper on the commercial program and perform a trace on the add-on.
  • an add-on e.g., an ActiveX control
  • a commercial program e.g. Microsoft Internet Explorer
  • the BugTrapper also allows the developer 112 to specify various function attributes to be displayed in the trace detail pane 316 of the analyzer frame window 300 , (shown in FIG. 3) while performing a trace.
  • the developer 112 can choose to display arguments, pointers, “this” class members and return values.
  • a “this” class member is a class member that is referenced by the C++ “this” pointer.
  • the developer 112 can also specify the maximum string length to be displayed. Selecting more options generally reduces the number of records in the trace log file and thus reduces the amount of execution time that is logged.
  • the discussion below regarding the cyclic trace buffer provides further details of how much execution time is actually logged.
  • the advanced button provides access to an advanced options window (not shown).
  • Selecting the arguments checkbox causes function arguments to be displayed in the trace detail pane 316 .
  • Selecting the “pointers” checkbox causes data to which a first level function argument of the pointer type points to be displayed.
  • selecting the pointers checkbox causes function arguments that are pointers to be de-referenced for the display.
  • the developer 112 may select the “this” checkbox to have “this” to have all members in a class displayed in the trace detail pane 316 when there is a call to a method which has a this pointer.
  • the developer 112 may select the return checkbox to have function return values displayed in the trace detail pane 316 .
  • the BugTrapper also allows the developer 112 to control tracing of specific source lines.
  • a checkbox is located to the left of each executable source line, which can be traced.
  • the developer 112 selects the required function in the filter tree pane 502 and the analyzer 106 displays the appropriate source code fragment in the source code pane 504 . If analyzer cannot locate the source code, then the source code is not displayed and the developer 112 may press the spacebar or right-click in the source code pane 504 and select a “Source Location” command from a pop-up menu.
  • the “Source Location” command opens a dialog box which allows the developer 112 to specify a source code file to be displayed in the source code pane 504 .
  • the appropriate source code is then displayed in the source code pane 504 , as shown in FIG. 5.
  • the developer clicks the check boxes corresponding to the desired lines.
  • the developer 112 can either press CTRL+A to select the whole source code file, or drag the mouse along several lines and thereby select a group of lines. The developer 112 can then click on any checkbox in the selected area to check all the selected lines or click on a checkbox that is already checked to deselect all selected the lines. If lines of code in a file are selected for tracing, then the filename is displayed in blue.
  • the developer 112 may also select which variables (e.g., local variables, global variables, static variables, etc.) should be traced for each traced line.
  • TCE Extended Trace Control Information
  • the TCE file is identified by a .TCE extension.
  • the developer may save a TCI file 120 by clicking the save button on the toolbar 306 , whereupon the trace control information is saved.
  • the first time that information is saved to a new TCI file 120 a file selection window appears.
  • the developer 112 may select the type of file (TCI or TCE) in a “Save as” type box.
  • the TCI file 120 can be used to trace a local client 102 at a later time, or it can be sent to a user 110 for use with the agent 104 to trace a client 102 at a remote site.
  • the developer 112 sends the user 110 a self-extracting zip file that contains the agent 104 and the TCI file 120 .
  • the agent 104 is an executable module which the developer 112 can provide to a user 110 along with a Trace Control Information (TCI) file in order to trace a client 102 .
  • TCI Trace Control Information
  • the trace data collected by the agent 104 are written to the trace log file 122 which the user sends to the developer 112 .
  • the developer 112 uses the analyzer 106 to view the contents of the trace log file and analyze the trace information in the log file 122 . Trace analysis using the analyzer 106 is discussed in subsequent sections of this disclosure. The present section discusses the procedures for starting the agent 104 , including the first step performed by the user 110 to run the agent 104 .
  • the present section also discloses techniques for selecting the TCI file 120 , specifying a directory for the trace log file 122 , specifying the client 102 , and, finally, using the agent 104 to control the logging of trace data.
  • the agent 104 is an easy-to-run standalone application, with step-by-step instructions provided on the screen. To trace an application, the user 102 needs both the agent 104 and the TCI file 120 .
  • the TCI file 120 is prepared, as described above, by the developer 112 and contains information about the client 102 and the specific functions to be traced.
  • the developer supplies the agent 104 as a self extracting zip file that can be installed by simply double clicking on the zip file name.
  • the user 110 can launch the agent 102 .
  • the agent 102 displays a TCI select window (not shown) which is a conventional file select dialog that allows the user to select the TCI file 120 .
  • the agent 104 provides a log file window, which allows the user 110 to select a directory for the log file 122 .
  • the default log file is the last log file that was opened by the agent 104 .
  • the next step in using the agent 104 is to specify the client 102 executable(s) to trace.
  • an attach to running processes window (running window) 900 is displayed, as shown in FIG. 9.
  • the running window 900 provides a finish button 902 , a cancel button 904 , a back button 906 , and a list of processes 908 .
  • the list of processes 908 shows any currently running processes that are specified in the TCI file 120 .
  • the list of processes 908 shows all processes that are specified in the TCI file 120 that are not currently running as disabled (grayed).
  • the running window 900 allows the user 102 to select a currently running process to trace by selecting items in the list 908 .
  • the user 110 will deselect any executables that are to be re-run from the start (that is, when the user does not want to attach to an executable that is already running).
  • the user 110 selects a process from the list 908 , and then presses the finish button 902 to cause the BugTrapper to attach to the client processes and starts to collect trace data.
  • start window 1000 is displayed, as shown in FIG. 10,.
  • the start window 1000 provides a finish button 1002 , a cancel button 1004 , a back button 1006 , and a list of executable files 1010 .
  • the start window 1000 also provides a path field 1012 , a parameters field 1014 , and a directory field 1016 .
  • the list of files 1010 shows any currently running processes that are specified in the TCI file.
  • the start window 1000 allows the user to specify executables that are not currently running to be traced.
  • the agent 104 will run the selected client(s) 102 and trace them according to the information in the TCI file 120 .
  • the file list 1010 displays the executables, which are listed in the TCI file. Each item in the file list 1010 is provided with a check box. To specify the executables to run, the user 102 checks the boxes for the desired executables in the file list 1010 . If the file path in the file list 1010 is not correct, then the user may enter the correct file path in the path field 1012 . The user 110 may also add command line arguments in the parameters field 1014 . The file path and command line steps may be repeated as needed to specify the file path and commands for additional executables. When the finish button 1002 is clicked, an agent window (described below) is displayed and the agent 104 runs the specified executables, attaches to the executable processes, and starts tracing.
  • an agent window (described below) is displayed and the agent 104 runs the specified executables, attaches to the executable processes, and starts tracing.
  • the agent window (not shown) is displayed by the agent 104 .
  • the agent window displays the names of the TCI file and the log file.
  • the agent window also contains an animated icon whose movement indicates whether trace data is currently being collected while the client 102 is running.
  • the agent window also contains: a “Start/Stop” button to start or stop the trace; a “Clear” button to clear the trace buffer 105 , a “Dump” button to save the contents of trace buffer 105 to the log file; and an “Exit” button to exit the agent 104 .
  • the “Stop/Start” button allows the user 110 to stop and restart tracing when desired. Stopping the trace may improve system performance.
  • the “Start/Stop” button toggles between Stop and Start according to the tracing status. The animated icon moves when tracing is in progress.
  • the “Clear” button allows the user 110 to clear the trace buffer 105 . The cleared information is not stored in the log file 122 unless the user first uses the dump button.
  • the dump button allows the user 110 to save the contents of the trace buffer 105 to the log file 122 . On the first save after a new process had been started, the agent 104 overwrites the old log file 122 (if one exists). On subsequent saves, new information will be appended to the existing log file 122 .
  • Clicking the exit button causes the agent 104 to exit.
  • the trace buffer is written to the log file. Note that the trace information is written to the log file when either dump or exit is clicked and also when the traced application crashes or terminates.
  • the user 110 will preferably use the dump button frequently if it appears likely that the entire operating system may crash.
  • the user may select to write every trace line to the disk as it is traced, or, the user may select to write trace lines periodically every N seconds. Such writing is useful, for example, when it appears likely that the entire operating system may crash.
  • the analyzer 106 is used to analyze a trace, either online as an application runs or off-line using a remote trace log.
  • the general topics that fall under the rubric of trace analysis include, starting an online trace, opening a previously saved trace log file, viewing trace information, interpreting the trace information, working with trace information, and additional trace functions that are available when performing an online trace.
  • the BugTrapper allows the developer 112 to trace a client 102 executable in order to pinpoint an element in the client 102 code that causes a bug.
  • the primary device for displaying trace information in the analyzer 106 is the trace tree 330 in the trace tree pane 310 shown in FIG. 3.
  • the trace control information (TCI) filters can be modified during trace analysis to filter out some of the available trace data according to the needs of the developer 112 .
  • Analysis of a remote trace is started by opening a previously saved trace log file and displaying the trace information that it contains in the trace tree pane 310 .
  • the log file 122 may either have been created by saving trace information using the analyzer 106 , or the log file 122 may have been created at a remote location using the agent 104 .
  • a trace log file 122 is opened by using an “Open Log” command from the “File” pull down menu found on the menu bar 304 . Once a trace log file 122 is open, the title bar 302 displays the name and path of the opened log file 122 .
  • the developer can view the trace information using various panes in the analyzer frame window 300 . Trace information is displayed in the trace tree pane 310 , the trace detail pane 316 , and the source pane 318 .
  • the trace tree 330 in the trace tree pane 310 , is a hierarchical tree showing trace data collected from the client 102 .
  • Trace data includes information about events that took place during execution of the client 102 , including function calls, function returns, selected source lines, etc.
  • the developer 112 can use the mouse to choose any function from the trace tree, whereupon the arguments and return values for the chosen function are shown in the trace detail pane 316 , and the source for the chosen function is displayed in the source pane 318 .
  • the types of trace information displayed for both online traces and a trace from log files is almost identical, however the log file trace provides a static display, while the online trace is dynamic and can be viewed as the trace information is being collected.
  • the trace tree 330 displays a hierarchical tree of the sequence of function calls and returns in the client 102 .
  • the number of lines in the trace tree is shown in the trace tree pane title bar 308 .
  • the trace tree 330 is organized in a standard tree structure and the developer 112 can click on the tree control buttons to collapse or expand the view of functions belonging to lower hierarchical levels. Clicking on a function or a source line in the trace tree pane 310 causes the trace detail pane 316 and the source pane 318 to change to display information relevant to the function. Selecting a function in the trace tree 330 and pressing the delete button on the keyboard removes the selected function from the trace. This is equivalent to filtering the function out of the trace.
  • the trace data is written to a buffer in memory called the trace buffer 105 , and from there either displayed in the trace tree pane 310 (when performing an online trace) or written to a log file (when performing a remote trace).
  • the trace buffer 105 is organized as a circular buffer of fixed size. The size of the trace buffer 105 can be set by the developer 112 . When the trace buffer 105 is fill, new trace records overwrite the oldest records contained in the buffer 105 .
  • the trace information could be stored in a buffer, which simply added trace records without overwriting old records.
  • loss of old data is acceptable because, when the client 102 malfunctions, the developer 112 is usually interested in the most recent records prior to the malfunction. Thus, there is usually little need to keep all of the records, especially the oldest ones.
  • the size of the trace buffer 105 is set so that it will be big enough to hold a large number of records without consuming too many system resources. Typically, 20,000 to 40,000 records are kept.
  • the trace buffer 105 When the trace buffer 105 is written to a log file 122 , the trace records are preferably appended to the end of the log file 122 . In a log file, old records are not deleted, and the trace size is limited only by the available disk space.
  • the trace tree is actually an image of the trace buffer 105 . Because of this, the trace tree will not display more records than the trace buffer 105 contains, so old records are deleted (“scrolled out” of the display).
  • the rows counter at the top of the trace tree pane 310 indicates the number of records in the trace buffer 105 and the number of rows in the trace tree. Because the buffer 10 S is circular, the number of rows in the trace tree 330 continuously grows during the beginning of the tracing process until the buffer wraps (typically 20,000 to 40,000 records). Thereafter, the number remains approximately at the same level as old records are overwritten with new records.
  • the exact number of records that are kept in the trace buffer 105 depends on the size of the trace records.
  • the size of each trace record is determined by the TCI options specified by the developer 112 . For example, if the developer 112 requires tracing of “this” class members, the size of the records will increase and the number of records in the buffer will decrease.
  • the analyzer 106 and the agent 104 can trace a multi-threaded and multi-processed client 102 .
  • a thread caption bar 320 For multi-process applications, similar horizontal bars, called process caption bars (not shown), separate trace lines belonging to different processes.
  • the thread caption bar 320 and the process caption bar separate the trace tree 330 into sections. These caption bars represent a context switch in the application, between threads and between processes. Process caption bars are similar to the thread caption bar 320 , therefore any future mention of threads also applies to processes in multi-process applications.
  • the thread caption bar 320 contains a name field, a process ID number field, and a thread ID number field 321 .
  • the trace tree 330 itself, there is an up arrow at the top of each section, and a down arrow at the bottom of each section. Clicking the up arrow causes the displayed trace tree 330 to jump to the previous point in the trace tree 330 where the thread gained control. Clicking the down arrow causes the displayed trace tree 330 to jump to the next point in the trace tree 330 where the thread gains control.
  • the trace tree 330 also provides an expand/collapse control button 326 to allow the developer 112 to expand and collapse the current thread view.
  • the trace tree pane 310 also provides a vertical scroll bar for scrolling up and down through the trace tree 330 .
  • the trace tree pane 310 When the trace tree pane 310 is scrolled up or down to a section containing functions of lower hierarchical levels, the portion of the trace tree 330 displayed in the window is shifted leftwards.
  • the depth of this shift is indicated by a stack level indicator 328 appearing in a rectangle in the upper left corner under the thread caption bar 320 (as shown in FIG. 3).
  • the trace detail pane 316 shows available details describing the function selected in the trace tree view.
  • FIG. 11 shows a trace detail pane 1116 that displays a C++ class having several members and methods, a class derived from another classes, and classes as members of a class.
  • the trace details are displayed in a trace detail tree 350 which is a hierarchical tree structure.
  • a right arrow 351 in the trace detail pane 316 marks where the function is called.
  • a left arrow at the bottom of the detail tree 350 marks where the function returned to its caller.
  • an argument in the call window of a function is of the aggregate type, the argument's components will be displayed beneath the right arrow 351 in the form of a hierarchy tree. If an argument is of the pointer type, and pointers were selected in the advanced trace options, then the value displayed in the trace detail tree 350 will be that of the data to which the pointer points. However, for pointer fields that reside within arguments, only the address contained in the pointer will be displayed. In other words, in the preferred embodiment, the pointer is de-referenced only for the first level arguments. One skilled in the art will understand that other pointers could be de-referenced as well, and that the trace detail tree 350 could display the value pointed to by arguments deeper than the first level.
  • the trace detail pane 316 also shows time stamps.
  • the time stamps display the time that a function is called and the time that the function returns to its caller.
  • the arguments are an array of known size, then the elements of the array will be displayed. If the array size is unknown, then the value displayed is the value of the first array element. If the argument is of character pointer type, then the string value is displayed. If the argument is numeric, then the decimal, hex, or decimal and hex values are displayed, depending on the selection made in the advanced trace options. Right-clicking the mouse when it points in the trace detail pane 316 displays a popup menu which allows the developer 112 to select how numeric arguments are displayed (as decimal, hex, or decimal and hex values).
  • the source pane 318 shows the source code for the selected function or source line selected in the trace tree 330 .
  • the source code listed in the source pane 318 is automatically scrolled to the location of the selected object, if possible.
  • the line in the source code is displayed in bold and is pointed to by an arrow.
  • the analyzer 106 looks for the source file in the current directory and in the directory indicated in the .PDB file. If the source file is not found, the source pane remains blank. In this case, the developer 112 can change the source file search path in order to display the source code.
  • the developer should select a function in the trace tree 330 , then right-click in the source pane to open a pop-up menu, and then select the “Source Location” from the pop-up menu.
  • the developer 112 can add additional source directories and remove source directories by selecting the “Options” command from the “View” menu on the menu bar 304 .
  • Source file paths can also be removed.
  • the analyzer 106 provides several features which make it easier to analyze trace information and pinpoint a bug in the client 102 . These features can be used both while performing an online trace and while viewing trace information from a remote log file 122 . Analysis features include: saving trace information to a log file 122 ; printing the trace tree 350 ; searching for trace elements; locating a function in the trace options window 500 ; filtering the trace information; adding, editing, deleting and locating bookmarks; clearing the trace tree pane; and displaying multiple windows. Additional features available for online tracing include saving trace information to the log file 122 .
  • the “Find” button on the toolbar 306 is used to initiate a search for an element in the trace tree 330 .
  • Clicking the Find button opens a “Find what” dialog box in which the developer 112 can enter a search text string.
  • the find what dialog provides a “Find Next” button to start a search for the occurrence of the specified search text.
  • the first occurrence of the specified text is highlighted in the relevant pane.
  • Functions in the source code displayed in source pane 318 can be located in the trace options dialog 500 by right-clicking inside the source code in the source pane 318 .
  • the right-click opens a pop-up menu.
  • the developer selects a “Locate in Trace Options” command from the pop-up menu to open the trace options window 500 .
  • the trace options window 500 will open with the desired function displayed and highlighted.
  • the trace filter previously described in the text relating to FIG. 5 is a tool that enables the developer 112 to select the functions to trace.
  • the trace continues in the background, and when the developer 112 closes the trace options window 500 the new filter is applied to the display in the trace window 300 .
  • the developer 112 can also use the trace options window 500 to change the display while performing an off-line trace. This enables the developer 112 to filter out traced elements and display a subset of the traced information.
  • the information contained in the log file is not modified, only the display changes.
  • a bookmark allows the developer 112 to mark trace lines (functions or source lines) in the trace tree 330 .
  • the developer 112 can also edit the name of a bookmark or delete the bookmark it as required.
  • Bookmarks are inserted in the trace tree 330 by using the bookmark button on the toolbar 306 . Bookmarks allow easy jumps to the bookmarked element.
  • the developer will: select the trace line (a function or source line in the trace tree 330 ) to mark; press the bookmark button to open the bookmark window; type the bookmark name in the bookmark widow; and click the OK button.
  • a waiving flag icon 332 appears on the left of the bookmarked trace line in the trace tree 330 .
  • the bookmark name is displayed whenever the cursor is placed over the bookmarked line.
  • the developer 112 repeats the steps to create a bookmark.
  • the developer 112 can press a delete button on the bookmark window.
  • the “Goto Bookmark” command from the “Edit” menu is used to go to a bookmark in the trace tree 330 .
  • Each instance of the analyzer 106 can be open simultaneously. Each instance can define different filter options for each window. This feature is especially useful for multi-threaded applications, where it is convenient to observe each thread in a separate window.
  • the analyzer 106 provides for starting and stopping of an online trace. All trace points are disabled when tracing is stopped. Stop is helpful if the trace adversely influences the application performance and it appears that the subsequent operations in the client 102 are not relevant to the problem being analyzed.
  • the Start/Stop Tracing button on the toolbar 306 is used to toggle tracing on and off. Tracing is stopped or restarted as specified. When tracing is stopped, the boundaries of the lost tree portion appear in the trace tree pane 330 as a tear 1202 , as shown in FIG. 12. When tracing is resumed, the trace tree 330 continues under the tear 1202 .
  • One aspect of the present invention is the attaching mechanism used by the BugTrapper to collect trace information.
  • tracing is accomplished by attaching to the memory image of the application (i.e., the copy of the executable code that is loaded into RAM or other memory for execution).
  • the memory image of the application i.e., the copy of the executable code that is loaded into RAM or other memory for execution.
  • Attaching to the client 102 in memory allows function calls, returns, and other source lines to be traced.
  • the attaching mechanism also allows for the tracing of any executable, including optimized (release) builds, multi-threading and multi-processes, longjumps, signals, exceptions, and recursions.
  • the BugTrapper client-side trace library 125 is attached to the client 102 , in part, by modifying certain executable instructions of the memory image of the client 102 .
  • This process is generally called “executable code instrumentation,” or simply “instrumentation.”
  • the instrumentation process is performed such that the functionality of the client 102 is preserved. Because the instrumentation is made only on the memory image, there is no need to pre-process or modify the source code or executable files of the client 102 .
  • Use of the client-side trace library 125 provides significant advantages over the prior art by eliminating the need for context switches when debugging a program. Context switching has the effect of significantly slowing down the rate of execution.
  • the tracing implementation provided by BugTrapper can therefore be used to study the real time behavior of a program and detect bugs resulting from such behavior.
  • a preferred embodiment runs under the Windows-NT/2000, Windows-95/98 and similar operating systems supplied by Microsoft Inc.
  • the following description of the internal details of the BugTrapper will thus be described in terms of the Windows-NT/2000/95/98 operating systems with the understanding that the invention is not limited to said systems.
  • the trace libraries 124 , 125 include a number of callable functions (discussed below). By using the callable functions, and system functions provided by the Win32 API (application program interface), the trace libraries performs two major tasks: (1) attaching specialty functions to application, and (2) tracing the execution of the application's executable code. Both of these tasks are described separately below.
  • the agent-side trace library 124 is primarily responsible for attaching the client-side trace library 125 to the client 102 .
  • the agent-side trace library 124 also provides communication with the client-side library 125 .
  • the client-side trace library 125 is primarily responsible for placing data in the trace buffer 105 .
  • client process is used to refer to the executable code of the client 102 that has been loaded into a memory space for execution.
  • BugTrapper refers both to BugTrapper Agent or BugTrapper Analyzer, depending whether it is operating in the Online mode or the Remote mode.
  • the act of attaching to a currently running process is known as a Process Attach.
  • the act of attaching to a new process, during the creation of the new process, in order to trace the new process from its start is known as a Creation Attach.
  • a Creation Attach it is desirable to pause the client 102 process as close as possible to its entry point so that virtually all of the functions executed by the client 102 will be traced.
  • each process resides at a distinct location or “address space” in memory.
  • a DLL such as the client-side trace library 125 , which resides in another address space, cannot simply be loaded into the same address space as the client process.
  • BugTrapper forces the client process to load the client-side trace library 125 DLL (using a process called injection) into the process space of the client process.
  • the injection process for Process Attach in Windows-NT is accomplished by using the CreateRemoteThread( ) function of the Win32 API, to create a remote thread in the client process and to force the newly created thread to run code in the client process.
  • the code that is run by the remote thread is a copy of an injection function copied to the remote thread using the Win32 API WriteProcessMemory( ) function.
  • the Process Attach involves the following sequence of events shown in FIG. 13 beginning with a procedure block 1302 where the function inst_attach( ) of the tracing library is called in BugTrapper, using the process ID (“PID”) of the client (client) process as an argument.
  • the function inst_attach( ) performs the following operations:
  • the new thread created in step 4 starts executing at the address to which the injection function was previously copied in step 3.
  • the procedure then advances from the procedure block 1302 to a procedure block 1304 where the injection function starts running in the new thread of the client process.
  • the injection function loads the client-side trace library 125 .
  • the procedure advances from the procedure block 1304 to a procedure block 1306 where the client-side trace library 125 runs in the context of the new thread while the instrumentation is taking place.
  • the client-side trace library 125 communicates with BugTrapper (i.e., the agent-side trace library 124 ), handling commands, and actually performing the instrumentation.
  • BugTrapper i.e., the agent-side trace library 124
  • the procedure advances from the procedure block 1306 to a procedure block 1308 where the client-side trace library 125 exits, and the injection function destroys its own thread and stops executing by calling the ExitThread( ) function.
  • the client 102 continues to run, without any substantial alteration to the functionality of the client 102 .
  • Creation Attach is accomplished under Windows-NT by creating the client process in a suspended state, by using the CREATE_SUSPENDED flag in the CreateProcess( ) function.
  • the previously described procedure cannot be used, since none of the system DLLs in the client process have been initialized.
  • KERNEL32.DLL is not loaded, the client-side trace library 125 cannot be loaded.
  • the present attaching procedure overcomes this difficulty by performing the following attaching procedure, which begins at a procedure block 1402 shown in FIG. 14.
  • the attaching procedure begins in block 1402 , in which the client process is created in a CREATE_SUSPENDED state.
  • the attaching procedure then advances to a procedure block 1404 .
  • BugTrapper makes a call to the inst_prepare( ) of the agent-side trace library 124 .
  • the inst_prepare function using WriteProcessMemory( ) and VirtualAllocEx( ), allocates memory in the client process and copies a small assembly language code segment into the allocated space.
  • the procedure then proceeds to a procedure block 1406 where the inst_prepare function overwrites the entry point of the client executable in the client process with a jump instruction to the new assembly code.
  • the attaching procedure then advances to a procedure block 1408 wherein the inst_prepare function allows the client process to resume, and thereby start the initialization process for the client process.
  • execution continues to the entry point of the client executable, which now contains a jump to the new assembly code.
  • the attaching procedure advances from the procedure block 1408 to a procedure block 1410 .
  • the assembly code restores the original client entry point, and suspends the client process. At this point, the client process is suspended without running any executable code, but is past the initialization stage.
  • the attaching procedure then advances to a procedure block 1412 .
  • BugTrapper can now call inst_attach( ) to attach to the client process and start instrumenting it. When the attaching procedure is complete, it can allow the client process to resume. The assembly code simply jumps directly is back to the original entry point of the client 102 , and execution of the client 102 starts with the proper instrumentation.
  • [0167] 2 It copies various data (such as the Injection Function code and the path for the client-side trace library 125 ) into the client's address space, using WriteProcessMemory function.
  • the injection function initializes the client-side trace library 125 and the communication channel in the client process so that the two trace libraries 124 , 125 can communicate.
  • BugTrapper calls the inst95_attach_to_running_process function in the agent-side trace library 124 .
  • the inst95_attach_to_running_process function executes the following sequence of operations:
  • create_remote_thread (not to be confused with the CreateRemoteThread API call in Windows-NT), that performs the following operations:
  • a device driver intercepts the INT 1 interrupt that is caused by the first executed instruction of the above mentioned valid thread. Upon receiving the interrupt, the device driver sets the instruction pointer to the start address of the injection function that was copied onto the shared heap, and clears the single step flag in the valid thread context. After clearing the single step flag, the driver proceeds as if the interrupt was successfully handled, and returns the control to Windows-95.
  • the injection function starts to execute in the context of the client process.
  • the injection function continues as in the case of Creation Attach described above and creates a new thread that subsequently performs the loading of the client-side trace library 125 into the address space of the client 102 .
  • the injection function executes the breakpoint instruction, which immediately causes an INT 3 interrupt that is intercepted by the device driver.
  • the device driver restores the thread context that was stored immediately after the thread was suspended and then the device driver returns the control to Windows-95.
  • the trace function involves tracing the execution of the instrumented client process and reporting certain events to BugTrapper.
  • the client-side trace library 125 accomplishes the tracing function by using breakpoints, and by reporting information concerning the status of the client process upon reaching the breakpoints.
  • the execution trace is stored within a fixed size circular trace buffer 105 in memory.
  • the remote mode of operation the contents of the trace buffer 105 are copied to a trace log file 122 .
  • the trace log file 122 thus contains trace information that reflects a time window ending with the writing of the log file 122 .
  • the length of this time window is generally dependent upon the size of the trace buffer 105 .
  • the trace buffer 105 is small enough to allow the trace log file 122 to be sent to the developer's site using standard email programs.
  • the display is constantly being updated mirroring the trace buffer 105 . The displayed information can also be saved to a log file 122 and later re-displayed.
  • the process of tracing the execution of the client 102 involves the steps of installing breakpoints, triggering breakpoints, and catching breakpoints.
  • Breakpoints are installed by overwriting the target address of the assembly instruction to be traced with an INT 3 instruction, occupying a single byte of space.
  • the original byte at that address, along with other information, is stored in a data structure created by the agent-side trace library 124 .
  • the data structure which describes all trace points, is preferably a hash table comprising a corresponding array of records for each hash value.
  • the hashing is implemented with the target address as a parameter, allowing for a very fast searching for information concerning a trace point by using its address.
  • Breakpoints are triggered whenever the target address gets executed.
  • the breakpoint instruction When the target address is executed, the breakpoint instruction generates an INT 3 interrupt.
  • this interrupt On Windows NT/2000 this interrupt is handled by the Windows-NT/2000 kernel-mode handler.
  • the kernel-mode handler transfers the execution to the user-mode routine KiUserExceptionDispatcher inside NTDLL.DLL (the system DLL).
  • KiUserExceptionDispatcher routine handles the task of locating a corresponding exception filter for the particular kind of exception.
  • the client-side trace library 125 When the client-side trace library 125 is initially loaded, a patch is applied to the KiUserExceptionDispatcher function, having the effect of forcing a call to a function in the client-side trace library 125 before processing the exception.
  • This function (the BugTrapper exception handler), determines whether the breakpoint occurred as a result of the tracing or for another reason. An exception that is not the result of tracing (i.e., no trace point has been installed at this target address) will result in a return of execution to KiUserExceptionDispatcher.
  • the handler When an exception is the result of the tracing, the handler notifies the appropriate routines in the tracing library 125 and defers the breakpoint, thereby allowing the original instruction at the target address to execute.
  • the original byte at the target address is restored, returning execution while setting a trap flag in the FLAGS register of an x86 processor.
  • the trap flag causes an INT 1 interrupt to occur as a result of the execution of the original instruction. This interrupt is also treated as an exception, eventually reflecting into the BugTrapper exception handler.
  • the handler restores the breakpoint instruction at the target address and returns for second time, allowing the client process code to continue running as if nothing happened.
  • interrupt handler In Windows 95/98, interception of the INT3 and INT1 interrupts is done by a device driver.
  • the driver registers its interrupt handler for INT1 and INT3 interrupts.
  • the interrupt handler checks to see if the interrupt occurred in the context of the client process. If the interrupt occurred in the client process, then the interrupt handler changes the instruction pointer of the thread to the address of a routine in the client-side trace library 125 , and passes back on its stack any data needed by the function (such as thread context). After this function handles the trace point, it triggers an additional INT 3 interrupt that is recognized by the device driver.
  • the device driver acts as if the interrupt has been successfully handled, causing the traced thread to continue execution.
  • the device driver recognizes that an interrupt has occurred not in the context of the client process, then the device driver passes the interrupt to the operating system interrupt handler (thus not affecting the normal behavior of other programs in the system or the operating system itself).
  • the client-side trace library 125 When tracing a plain source line (e.g., not a function entry or exit point), the client-side trace library 125 inserts data in the trace buffer to indicate that a trace point has been reached.
  • a special mechanism is used because tracing of information regarding both the entry to and exit from the function is desired. This is preferably accomplished by modifyfing the return address of the function.
  • the return address is located on the stack. The original return address is saved and a new return address point is inserted. The new return address points to a special assembly stub inside the client-side trace library 125 . Therefore, when the function returns the assembly stub is called.
  • the stub reports to the client-side trace library 125 function that the function has exited, and the client-side trace library 125 writes this trace point to the trace buffer. The stub then jumps to the real return address of the function.
  • the BugTrapper attaching technology can be used with multi-process and multi-threaded applications. Every trace record is associated with a process and a thread. Stack information is separately kept for each context. Therefore, the BugTrapper can trace two or more client executables at the same time. This allows BugTrapper to display any context switches between the processes and threads of the client(s) 102 .
  • the BugTrapper supports the tracing of Dynamically Linked Libraries (DLLs), including all sub-formats such as OCX, Active-X, drivers (DRV), etc.
  • DLLs Dynamically Linked Libraries
  • the tracing of DLLs is accomplished by analyzing the client 102 process to find the DLLs it uses, and by displaying the source structures of the DLLs to the user. The user can then specify trace points within the DLLs as is done for any other executable.
  • BugTrapper finds the base address into which the DLL was loaded, and uses the address to translate the addresses in the debug information to actual addresses in the running image.
  • the BugTrapper also supports the tracing of DLLs for which no debug information is available, such as system DLL's.
  • the tracing of such DLLs is accomplished by tracking the exported functions used by the DLLs. This is done by analyzing the DLL exported function table in the client 102 to retrieve information concerning the exported function names and addresses.
  • the BugTrapper also supports tracing of sub-processes. For example, when a first process P 1 and a second process P 2 are listed in the executable pane 314 , and P 1 spawns P 2 as a sub-process, then BugTrapper will start tracing P 2 . This is done by tracing the CreateProcess function in all of the traced processes, even if the developer 112 did not specify tracing the CreateProcess function. By tracing CreateProcess, BugTrapper will know that PI spawned a sub-process, and BugTrapper can identify that the sub-process name (P 2 in the present example) is listed in the executable pane 314 . When the sub-process is created, BugTrapper will attach to the sub-process using the “Creation Attach” mechanism discussed above.
  • Variables and memory values can also be traced by BugTrapper.
  • the user can view variable values as in an ordinary debugger.
  • the variables may include function arguments, the C++ “this” pointer, function return values, local variables, global variables, static variables, etc.
  • the data to which a pointer is pointing can also be traced. This information can be viewed for optimized builds, which cannot always be done by current debuggers. Tracking of variables in memory is accomplished by first analyzing the debug information to find the address (global, static, stack, or dynamic address) of the variable and the data it holds. BugTrapper then uses these addresses to dump to the trace log file 122 the memory content according to variable size.
  • BugTrapper records the point where the failure occurred, even if the line was not specified in the TCI file 120 . All stack variables are saved by using the Win32 debug API and the system library IMAGEHLP.DLL.
  • Communication between the client-side trace library 125 and the agent-side trace library 124 (in the agent 104 or the analyzer 106 ) can be divided into two categories. Category one comprises normal messages. Category two comprises trace data.
  • Normal messages include commands sent to the client-side trace library 125 such as, start trace function at a given address, or suspend tracing. Normal messages also include notifications sent by the client-side trace library 125 , such as creation of a sub-process or run-time loading of a DLL.
  • IPC Windows InterProcess Communication
  • Trace data itself is sent using a different mechanism, because of the quantity of data.
  • Trace data comprises: function calls (including the assembly address of the called function); values of parameters for each call; function return values (including function address); tracing of other source lines specified in the TCI file 120 (including their address); variables value at these addresses; etc.
  • the trace records are written to a shared memory area called the trace buffer 105 , and from there either displayed in the BugTrapper user interface by the analyzer 106 (when performing an online trace) or written to a log file by the agent 104 (when performing a remote trace).
  • the client-side trace library 125 and the agent-side trace library 124 prevent simultaneous access to the trace buffer using standard locking mechanism such as Mutex (in Windows-95) or Interlocked Functions (in Windows-NT).
  • the client-side trace library 125 preferably only writes trace data to the trace buffer 125 in shared memory.
  • the client-side trace library 125 preferably performs no I/O to the disk or to the display. Disk I/O and display updates are done later by the agent 104 or the analyzer 106 . This reduces the performance penalty imposed on the client 102 .
  • the SA array provides for very fast vertical scrolling. The SA array is updated each time a new record is read from the trace buffer 105 or the log file 122 , or when the developer 112 collapses or expands some of the trace tree.
  • the analyzer 106 when the analyzer 106 draws a trace tree, it performs the following steps: (1) lock the trace buffer 105 ; (2) scan new records and update the calls index and the SA array; (3) read and analyze the records that must be shown; (4) merge the records with the debug information 121 and create strings for each record; (5) draw the page; and (6) unlock the shared memory trace buffer 105 . Note that when reading data from a trace log file 122 only steps 3-5 are performed, since steps 1, 2, and 6 are unnecessary.
  • a visual problem monitor assists a support technician (e.g., a help desk person, a system administrator, etc.) in remotely analyzing problems by gathering run-time information about: program execution; interaction between the executing program and the operating system; system resources; user actions; file operations; failed operations and screen output. For example, file interactions, DLL loading and/or registry accesses can be monitored non-intrusively.
  • the support technician can remotely view user interactions with the program and corresponding reactions by the system. This mitigates (or in some cases eliminates) the “questions and answers” game that support technicians usually play with users in order to understand what the user did and what happened on the customer's PC.
  • the support technician can check the parameters that influenced the program more effectively than by scanning static data gathered from the user's computer. For example, there is no need to check the versions of all the DLL's in the user's computer or to dump the entire registry from the user's computer. Rather, by using the visual problem monitor, the support technician can choose to view only the DLL's used by the traced program, or the registry entries or files accessed by the traced program.
  • the visual problem monitor helps the support technician understand the details of problems in cases where programs produce cryptic messages and in cases where the programs simply crash without any specific error message.
  • the visual problem monitor uses the executable hooking technology described above.
  • the hooking technology allows trace points to be added to a running program while preserving the program's original operation. Support and help desk technicians can use this technology for tracing software interaction with the system and other API functions, without access to the source code, and therefore it does not require extra work to be done by the software vendors.
  • tracing of API functions using BugTrapper hooking technology requires one standard TCI file for all Windows applications.
  • FIG. 15 is a block diagram showing the components of a visual problem monitor system 1500 .
  • the visual problem monitor system 1500 includes an information-gathering module 1501 that runs on the user's computer along with a client program 1509 , and an information-display module 1502 that runs on the support technician's computer.
  • the information-gathering module 1501 includes an Application Programming Interface (API) event hooking module 1506 , a message event hooking module 1507 , and a program code event hooking module 1508 .
  • API event hooking module 1506 , the message event hooking module 1507 , and the program code event hooking module 1508 are controlled by, and send data to, an event processing engine 1503 .
  • the event processing engine 1503 stores information gathered from the program 1509 and the user's computer system in a log file 1505 .
  • the event processing engine retrieves commands and event tracing instructions from an event knowledge base 1504 .
  • System interaction tracing allows support personnel to gather information about behavior of the program 1509 , and to diagnose sources of errors.
  • the dynamic tracing mechanism provided by the visual problem monitor system 1500 provides logging the following Windows API functions and GUI events:
  • IPC mapshores, shared memory, messages, etc.
  • the events are synchronized by time and logged into the log file 1505 .
  • Several mechanisms can be used for gathering information for event logging. Monitoring of Win32 API calls can be done using any of the following tools and techniques:
  • Screen-capture tools e.g. Lotus SreenCam
  • Remote PC administration tools e.g. Norton PCAnywhere, Netvision OpSession, AT&T WinVNC
  • One embodiment of the visual problem monitor system 1500 uses the following logging mechanisms: (1) the hooking mechanism described above is used to gather event data for logging of Windows API functions; and (2) hooking to Windows messages related to keyboard and mouse events and screen updates is used to gather event data for logging of GUI interactions and screen capture.
  • standard data compression techniques are used for compression of the visual information and other records in the log file 1505 .
  • Registry operations (For example, the information-gathering module 1501 can detect when the application 1509 tries to read a non-existent key, a key has a wrong value, a key points to a missing file, etc.)
  • INI files e.g. Profile Strings
  • Loaded DLLs For example, the information-gathering module 1501 can detect loaded DLL name, version, date, location on disk, etc. and pinpoint to a missing DLL or a DLL having an incorrect version number.
  • the information-gathering module 1501 can collect information on missing, incorrect, and misbehaved NT services and drivers.
  • the information-gathering module 1501 can collect information regarding spawned executables (e.g., executable name, version, id, etc.). The information-gathering module 1501 can also log information regarding unsuccessful attempts to create a sub-process (e.g. because the executable was not found, etc.)
  • Crash information The information-gathering module 1501 collects information regarding the name of an executable (or DLL) where a crash occurred, contents of the stack at the time of the crash, memory status, sequence of function calls before the crash, etc.
  • Inter-Process Communication e.g., Common Object Model (COM) messages, Distributed COM (DCOM) messages, semaphores, shared memory, messages, etc.
  • COM Common Object Model
  • DCOM Distributed COM
  • Networking events e.g., Winsocket messages, Remote Procedure Call (RPC) information, etc.
  • the information collected by the information-gathering module 1501 and stored in the log file 1505 is passed to a remote support technician in order to allow the support technician to resolve software support issues related to the program 1509 .
  • the log file 1505 created by the information-gathering module 1501 is transferred to the information-display module 1502 running on the support technician's computer.
  • the log file 1505 can be transferred using email, WEB access, network file transfer protocols and the like.
  • the support technician can select between two modes of operation. In a first mode, the information-gathering module 1501 is continuously active. When a problem occurs, the log file 1505 is created. If the user chooses to call the help desk, the support technician can obtain the log file 1505 and use it for analysis. In a second mode, the information-gathering module 1501 is active on demand. In the second mode, when the user calls the help desk, the support technician activates the information-gathering module 1501 on the user's computer and receives the log file 1505 using network communication protocols. In one embodiment, the support technician receives the log file 1505 by using a TCP/IP-based communication protocol.
  • the information-display module 1502 is used by the support technician to view the data from the log file 1505 (as shown in FIG. 16 below).
  • the information-display module 1502 allows the support technician to filter the display to show only specific types of events or the whole scenario. In one embodiment, suspicious events (e.g. loading a non-existing DLL) are highlighted.
  • FIG. 16 shows the graphical user interface (GUI) 1600 provided to the support technicianby the information-display module 1502 .
  • the GUI 1600 includes a window 1609 that lists executable modules (by file name) that comprise the program 1509 and the processes created by the executable modules.
  • a window 1608 lists module information including the DLLs (with version numbers) used by the executable module.
  • a window 1605 (shown as a tab) provides crash information in the event of a crash of the program 1509 .
  • a window 1607 (shown as a tab) lists environment information including environment variables, registry variables, and INI variables used by the program 1509 .
  • a window 1607 (shown as a tab) lists system information about the user's computer (that is, the computer running the program 1509 that is being traced).
  • a window 1603 lists event information (by process) in chronological order.
  • a window 1606 (shown as a tab) provides options to allow the support technician to define filters for the event information shown in the window 1603 . The filters allow the support technician to specify which types of events are traced and displayed in the window 1603 .
  • a window 1602 shows screen captures from the user's computer.
  • a group of video controls 1601 allows the support technician to “play the movie” of screen capture events obtained from the user's computer using standard video-type controls such as stop, play, rewind, fast forward, next frame, etc.
  • the GUI 1601 provides verbalization of data from the log file 1505 .
  • Events logged in the log file 1505 are displayed as textual strings in plain English, or another natural language in the window 1603 .
  • the support technician and PC users need relatively less programming experience to use the system 1500 .
  • the screen captures shown in the window 1602 are replayed synchronously with the even displays provided by the GUI 1601 . This allows the support technician to see what was happening on the user's screen when various events occurred in the user's system.
  • screen captures in the window 1602 are replayed synchronously with the replay of events in the window 1603 , 1608 , etc.
  • the support technician can use the controls 1601 to control (e.g., pause, rewind, etc) the animated screen-capture display (in the window 1602 ) and the animated event displays provided by the GUI 1601 .
  • the log file 1505 is an extension of the trace log file 122 shown in FIG. 1B.
  • the log file 1505 includes records related to logging of screen updates and user interaction with the application as follows:
  • the recording of GUI-related objects is based on intercepting Windows messages by the message event hooking module 1507 .
  • the message event hooking module 1507 is supplied with an Attach(ThreadIdent) method that sets a hooking function with help of the Windows SetWindowsHookEx( ) function and creates an additional thread.
  • the Hook( ) function in the current thread analyzes intercepted messages and window regions that are re-drawn. As a result, special messages are generated and directed to the additional thread for transforming into records and writing into DirectAccessStream objects.
  • the vlFramebufferUpdate records are generated to save bitmaps of invalidated regions of windows.
  • bitmaps are created by reading video memory using Microsoft DirectX methods.
  • each created bitmap stores only a minimal rectangle corresponding to the window update region.
  • the visual problem monitor system 1500 provides more information about the missing file problem. Consider, for example, a simple example with Acrobat Reader. If font file Zd______ .pfb is missing, then the Acrobat Reader is not started and the user gets the cryptic message “No Zapff)ingbats or Multiple Master fonts found.” After getting this cryptic message, the user has to guess what happened with the application or the system and where it is possible to find the suddenly lacking fonts and how to restore the system to working order. A typical solution in such a case is to reinstall the whole application.
  • the visual problem monitor system 1500 can easily detect that the program lacks the file Zd______.pfb in the directory C:Acrobat3ReaderFonts, thus providing a better way for the problem resolution.
  • DLL management represents a significant challenge for Windows users.
  • the following scenario illustrates the problem. Assume that installation of a vendor's program overrides the system DLL mapi32.dll with an older version without any warning message. As a result, after installing the vendor's program the Microsoft Notepad+ program fails to send any mail and gives the user a nonspecific message “SendMail failed to send message.” Since the visual problem monitor system 1500 tracks the use of DLLs, visual problem monitor system 1500 can show a support technician that a function from mapi32.dll made a call to a nonexistent executable mapisrv.exe (the problem lies in MAPI version mismatch). In one implementation, visual problem monitor system 1500 includes a DLL management module that monitors DLL-related operations and detects typical DLL problems.
  • the visual problem monitor and the BugTrapper can be used in concert to locate problems in software.
  • Support technicians typically analyze visual problem monitor trace information without access to the source code.
  • the trace log is transferred to a software developer.
  • Software developers can open visual problem monitor trace logs using the BugTrapper analyzer and by accessing source code can view the calls of traced API functions in the source code.
  • the escalation workflow is illustrated in the flowchart 1700 shown in FIG. 17.
  • the flowchart 1700 begins at a process block 1701 where a visual problem monitor agent (comprising the event processing engine 1503 and one or more of the hooking modules 1506 - 1508 ) and the event knowledge database 1504 (an API-level TCI file) is sent to a user (e.g., a customer) site.
  • the process block 1701 typically happens in response to a user complaint (regarding a software problem) to a support site.
  • the user generates a trace log file 1505 by running (or attempting to run) the malfunctioning program client in connection with the visual problem monitor agent.
  • the trace log file 1505 is transferred to the support site (e.g. by using the Internet, computer network, etc.).
  • the trace log file 1505 is analyzed by using the visual problem monitor. If the reason for the software malfunction is found by using the visual problem monitor, then the process advances to a process block 1706 where the user is informed of the nature of the problem and, typically, how to correct the problem; otherwise, the process advances to a process block 1707 .
  • the trace log file 1505 is transferred to a developer (e.g., at a developer site).
  • the developer uses the BugTrapper source code analyzer (with application source code inputs from a process block 1709 ) to search for program bugs in the malfunctioning application.

Abstract

A software system is disclosed that provides remote troubleshooting and tracing of the execution of computer programs. The software system allows a remote software developer or help desk person to troubleshoot computer environment and installation problems such as missing or corrupted environment variables, files, DLLs, registry entries, and the like. In one embodiment the software system includes an information-gathering module that gathers run-time information about program execution, program interaction with the operating system and the system resources. The information-gathering module also monitors user actions and captures screen output. The information-gathering module passes the gathered information to an information-display module. The information-display module allows a support technician (e.g., a software developer, a help desk person, etc.) to see the user interactions with the program and corresponding reactions of the system. In one embodiment, the information-display module allows the support technician to remotely view environment variables, file access operations, system interactions, and user interactions that occur on the user's computer and locate failed operations that cause execution problems

Description

    REFERENCE TO RELATED APPLICATIONS
  • The present application claims priority benefit of Provisional Application No. 60/186,636, filed Mar. 3, 2000, titled “SYSTEM AND METHOD FOR SOFTWARE DIAGNOSTICS USING COMBINATION OF VISUAL AND DYNAMIC TRACING,” the disclosure of which is incorporated herein by reference in its entirety.[0001]
  • BACKGROUND OF THE INVENTION
  • 1. Field of the Invention [0002]
  • The present invention relates to software tools for assisting software developers and help desk personnel in the task of monitoring and analyzing the execution of computer programs running on remote computers and detection and troubleshooting of execution problems. [0003]
  • 2. Description of the Related Art [0004]
  • The problem of ascertaining why a particular piece of software is malfunctioning is currently solved by a number of techniques including static analysis of configuration problems and conventional debugging techniques such as run-time debugging and tracing. Despite the significant diversity in software tracing and debugging programs (“debuggers”), virtually all debuggers share a common operational model: the developer notices the presence of a bug during normal execution, and then uses the debugger to examine the program's behavior. The second part of this process is usually accomplished by setting a breakpoint near a possibly flawed section of code, and upon reaching the breakpoint, single-stepping forward through the section of code to evaluate the cause of the problem. [0005]
  • Two significant problems arise in using this model. First, the developer needs to know in advance where the problem resides in order to set an appropriate breakpoint location. Setting such a breakpoint can be difficult when working with an event-driven system (such as the Microsoft Windows® operating system), because the developer does not always know which of the event handlers (callbacks) will be called. [0006]
  • The second problem is that some bugs give rise to actual errors only during specific execution conditions, and these conditions cannot always be reproduced during the debugging process. For example, a program error that occurs during normal execution may not occur during execution under the debugger, since the debugger affects the execution of the program. This situation is analogous to the famous “Heizenberg effect” in physics: the tool that is used to analyze the phenomena actually changes its characteristics. The Heizenberg effect is especially apparent during the debugging of time-dependent applications, since these applications rely on specific timing and synchronization conditions that are significantly altered when the program is executed step-by-step with the debugger. [0007]
  • An example of this second type of problem is commonly encountered when software developers attempt to diagnose problems that have been identified by customers and other end users. Quite often, software problems appear for the first time at a customer's site. When trying to debug these problems at the development site (typically in response to a bug report), the developer often discovers that the problem cannot be reproduced. The reasons for this inability to reproduce the bug may range from an inaccurate description given by the customer, to a difference in environments such as files, memory size, system library versions, and configuration information. Distributed, client/server, and parallel systems, especially multi-threaded and multi-process systems, are notorious for having non-reproducible problems because these systems depend heavily on timing and synchronization sequences that cannot easily be duplicated. [0008]
  • When a bug cannot be reproduced at the development site, the developer normally cannot use a debugger, and generally must resort to the tedious, and often unsuccessful, task of manually analyzing the source code. Alternatively, a member of the software development group can be sent to the customer site to debug the program on the computer system on which the bug was detected. Unfortunately, sending a developer to a customer's site is often prohibitively time consuming and expensive, and the process of setting up a debugging environment (source code files, compiler, debugger, etc.) at the customer site can be burdensome to the customer. [0009]
  • Some software developers attempt to resolve the problem of monitoring the execution of an application by imbedding tracing code in the source code of the application. The imbedded tracing code is designed to provide information regarding the execution of the application. Often, this imbedded code is no more than code to print messages which are conditioned by some flag that can be enabled in response to a user request. Unfortunately, the imbedded code solution depends on inserting the tracing code into the source prior to compiling and linking the shipped version of the application. To be effective, the imbedded code must be placed logically near a bug in the source code so that the trace data will provide the necessary information. Trying to anticipate where a bug will occur is, in general, a futile task. Often there is no imbedded code where it is needed, and once the application has been shipped it is too late to add the desired code. [0010]
  • Another drawback of current monitoring systems is the inability to correctly handle parallel execution, such as in a multiprocessor system. The monitoring systems mentioned above are designed for serial execution (single processor) architectures. Using serial techniques for parallel systems may cause several problems. First, the sampling activity done in the various parallel entities (threads or processes) may interfere with each other (e.g., the trace data produced by one entity may be over written by another entity). Second, the systems used to analyze the trace data cannot assume that the trace is sequential. For example, the function call graph in a serial environment is a simple tree. In a parallel processing environment, the function call graph is no longer a simple tree, but a collection of trees. There is a time-based relationship between each tree in the collection. Displaying the trace data as a separate calling tree for each entity is not appropriate, as this does not reveal when, during the execution, contexts switches were done between the various parallel entities. The location of the context switches in the execution sequence can be very important for debugging problems related to parallel processing. [0011]
  • Moreover, the computing model used in the Microsoft Windows environment, which is based on the use of numerous sophisticated and error-prone applications with many components interacting in a complex way, requires a significant effort for system servicing and support. Many Windows problems experienced by users are software configuration errors that commonly occur when the users add new programs and devices to their computers. Problems also occur due to the corruption of important system files, resources, or setups. Another important source of software malfunctioning is “unexpected” user behavior that was not envisioned by the software developers (as occurs when, for example, the user inadvertently deletes a file needed by the application). [0012]
  • SUMMARY OF THE INVENTION
  • The present invention overcomes these and other problems associated with debugging and tracing the execution of computer programs. The present invention provides features that allow a remote software developer or help desk person to debug configuration problems such as missing or corrupted environment variables, files, DLLs, registry entries, and the like. In one embodiment, a “visual problem monitor” system includes an information-gathering module that gathers run-time information about program execution, program interaction with the operating system and the system resources. The information-gathering module also monitors user actions and captures screen output. In one embodiment, file interactions, DLL loading and/or registry accesses are monitored non-intrusively. In one embodiment, the relevant support information captured by the information-gathering module is saved in a log file. The information-gathering module passes the gathered information to an information-display module. In one embodiment, the information-gathering module attaches to the running program using a hooking process. The program being monitored need not be specially modified or adapted to allow the information-gathering module to attach. [0013]
  • The information-display module allows a support technician (e.g., a software developer, a help desk person, etc.) to see the user interactions with the program and corresponding reactions of the system. This eliminates the “questions and answers” game that support personnel often play with users in order to understand what the user did and what happened on the user's PC. In one embodiment, the information-display module allows the support technician to remotely view environment variables, file access operations, system interactions, and user interactions that occur on the user's computer. In one embodiment, the information-display module allows the support technician to remotely view crash information (in the event of a crash on the user's computer), system information from the user's computer, and screen captures from the user's computer. [0014]
  • One aspect of the present invention is a software system that facilitates the process of identifying and isolating bugs within a client program by allowing a developer to trace the execution paths of the client. The tracing can be performed without requiring modifications to the executable or source code files of the client program. In one embodiment, the system interaction tracing can be performed even without any knowledge of the source code or debug information of the client. Preferably, the trace data collected during the tracing operation is collected according to instructions in a trace control dataset, which is preferably stored in a Trace Control Information (TCI) file. Typically, the developer generates the TCI file by using a trace options editor program having a graphical user interface. The options editor displays the client's source code representation on a display screen together with controls that allow the software developer to interactively specify the source code and data elements to be traced. The options editor may use information created by a compiler or linker, such as debug information, in order to provide more information about the client and thereby make the process of selecting trace options easier. Once the trace options are selected, the client is run on a computer, and a tracing library is used to attach to the memory image of the client (the client process). The tracing library is configured to monitor execution of the client, and to collect trace data, based on selections in the trace options. The trace data collected by the tracing library is written to an encoded buffer in memory. The data in the buffer may optionally be saved to a trace log file for later use. [0015]
  • The developer then uses a trace analyzer program, also having a graphical user interface, to decode the trace information into a human-readable form, again using the debug information, and displays translated trace information on the display screen to allow the developer to analyze the execution of the client program. In a preferred embodiment, the trace options editor and the trace analyzer are combined into a single program called the analyzer. The analyzer is preferably configured to run under the control of a multi-process operating system and to allow the developer to trace multiple threads and multiple processes. The tracing library is preferably configured to run in the same process memory space as the client thereby tracing the execution of the client program without the need for context switches. [0016]
  • In one embodiment, the software system provides a remote mode that enables the client program to be traced at a remote site, such as by the customer at a remote customer site, and then analyzed at the developer site. When the remote mode is used, the developer sends the TCI file for the particular client to a remote user site together with a small executable file called the tracing “agent.” The agent is adapted to be used at the remote user site as a stand-alone tracing component that enables a remote customer, who does not have access to the source code of the client, to generate a trace file that represents execution of the client application at the remote site. The trace file is then sent to the developer site (such as by email), and is analyzed by the software developer using the analyzer. The remote mode thus enables the software developer to analyze how the client program is operating at the remote site, without the need to visit the remote site, and without exposing to the customer the source code or other confidential details of the client program. [0017]
  • The software system also preferably implements an online mode that enables the software developer to interactively trace and analyze the execution of the client. When the software system is used in the online mode, the analyzer and agent are effectively combined into one program that a developer can use to generate trace options, run and trace the client, and display the trace results in near real-time on the display screen during execution of the client program. [0018]
  • In one embodiment, the support technician typically uses a default TCI file that allows the trace system to trace interactions and other important API functions without access to source code and/or debug information. This is useful for troubleshooting commercial applications such Microsoft Office, Internet Information Server, CRM and ERP systems, and other legacy products and the like.[0019]
  • BRIEF DESCRIPTION OF THE DRAWINGS
  • A software system which embodies the various features of the invention will now be described with reference to the following drawings. [0020]
  • FIG. 1A is a block diagram illustrating the use of the system to create a trace control information file. [0021]
  • FIG. 1B is a block diagram illustrating the use of the system in remote mode. [0022]
  • FIG. 1C is a block diagram illustrating the use of the system to analyze a trace log file. [0023]
  • FIG. 2 is a block diagram illustrating the use of the system in online mode. [0024]
  • FIG. 3A is an illustration of a typical main frame window provided by the system's trace analyzer module. [0025]
  • FIG. 3B is an illustration of a typical main frame window showing multiple threads. [0026]
  • FIG. 4 illustrates a process list window that lists the processes to be traced. [0027]
  • FIG. 5 illustrates the trace options window that allows a developer to select the functions to be traced and the information to be collected during the trace. [0028]
  • FIG. 6 illustrates a file page window that provides a hierarchical tree of trace objects listed according to hierarchical level. [0029]
  • FIG. 7 illustrates a class page window that provides a hierarchical tree of trace objects sorted by class. [0030]
  • FIG. 8 illustrates the process page window that provides a hierarchical tree that displays the traced process, and the threads for each process. [0031]
  • FIG. 9 illustrates the running process window that allows the user to attach to and start tracing a process that is already running. [0032]
  • FIG. 10 illustrates the start process window that allows the user to load an executable file, attach to the loaded file, execute the loaded file, and start tracing the loaded file. [0033]
  • FIG. 11 shows a trace detail pane that displays a C++ class having several members and methods, a class derived from another classes, and classes as members of a class. [0034]
  • FIG. 12 illustrates a trace tree pane, showing a break (or tear) in the trace tree where tracing was stopped and then restarted. [0035]
  • FIG. 13 is a flowchart which illustrates the process of attaching to (hooking) a running process. [0036]
  • FIG. 14 is a flowchart which illustrates the process of loading an executable file and attaching to (hooking) the program. [0037]
  • FIG. 15 is a block diagram showing the architecture of the visual problem monitor system including the information-gathering module and the information-display module. [0038]
  • FIG. 16 shows a multi-window display provided by the information-display module. [0039]
  • FIG. 17 is a flowchart illustrating the use of the system to solve software support problems.[0040]
  • In the drawings, like reference numbers are used to indicate like or functionally similar elements. In addition, the first digit or digits of each reference number generally indicate the figure number in which the referenced item first appears. [0041]
  • DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENT
  • The present invention provides a new model for software diagnostics by tracing the execution path of a computer program and user interaction with the computer program. In the preferred embodiment of the invention, this tracing model is implemented within a set of tracing and debugging tools that are collectively referred to as the BugTrapper system (“BugTrapper”). The BugTrapper tools are used to monitor and analyze the execution of a computer program, referred to as a client. One feature of the BugTrapper is that it does not require special instructions or commands to be imbedded within the source code of the client, and it does not require any modifications to be made to the source or executable files of the client. “Tracing,” or “to trace,” refers generally to the process of using a monitoring program to monitor and record information about the execution of the client while the client is running. A “trace” generally refers to the information recorded during tracing. Unlike conventional debuggers that use breakpoints to stop the execution of a client, the BugTrapper tools collect data while the client is running. Using a process called “attaching”, the BugTrapper tools instrument the client by inserting interrupt instructions at strategic points defined by the developer (such as function entry points) in the memory image of the client. This instrumentation process is analogous to the process of connecting a logic analyzer to a circuit board by connecting probes to test points on the circuit board. When these interrupts are triggered, the BugTrapper collects trace information about the client without the need for a context switch, and then allows the client to continue running. [0042]
  • The BugTrapper implementations described herein operate under, and are therefore disclosed in terms of, the Windows-NT/2000 and Windows-95/98 operating systems and the like. It will be apparent, however, that the underlying techniques can be implemented using other operating systems that provide similar services. Other embodiments of the invention will be apparent from the following detailed description of the BugTrapper. [0043]
  • Overview of BugTrapper System and User Model [0044]
  • The BugTrapper provides two modes of use, remote mode, and online mode. As discussed in more detail in the following text accompanying FIGS [0045] 1A-1C, using remote mode a developer can trace the remote execution of a program that has been shipped to an end user (e.g. a customer or beta user) without providing a special version of the code to the user, and without visiting the user's site or exposing the source code level details of the program to the user. The system can also be used in an online mode wherein the developer can interactively trace a program and view the trace results in real time.
  • Remote Mode [0046]
  • Remote mode involves three basic steps shown in FIGS. 1A through 1C. In [0047] step 1, shown in FIG. 1A, a developer 112 uses a program called the BugTrapper analyzer 106 to create a file called a trace control information (TCI) file 120. The TCI file 120 contains instructions that specify what information is to be collected from a program to be traced (the client). The analyzer 106 obtains information about the client from a build (e.g., compile and link) by-product, such as a link map file, or, as in the preferred embodiment, a debug information file 121. Typically, the debug information file 112 will be created by a compiler and will contain information such as the names and addresses of software modules, call windows, etc. for the specific client. The developer 112 then sends the TCI file 120 and a small tracing application called the agent 104 to a user 110 as shown in FIG. 1B. The user 110 runs the agent 104 and the client 102 and instructs the agent 104 to attach to the client 102. The agent attaches to the client 102 by loading a client-side trace library 125 into the address space of the client 102. An agent-side trace library 124 is provided in the agent 104. The client-side trace library 125 and the agent-side trace library 124 are referred to collectively as the “trace library.” The agent-side trace library 124 and the client-side trace library 125 exchange messages through normal interprocess communication mechanisms, and through a shared memory trace buffer 105. The agent-side trace library 124 uses information from the TCI file 102 to attach the client-side trace library 125 into the client 102, and thereby obtain the trace information requested by the developer 112.
  • The [0048] agent 104 and the client-side trace library 125 run in the same context so that the client 102 can signal the client-side trace library 125 without performing a context switch and thus without incurring the overhead of a context switch. For the purposes herein, a context can be a process, a thread, or any other unit of dispatch in a computer operating system. The client 102 can be any type of software module, including but not limited to, an application program, a device driver, or a dynamic link library (DLL), or a combination thereof. The client 102 can run in a single thread, or in multiple processes and/or multiple threads.
  • In operation, the [0049] agent 104 attaches to the client 102 using a process known as “attaching.” The agent 104 attaches to the client 102, either when the client 102 is being loaded or once the client 102 is running. Once attached, the agent 104 extracts trace information, such as execution paths, subroutine calls, and variable usage, from the client 102. Again, the TCI file 120 contains instructions to the client-side trace library 125 regarding the trace data to collect. The trace data collected by the client-side trace library 125 is written to the trace buffer 105. On command from the user 110 (such as when a bug manifests itself), the agent 104 copies the contents of the trace buffer 105 to a trace log file 122. In some cases, the log data is written to a file automatically, such as when the client terminates. The user 110 sends the trace log file 122 back to the developer 112. As shown in FIG. 1C, the developer 112 then uses the analyzer 106 to view the information contained in the trace log file 122. When generating screen displays for the developer 112, the analyzer 106 obtains information from the debug information file 121. Since the analyzer 106 is used to create the TCI file 120 and to view the results in the trace log file 122, the developer can edit the TCI file 120 or create a new TCI file 120 while viewing results from a trace log file 122.
  • Remote mode is used primarily to provide support to [0050] users 110 that are located remotely relative to the developer 112. In remote mode, the agent 104 is provided to the user 110 as a stand-alone component that enables the user to generate a trace log file that represents the execution of the client. The TCI file 120 and the trace log file 122 both may contain data that discloses secrets about the internal operation of the client 102 and thus both files are written using an encoded format that is not readily decipherable by the user 110. Thus, in providing the TCI file 120 and the agent 104 to the user, the developer 112 is not divulging information to the user that would readily divulge secrets about the client 102 or help the user 110 in an attempt to reverse engineer the client 102. The Agent traces the client without any need for modification of the client. The developer 112 does not need to build a special version of the client 102 executable file and send it to the customer, neither does the customer need to pre-process the client executable file before tracing.
  • From the perspective of the remote user, the [0051] agent 104 acts essentially as a black box that records the execution path of the client 102. As explained above, the trace itself is not displayed on the screen, but immediately after the bug reoccurs in the application, the user 110 can dump the trace data to the trace log file 122 and send this file to the developer 112 (such as by email) for analysis. The developer 112 then uses the analyzer 106 to view the trace log file created by the user 110 and identify the problematic execution sequence. In remote mode, the user 110 does not need access to the source code or the debug information. The agent 104, the TCI file 120, and the trace log file 122 are preferably small enough to be sent via email between the developer 112 and the user 110. Further details regarding the remote mode of operation are provided in the sections below.
  • Online Mode [0052]
  • As shown in FIG. 2, the BugTrapper may also be used in an online mode rather than remote mode as shown in the previous figures. In this mode, the BugTrapper is used by the [0053] developer 112 to locally analyze a client 102, which will typically be a program that is still being developed. For example, the online mode can be used as an aid during the development as a preliminary or complementary step to using a conventional debugger. In many cases it is hard to tell exactly where a bug resides and, therefore, where breakpoints should be inserted. Online mode provides the proper basis for setting these breakpoints. Later, if further analysis is required, a more conventional debugger can be used. In online mode, the analyzer 106 is used to perform all of its normal operations (e.g. creating the TCI file 120 and viewing the trace results) as well as the operations performed by the agent 104 in remote mode. Thus, in online mode, the agent 104 is not used because it is not needed. The developer 112 uses the analyzer 106 to run the client 102 and attach the client-side trace library 125 to the client 102. In online mode, the analyzer 106 reads the trace buffer 105 in near real-time to provide near real-time analysis functionality. In the online mode, the analyzer 106 immediately displays the trace information to the developer 112.
  • The [0054] developer 112 uses the analyzer 106 to interactively create trace control information (TCI). The TCI may be sent to the client-side trace library 125 via file input/output operations or through conventional inter-process communication mechanisms such as shared memory, message passing or remote procedure calls. The TCI indicates to the client-side trace library 125 what portions of the client 102 to trace, and when the tracing is to be performed. As the client program 102 runs, the client-side trace library 125 collects the trace information and relays the information back to the analyzer 106, which displays the information in near real-time within one or more windows of the BugTrapper.
  • Operational Overview of the Tracing Function [0055]
  • Regardless of which operational mode is used (online or remote), the [0056] client 102 is run in conjunction with the client-side trace library 125. As described in detail below, the client-side trace library 125 is attached to the in-memory image of the client 102 and generates trace information that describes the execution of the client 102. The TCI file 120, provided by the developer 112, specifies where tracing is to take place and what information will be stored. Because the client is traced without the need for context switches, the effect of this tracing operation on the performance of the client 102 is minimal, so that even time-dependent bugs can be reliably diagnosed. As described below, this process does not require any modification to the source or object code files of the client 102, and can therefore be used with a client 102 that was not designed to be traced or debugged.
  • The [0057] analyzer 106 is used to analyze the trace data and isolate the bug. The developer 112 may either analyze the trace data as it is generated (online mode), or the developer 112 may analyze trace data stored in the trace log file 122 (mainly remote mode). As described below, the assembly level information in the trace log file is converted back to a source level format using the same debug information used to create the TCI file 120. During the trace analysis process, the analyzer 106 provides the developer 112 with execution analysis options that are similar to those of conventional debuggers, including options for single stepping and running forward through the traced execution of the client 102 while monitoring program variables. In addition, the analyzer 106 allows the developer 112 to step backward in the trace, and to search for breakpoints both in the future and in the past.
  • The attaching mechanism used to attach the client-[0058] side trace library 125 to the client 102 involves replacing selected object code instructions (or fields of such instructions) of the memory image of the client 102 with interrupt (INT) instructions to create trace points. The locations of the interrupts are specified by the TCI file 122 that is created for the specific client 102. When such an interrupt instruction is executed, a branch occurs to the tracing library 125. The client-side trace library 125 logs the event of passing the trace point location and captures pre-specified state information, such as values of specific program variables and microprocessor registers. The instructions that are replaced by the interrupt instructions are maintained within a separate data structure to preserve the functionality of the application.
  • Overview of the Analyzer User Interface [0059]
  • The [0060] analyzer 106 comprises a User Interface module that reads trace data, either from the trace buffer 105 (during on-line mode tracing) or from the trace log file 122 (e.g. after remote tracing) and displays the data in a format, such as a trace tree, that shows the sequence of traced events that have occurred during execution of the client 102. Much of the trace data comprises assembly addresses. With reference to FIG. 1C, the analyzer 106 uses the debug information 121 to translate the traced assembly addresses to comprehensive strings that are meaningful to the developer. In order to save memory and gain performance, this translation to strings is preferably done only for the portion of the trace data which is displayed at any given time, not the whole database of trace data. Thus, for example, in formatting a screen display in the user interface, only the trace data needed for the display in the user interface at any given time is read from the log file 122. This allows the analyzer 106 to display data from a trace log file 122 with more than a million trace records.
  • The [0061] debug information 121 is preferably created by a compiler when the client is compiled. Using the debug information 121 the analyzer translates function names and source lines to addresses when creating the TCI file 120. Conversely, the analyzer 106 uses the debug information 121 to translate addresses in the trace data back into function names and source lines when formatting a display for the user interface. One skilled in the art will recognize that other build information may be used as well, including, for example, information in a linker map file and the Type Library information available in a Microsoft OLE-compliant executable.
  • Preferably, the debug information is never used by the [0062] trace libraries 124, 125 or the agent 102, but only by the analyzer 106. This is desirable for speed because debug information access is typically relatively slow. This is also desirable for security since there is no need to send to the user 110 any symbolic information that might disclose confidential information about the client 102.
  • The [0063] analyzer 106 allows the developer 112 to open multiple trace tree windows and define a different filter (trace control instructions) for each of window. When reading a trace record, each window filter is preferably examined separately to see if the record should be displayed. The filters from the various windows are combined in order to create the TCI file 120, which is read by the client-side trace library 125. In other words, the multiple windows with different filters are handled by the User Interface, and the client-side trace library 125 reads from a single TCI file 120.
  • FIG. 3A is an illustration of a [0064] typical frame window 300 provided by the analyzer 106. The analyzer frame window 300 displays similar information both when performing online tracing (online mode) and when displaying a trace log file (remote mode). The frame window 300 is a split frame having four panes. The panes include a trace tree pane 310, an “executable” pane 314, a trace detail pane 316, and a source pane 318. The analyzer frame 300 further provides a menu bar 304, a dockable toolbar 306, and a status bar 312. The menu bar 304 provides drop-down menus labeled “File,” “Edit,” “View,” “Executable,” and “Help.” The trace tree pane 310 contains a thread caption bar 320, described below in connection with the Analyzer. Below the thread caption bar 320 is a trace tree 330. The trace tree 330 is a hierarchical tree control that graphically displays the current trace information for the execution thread indicated in the thread caption bar 320. The trace tree 330 displays, in a hierarchical tree graph, the sequence of function calls and returns (the dynamic call tree) in the executable programs (collectively the client 102) listed in the executable pane 314. Traced source lines also appear in the trace tree, between the call and return of the function in which the lines are located. FIG. 3 illustrates a single thread header and thread tree combination (the items 320 and 330). However, multiple thread captions and thread tree combinations will be displayed when there are context switches between multiple threads or processes.
  • The [0065] executable pane 314 displays an “executable” listbox 361. Each line in the executable listbox 361 displays information about an executable image that is currently being traced. Each line in the list box 361 displays a filename field 360, a process id (PID) field 362, and a status field 364. Typical values for the status field 364 include “running,” “inactive,” and “exited.” The trace detail pane 316 contains a trace detail tree 350, which that is preferably implemented as a conventional hierarchical tree control. The trace detail tree 350 displays attributes, variables such as arguments in a function call window, and function return values of a function selected in the trace tree 330. The source pane 318 displays a source listing of one of the files listed in the source listbox 361. The source listing displayed in the source pane 318 corresponds to the source code of the function selected in the trace tree 330 of to the selected source line. The source code is automatically scrolled to the location of the selected function.
  • The [0066] frame window 300 also contains a title bar which displays the name of the analyzer 106 and a file name of a log or Trace Control Information (TCI) file that is currently open. If the current file has not yet been saved, the string “-New” is concatenated to the file name display.
  • The [0067] status bar 312 displays the status of the analyzer 106 (e.g. Ready), the source code file containing the source code listed in the source code pane 318, and the line and column number of a current line in the source pane 318.
  • The [0068] toolbar 306 provides windows tooltips and the buttons listed in Table 1.
  • FIG. 3B shows a [0069] typical frame window 300 with multiple threads in the trace tree pane 310. FIG. 3B shows a separate trace tree for each thread and a thread caption bar (similar to the thread caption bar 320 shown in FIG. 3A) for each thread.
    TABLE 1
    Buttons on the toolbar 306
    Menu
    Button Equivalent Key Description
    “Open” File | Open Ctrl+O Opens an existing Trace Control
    Information file.
    “Save” File | Save Ctrl+S Saves the current Trace Control
    Information to a file.
    “Clear” Edit | Clear Clears the Trace Tree pane, the
    All Trace Detail pane, and the
    Source pane.
    “Find” Edit | Find Ctrl+F Finds a specific string in the
    executable source code or trace
    tree.
    “Bookmark” Edit | Adds or deletes a bookmark for
    Bookmark the currently selected function,
    or edits the name of an existing
    bookmark.
    “Window” View | New Opens a new instance of the
    Window analyzer.
    “Start/Stop” Executable | Starts or stops tracing the
    Start/Stop executables listed in the
    Trace Executable pane.
    “Add” Executable | Ins Adds an executable to the
    Add Executable pane, without
    running it, so that it can be run
    and traced at a later date.
    “Run” Executable | F5 When the <New Executable>
    Run string is selected, adds an
    executable to the
    Executable pane, starts this
    executable and begins tracing.
    When an executable which is
    not running is selected in the
    Executable pane, starts this
    executable and begins tracing.
    “Attach” Executable | When the <New Executable>
    Attach string is selected, attaches a
    running executable to the
    Executable pane and begins
    tracing. When an executable
    that is not traced is selected,
    attaches the running process of
    this executable, if it exists.
    “Terminate” Executable | Terminates the executable
    Terminate currently selected in the
    Executable pane.
    “Options” Executable | Opens the Trace Options
    Trace Options window in which you can
    specify the elements that you
    want to trace for the selected
    executable.
  • Using the Analyzer to Create the TCI File [0070]
  • The [0071] TCI file 120 specifies one or more clients 102 and the specific elements (functions, processes and so on) to be traced either in online or remote mode. The TCI information is specified in a trace options window (described in the text associated with FIG. 5). The TCI file 120 is used to save trace control information so that the same trace options can be used at a later time and to send trace control information to a user 110 to trace the client 102. The subsections that follow provide a general overview of selecting trace information for a TCI file 120 and descriptions of various trace options, different ways to access the trace options, and how to use the trace options to specify elements to be traced.
  • The [0072] TCI file 120 for a client 102 is interactively generated by the software developer 112 using the analyzer 106. During this process, the analyzer 106 displays the source structure (modules, directories, source files, C++ classes, functions, etc.) of the client 102 using the source code debug information 121 generated by the compiler during compilation of the client 102. As is well known in the art, such debug information 121 may be in an open format (as with a COFF structure), or proprietary format (such as the Microsoft PDB format), and can be accessed using an appropriate application program interface (API). Using the analyzer 106, the developer 112 selects the functions and source code lines to be traced. This information is then translated into addresses and instructions that are recorded within the TCI file. In other embodiments of the invention, trace points may be added to the memory image of the client 102 by scanning the image's object code “on the fly” for specific types of object code instructions to be replaced.
  • Trace control information is defined for a [0073] specific client 102. In order to access the trace tool, the developer 112 first adds the desired programs 110 to the list of executables shown in the executable pane 314 shown in FIG. 3. The executable is preferably compiled in a manner such that debug information is available. In many development environments, debug information may be included in an optimized “release” build such that creation of the debug information does not affect the optimization. In a preferred embodiment, the debug information is stored in a PDB file. If during an attempt to add the executable to the Executable pane 314 a PDB file is not found by the analyzer 106, the developer 112 is prompted to specify the location of the PDB file. Once an executable has been added to the Executable pane 314, the developer 112 can set the trace control information using the available trace options described below.
  • To use the online mode to trace an executable [0074] 314 that is not currently running, the developer selects an executable file to run as the client 102. To run an executable file, the developer 112 double-clicks the <New Executable> text 365 in the executable pane 314 to open a file selection window thus allowing the developer 112 to select the required executable. Alternatively, the developer 112 can click the Run button on the toolbar 306, or select the Run option from the “Executable” menu after selecting the <New Executable> text. The file selection window provides a command line arguments text box to allow the developer 112 to specify command line arguments for the selected executable file.
  • After selecting an executable to be a client [0075] 102 a trace options window (as described below in connection with FIG. 5.) is displayed which allows the developer 112 to specify which functions to trace. After selecting the desired trace options and closing the trace options window, the executable starts running and BugTrapper starts tracing. As the client 102 runs, trace data is collected and the trace data are immediately displayed in the analyzer frame window 300 as shown in FIG. 3.
  • To cause the [0076] analyzer 106 to trace an executable that is currently running, the developer 112 may click the “Attach” button on the toolbar 306 after selecting the <New Executable> text. Upon clicking the “Attach” button on the toolbar 306, a process list window 400 is displayed, as shown in FIG. 4. The process list window 400 displays either an applications list 402 or a process list (not shown). One skilled in the art will understand that, according to the Windows operating system, an application is a process that is attached to a top level window. The applications list 402 displays a list of all of the applications that are currently running. The process list window 400 also provides a process list, which is a list of the processes that are currently running. The applications list 402 is selected for display by an applications list tab and the process list is selected for display by pressing the applications list tab. To select a process from the process list window, the developer 112 clicks the Applications tab or the Processes tab as required, and then selects the application or process to be traced. The process list window 400 also provides a refresh button to refresh the application list and the process list, and an OK button to close the process list window 400.
  • After the [0077] developer 112 selects an application or process using the process list window 400, and closes the process list window 400, the analyzer 106 displays a trace options window 500, as shown in FIG. 6 below. The application or process selected in the process list window 400 becomes the client 102. The analyzer 106 can display trace data for multiple processes and applications (multiple clients); however, for the sake of simplicity, the operation of the analyzer 106 is described below primarily in terms of a single client 102. The trace options window 500 allows the developer 112 to select the functions to be traced. Selecting trace options is described below in the text in connection with FIG. 5. After selecting trace options and closing the trace options window 500, the client-side trace library 125 is attached to the client 102, and the client 102 continues to run. The client-side trace library 125 thereafter collects trace information that reflects the execution of the client 102 and sends the trace information to the analyzer 106 for display.
  • The developer can also add an executable file (e.g. a windows .exe file) to the [0078] executable pane 314 without actually running the executable file. To add an executable that is not currently running (and which is not to be run yet) to the executable pane 314, the developer 112 selects the <New Executable> text 365 and then clicks the Add button on the toolbar 306, whereupon a file selection window is displayed. The developer 112 uses the file selection window to select the desired executable and closes the file selection window. The file selection window provides a text field to allow the developer to enter command line arguments for the executable. Upon closing the file selection window, the trace options window 500 is displayed which enables the developer 112 to select the functions to trace. After selecting trace options and closing the trace options window, the selected executable is inserted into the Executable pane 314 with the status “Inactive.” The developer can then begin a trace on the inactive executable by selecting the executable in the executable pane 314 and clicking the “Run” or “Attach” buttons on the toolbar 306.
  • In a preferred embodiment, the [0079] developer 112 can only create a new TCI file 120 when the executable list 361 contains the names of one or more executable files. To create a TCI file 120, the developer 112 selects “Save” from the “File” menu. The developer can also open a previously saved TCI file 120 and then modify the TCI file 120 using the trace options window 500. Once a TCI file 120 has been created (or opened) the developer 112 can select an executable from the executable pane and click the “Run” or “Attach” button from the toolbar to start tracing.
  • FIG. 5 illustrates the [0080] trace options window 500. The trace options window 500 is divided into two panes, a filter tree pane 501 and a source code pane 504. The filter tree pane 501 is a multi-page pane having four pages: a file page 602 which is selected by a file tab 510; a class page 702 which is selected by a class tab 512; a name page 502 which is selected by a name tab 514; and a process page 802 which is selected by a process tab 516. The name page 502 is shown in FIG. 5. The file page 602 is shown in FIG. 6, the class page 702 is shown in FIG. 7, and the process page 802 is shown in FIG. 8. The trace options window also provides an “advanced” button 520 and an “add DLL” button 522.
  • The [0081] trace options window 500 allows the developer 112 to specify which functions to trace and what to display in the trace tree 330. The trace options window 502 allows the developer 112 to filter out functions which have already been traced. These functions will be redisplayed where they were traced if they are later re-select for tracing. If a function is not selected for tracing in the trace options window 500, it will not be displayed in the trace tree 330. If a function that was not traced is filtered in again, it will not appear in that portion of the information that has already been displayed.
  • For example, consider the following C++ program: [0082]
    f1 ( ) { }
    f2 ( ) { }
    main ( ) {
    while (1) {
    getchar (c) ;
    f1 ( ) ;
    f2 ( ) ;
    }
    }
  • Using the above program as an example of a [0083] client 102, and assuming that the user forms the following steps:
  • 1. Select the functions f1, f2, and main for tracing in the [0084] trace options window 500.
  • 2. Execute one loop and view the resulting trace. [0085]
  • 3. Deselect (filter out) f2 for tracing in the [0086] Trace Options window 500.
  • 4. Execute the loop again. [0087]
  • 5. Re-select (filter in) f2 for tracing in the Trace Options window. [0088]
  • 6. Execute the loop once more. [0089]
  • Then, after [0090] Step 4 the following depicts the elements that are displayed in the trace window, with the symbol ˜˜˜representing a tear in the trace as described below in connection with FIG. 12. main f1 ~ ~ ~ ~ f1 ( Step 3 )
    Figure US20020087949A1-20020704-M00001
  • After [0091] Step 6 the trace appears as follows: main f1 f2 ~ ~ ~ ~ ( Step 4 ) f1 ~ ~ ~ ~ f1 f2 ( Step 5 )
    Figure US20020087949A1-20020704-M00002
  • In the above example, after f2 was filtered in again in step 5, it was restored in the first portion of the trace because filtering out occurred after this portion had already been executed. However, f2 never returned to the second portion, which was executed after f2 had been filtered out. Therefore, changing the trace options also determines which of the functions that have already been traced will be displayed. If a traced function is then filtered out from the trace, it can later be filtered in again. [0092]
  • In the filter tree pane [0093] 501, the process tab 516, corresponding to the process page 802, is not displayed prior to activating a process. Each of the four pages in the filter tree pane 501 displays a tree that the developer 112 can use to select the functions to be traced and analyzed. The source code pane 504 displays a source code fragment that contains the source code for the selected function and enables the developer 112 to select the specific source lines to be traced. Each line of executable source in the source code pane 504 is provided with a check box displayed along the left edge of the pane 504. The developer 112 checks the box to select the corresponding source line for tracing.
  • The “advanced” [0094] button 520 opens a window which allows the developer 112 to specify which elements to display during the trace (e.g. arguments, pointers, “this” class members and return values) and the maximum string length to be traced. The add DLL button 522 opens a window which allows the developer 112 to specify DLL files to be traced. This is useful when a DLL is loaded dynamically, as described below.
  • The [0095] developer 112 uses the filter tree pane 501 to select functions to be traced. Four page selection tabs at the top of the filter tree pane 501 enable the developer 112 to view the functions classified (sorted) according to file (on the file page 602), class (on the class page 702), name (on the name page 502) or process (on the process page 802). The way the functions are organized is different for each classification tab. However, the tree structure that is displayed in each of the four pages operates in the same way, even though the data elements in the tree are different for each page. Thus, the following discussion relating to the filter tree applies to any of the four pages of the filter tree pane 502.
  • The filter tree is a tree of function names with check boxes to the left of each name. Function check boxes appear blank, checked or dimmed as follows: [0096]
  • Blank: No sub-element of this branch is checked. [0097]
  • Checked: All sub-elements of this branch are checked. [0098]
  • Dimmed: Some (but not all) sub-elements of this branch are checked. [0099]
  • The [0100] developer 112 uses the check boxes to selected the functions to trace and then closes the trace options window by clicking an OK button.
  • The file page [0101] 602, shown in FIG. 6, provides a hierarchical tree that lists the objects according to their hierarchical level in the following order:
    + The Process that is traced.
    + The executable and DLL files which comprise the process.
    + Static Libraries
    + Source file directories.
    + Source files residing in these directories.
    + Classes contained in each source file and
    functions in each source file that do not
    belong to any class.
    + Functions belonging to the classes.
  • The source file structure is taken from the debug information (e.g., .PDB) files [0102] 121 for the client 102. If the full path name of the source file is not contained in the .PDB file, then the functions contained in that source file are located in a separate branch of the trace tree 330 under the title <Unknown Directory>. Functions that are included in the .PDB file, but whose source file is unknown, are located in a separate branch of the trace tree 330 under the title <Unknown Source File>.
  • The [0103] class page 702, shown in FIG. 7, provides a hierarchical tree that lists the trace objects sorted by class, ignoring their distribution amongst source files. Functions, which do not belong to a specific class are located in a separate branch of the trace tree 330 under the title <Functions>. The name page 502, shown in FIG. 5, provides a hierarchical tree that lists functions sorted alphabetically by name. Leading underscores and class names for methods are ignored. The process page 802, shown in FIG. 8, provides a hierarchical tree that displays each process that has been selected for tracing. Under each process is a list of the threads for that process.
  • DLL files that are not linked with the executable but rather are loaded dynamically (e.g. libraries loaded using the LoadLibrary system call), are not shown by default in the [0104] trace options window 500. In order to trace a dynamically loaded DLL file, the dynamically loaded DLL file should be added to the list of DLL files using the Add DLL button 522 in the Trace Options window 500. Clicking the add DLL button 522 displays a file selection window. Using the file selection window, the developer 112 then selects the required DLL file. The selected DLL file is added to the filter tree in the filter tree pane 502 of the trace options window 500.
  • The BugTrapper can also trace DLL files loaded by an executable, even when the executable does not contain debug information. For example, if the [0105] developer 112 writes a DLL file as an add-on (e.g., an ActiveX control) to a commercial program (e.g. Microsoft Internet Explorer), the developer 112 can activate BugTrapper on the commercial program and perform a trace on the add-on.
  • The BugTrapper also allows the [0106] developer 112 to specify various function attributes to be displayed in the trace detail pane 316 of the analyzer frame window 300, (shown in FIG. 3) while performing a trace. The developer 112 can choose to display arguments, pointers, “this” class members and return values. One skilled in the art will recognize that under the terminology of C++, a “this” class member is a class member that is referenced by the C++ “this” pointer. The developer 112 can also specify the maximum string length to be displayed. Selecting more options generally reduces the number of records in the trace log file and thus reduces the amount of execution time that is logged. The discussion below regarding the cyclic trace buffer provides further details of how much execution time is actually logged. The advanced button provides access to an advanced options window (not shown).
  • Selecting the arguments checkbox causes function arguments to be displayed in the [0107] trace detail pane 316. Selecting the “pointers” checkbox causes data to which a first level function argument of the pointer type points to be displayed. In other words, selecting the pointers checkbox causes function arguments that are pointers to be de-referenced for the display. The developer 112 may select the “this” checkbox to have “this” to have all members in a class displayed in the trace detail pane 316 when there is a call to a method which has a this pointer. The developer 112 may select the return checkbox to have function return values displayed in the trace detail pane 316.
  • The BugTrapper also allows the [0108] developer 112 to control tracing of specific source lines. In the source code pane 504, a checkbox is located to the left of each executable source line, which can be traced. To view the source code fragment containing a specific function, the developer 112 selects the required function in the filter tree pane 502 and the analyzer 106 displays the appropriate source code fragment in the source code pane 504. If analyzer cannot locate the source code, then the source code is not displayed and the developer 112 may press the spacebar or right-click in the source code pane 504 and select a “Source Location” command from a pop-up menu. The “Source Location” command opens a dialog box which allows the developer 112 to specify a source code file to be displayed in the source code pane 504. The appropriate source code is then displayed in the source code pane 504, as shown in FIG. 5.
  • To select the source code lines to trace, the developer clicks the check boxes corresponding to the desired lines. To select multiple lines, the [0109] developer 112 can either press CTRL+A to select the whole source code file, or drag the mouse along several lines and thereby select a group of lines. The developer 112 can then click on any checkbox in the selected area to check all the selected lines or click on a checkbox that is already checked to deselect all selected the lines. If lines of code in a file are selected for tracing, then the filename is displayed in blue. The developer 112 may also select which variables (e.g., local variables, global variables, static variables, etc.) should be traced for each traced line.
  • If a [0110] client 102 is modified and recompiled, it may not be desirable to use an existing TCI file for that client 102 (for example, a function that was selected for tracing may have been from the modified and recompiled version). Whenever the BugTrapper encounters an outdated TCI file 122, it issues a warning and then continues to trace based on a heuristic algorithm, which attempts to match the trace instructions to the modified client executable. Trace information for an application that may be recompiled at some future date can be supplemented by saving the trace information to an Extended Trace Control Information (TCE) file rather than a regular TCI file 120. The TCE file contains extra symbolic information (such as function names) that is not part of a regular TCI file 120. Using the extra symbolic information greatly increases the chances that the heuristic trace algorithm will produce the desired results. It is especially desirable to use a TCE file at the user 102 site when the client 102 is frequently modified, and the developer 112 does not want to redefine the trace options after each compilation. The TCE file is identified by a .TCE extension.
  • The developer may save a [0111] TCI file 120 by clicking the save button on the toolbar 306, whereupon the trace control information is saved. The first time that information is saved to a new TCI file 120, a file selection window appears. In the file selection window, the developer 112 may select the type of file (TCI or TCE) in a “Save as” type box.
  • The [0112] TCI file 120 can be used to trace a local client 102 at a later time, or it can be sent to a user 110 for use with the agent 104 to trace a client 102 at a remote site. In a preferred embodiment, for remote tracing, the developer 112 sends the user 110 a self-extracting zip file that contains the agent 104 and the TCI file 120.
  • Using the Agent [0113]
  • As described above, the [0114] agent 104 is an executable module which the developer 112 can provide to a user 110 along with a Trace Control Information (TCI) file in order to trace a client 102. The trace data collected by the agent 104 are written to the trace log file 122 which the user sends to the developer 112. The developer 112 uses the analyzer 106 to view the contents of the trace log file and analyze the trace information in the log file 122. Trace analysis using the analyzer 106 is discussed in subsequent sections of this disclosure. The present section discusses the procedures for starting the agent 104, including the first step performed by the user 110 to run the agent 104. The present section also discloses techniques for selecting the TCI file 120, specifying a directory for the trace log file 122, specifying the client 102, and, finally, using the agent 104 to control the logging of trace data. The agent 104 is an easy-to-run standalone application, with step-by-step instructions provided on the screen. To trace an application, the user 102 needs both the agent 104 and the TCI file 120. The TCI file 120 is prepared, as described above, by the developer 112 and contains information about the client 102 and the specific functions to be traced.
  • In a preferred embodiment, the developer supplies the [0115] agent 104 as a self extracting zip file that can be installed by simply double clicking on the zip file name. At the end of the installation, the user 110 can launch the agent 102. When the agent 102 is launched, it displays a TCI select window (not shown) which is a conventional file select dialog that allows the user to select the TCI file 120. Likewise, the agent 104 provides a log file window, which allows the user 110 to select a directory for the log file 122. The default log file is the last log file that was opened by the agent 104. The next step in using the agent 104 is to specify the client 102 executable(s) to trace.
  • If an executable specified in the [0116] TCI file 120 is already running, an attach to running processes window (running window) 900 is displayed, as shown in FIG. 9. The running window 900 provides a finish button 902, a cancel button 904, a back button 906, and a list of processes 908. The list of processes 908 shows any currently running processes that are specified in the TCI file 120. The list of processes 908 shows all processes that are specified in the TCI file 120 that are not currently running as disabled (grayed). The running window 900 allows the user 102 to select a currently running process to trace by selecting items in the list 908. Preferably, the user 110 will deselect any executables that are to be re-run from the start (that is, when the user does not want to attach to an executable that is already running). To select a running process, the user 110 selects a process from the list 908, and then presses the finish button 902 to cause the BugTrapper to attach to the client processes and starts to collect trace data.
  • If an executable specified in the TCI file is not currently running, then a start processes window (start window) [0117] 1000 is displayed, as shown in FIG. 10,. The start window 1000 provides a finish button 1002, a cancel button 1004, a back button 1006, and a list of executable files 1010. The start window 1000 also provides a path field 1012, a parameters field 1014, and a directory field 1016. The list of files 1010 shows any currently running processes that are specified in the TCI file. The start window 1000 allows the user to specify executables that are not currently running to be traced. The agent 104 will run the selected client(s) 102 and trace them according to the information in the TCI file 120.
  • The [0118] file list 1010 displays the executables, which are listed in the TCI file. Each item in the file list 1010 is provided with a check box. To specify the executables to run, the user 102 checks the boxes for the desired executables in the file list 1010. If the file path in the file list 1010 is not correct, then the user may enter the correct file path in the path field 1012. The user 110 may also add command line arguments in the parameters field 1014. The file path and command line steps may be repeated as needed to specify the file path and commands for additional executables. When the finish button 1002 is clicked, an agent window (described below) is displayed and the agent 104 runs the specified executables, attaches to the executable processes, and starts tracing.
  • The agent window (not shown) is displayed by the [0119] agent 104. The agent window displays the names of the TCI file and the log file. The agent window also contains an animated icon whose movement indicates whether trace data is currently being collected while the client 102 is running. The agent window also contains: a “Start/Stop” button to start or stop the trace; a “Clear” button to clear the trace buffer 105, a “Dump” button to save the contents of trace buffer 105 to the log file; and an “Exit” button to exit the agent 104.
  • The “Stop/Start” button allows the [0120] user 110 to stop and restart tracing when desired. Stopping the trace may improve system performance. The “Start/Stop” button toggles between Stop and Start according to the tracing status. The animated icon moves when tracing is in progress. The “Clear” button allows the user 110 to clear the trace buffer 105. The cleared information is not stored in the log file 122 unless the user first uses the dump button. The dump button allows the user 110 to save the contents of the trace buffer 105 to the log file 122. On the first save after a new process had been started, the agent 104 overwrites the old log file 122 (if one exists). On subsequent saves, new information will be appended to the existing log file 122. Clicking the exit button causes the agent 104 to exit. Upon exiting, the trace buffer is written to the log file. Note that the trace information is written to the log file when either dump or exit is clicked and also when the traced application crashes or terminates. The user 110 will preferably use the dump button frequently if it appears likely that the entire operating system may crash.
  • In one embodiment, the user may select to write every trace line to the disk as it is traced, or, the user may select to write trace lines periodically every N seconds. Such writing is useful, for example, when it appears likely that the entire operating system may crash. [0121]
  • Analysis of the Trace Information [0122]
  • The [0123] analyzer 106 is used to analyze a trace, either online as an application runs or off-line using a remote trace log. The general topics that fall under the rubric of trace analysis include, starting an online trace, opening a previously saved trace log file, viewing trace information, interpreting the trace information, working with trace information, and additional trace functions that are available when performing an online trace.
  • The BugTrapper allows the [0124] developer 112 to trace a client 102 executable in order to pinpoint an element in the client 102 code that causes a bug. The primary device for displaying trace information in the analyzer 106 is the trace tree 330 in the trace tree pane 310 shown in FIG. 3. The trace control information (TCI) filters can be modified during trace analysis to filter out some of the available trace data according to the needs of the developer 112.
  • Analysis of a remote trace (or a previously saved online trace) is started by opening a previously saved trace log file and displaying the trace information that it contains in the [0125] trace tree pane 310. The log file 122 may either have been created by saving trace information using the analyzer 106, or the log file 122 may have been created at a remote location using the agent 104. A trace log file 122 is opened by using an “Open Log” command from the “File” pull down menu found on the menu bar 304. Once a trace log file 122 is open, the title bar 302 displays the name and path of the opened log file 122. Once a trace log file 122 is open, the developer can view the trace information using various panes in the analyzer frame window 300. Trace information is displayed in the trace tree pane 310, the trace detail pane 316, and the source pane 318.
  • The [0126] trace tree 330, in the trace tree pane 310, is a hierarchical tree showing trace data collected from the client 102. Trace data includes information about events that took place during execution of the client 102, including function calls, function returns, selected source lines, etc. The developer 112 can use the mouse to choose any function from the trace tree, whereupon the arguments and return values for the chosen function are shown in the trace detail pane 316, and the source for the chosen function is displayed in the source pane 318. The types of trace information displayed for both online traces and a trace from log files is almost identical, however the log file trace provides a static display, while the online trace is dynamic and can be viewed as the trace information is being collected.
  • The [0127] trace tree 330 displays a hierarchical tree of the sequence of function calls and returns in the client 102. The number of lines in the trace tree is shown in the trace tree pane title bar 308. The trace tree 330 is organized in a standard tree structure and the developer 112 can click on the tree control buttons to collapse or expand the view of functions belonging to lower hierarchical levels. Clicking on a function or a source line in the trace tree pane 310 causes the trace detail pane 316 and the source pane 318 to change to display information relevant to the function. Selecting a function in the trace tree 330 and pressing the delete button on the keyboard removes the selected function from the trace. This is equivalent to filtering the function out of the trace.
  • The trace data is written to a buffer in memory called the [0128] trace buffer 105, and from there either displayed in the trace tree pane 310 (when performing an online trace) or written to a log file (when performing a remote trace). The trace buffer 105 is organized as a circular buffer of fixed size. The size of the trace buffer 105 can be set by the developer 112. When the trace buffer 105 is fill, new trace records overwrite the oldest records contained in the buffer 105. One skilled in the art will recognize that other buffering methods can be used without changing the scope of the present invention. For example, the trace information could be stored in a buffer, which simply added trace records without overwriting old records. In a preferred embodiment, loss of old data is acceptable because, when the client 102 malfunctions, the developer 112 is usually interested in the most recent records prior to the malfunction. Thus, there is usually little need to keep all of the records, especially the oldest ones. The size of the trace buffer 105 is set so that it will be big enough to hold a large number of records without consuming too many system resources. Typically, 20,000 to 40,000 records are kept.
  • When the [0129] trace buffer 105 is written to a log file 122, the trace records are preferably appended to the end of the log file 122. In a log file, old records are not deleted, and the trace size is limited only by the available disk space.
  • Alternatively, when tracing online, the trace tree is actually an image of the [0130] trace buffer 105. Because of this, the trace tree will not display more records than the trace buffer 105 contains, so old records are deleted (“scrolled out” of the display). The rows counter at the top of the trace tree pane 310 indicates the number of records in the trace buffer 105 and the number of rows in the trace tree. Because the buffer 10S is circular, the number of rows in the trace tree 330 continuously grows during the beginning of the tracing process until the buffer wraps (typically 20,000 to 40,000 records). Thereafter, the number remains approximately at the same level as old records are overwritten with new records. The exact number of records that are kept in the trace buffer 105 depends on the size of the trace records. The size of each trace record is determined by the TCI options specified by the developer 112. For example, if the developer 112 requires tracing of “this” class members, the size of the records will increase and the number of records in the buffer will decrease.
  • The [0131] analyzer 106 and the agent 104 can trace a multi-threaded and multi-processed client 102. When tracing a multi-threaded process, different threads are separated from each other in the trace tree pane 310 by a thread caption bar 320. For multi-process applications, similar horizontal bars, called process caption bars (not shown), separate trace lines belonging to different processes. The thread caption bar 320 and the process caption bar separate the trace tree 330 into sections. These caption bars represent a context switch in the application, between threads and between processes. Process caption bars are similar to the thread caption bar 320, therefore any future mention of threads also applies to processes in multi-process applications.
  • The [0132] thread caption bar 320 contains a name field, a process ID number field, and a thread ID number field 321. Within the trace tree 330 itself, there is an up arrow at the top of each section, and a down arrow at the bottom of each section. Clicking the up arrow causes the displayed trace tree 330 to jump to the previous point in the trace tree 330 where the thread gained control. Clicking the down arrow causes the displayed trace tree 330 to jump to the next point in the trace tree 330 where the thread gains control. The trace tree 330 also provides an expand/collapse control button 326 to allow the developer 112 to expand and collapse the current thread view. The trace tree pane 310 also provides a vertical scroll bar for scrolling up and down through the trace tree 330. When the trace tree pane 310 is scrolled up or down to a section containing functions of lower hierarchical levels, the portion of the trace tree 330 displayed in the window is shifted leftwards. The depth of this shift, with respect to the first function called in the process, is indicated by a stack level indicator 328 appearing in a rectangle in the upper left corner under the thread caption bar 320 (as shown in FIG. 3).
  • The [0133] trace detail pane 316 shows available details describing the function selected in the trace tree view. FIG. 11 shows a trace detail pane 1116 that displays a C++ class having several members and methods, a class derived from another classes, and classes as members of a class. The trace details are displayed in a trace detail tree 350 which is a hierarchical tree structure. A right arrow 351 in the trace detail pane 316 marks where the function is called. A left arrow at the bottom of the detail tree 350 marks where the function returned to its caller. Some of the data that can be displayed (such as the arguments) are only displayed if an option is selected in the advanced trace options. If an argument in the call window of a function is of the aggregate type, the argument's components will be displayed beneath the right arrow 351 in the form of a hierarchy tree. If an argument is of the pointer type, and pointers were selected in the advanced trace options, then the value displayed in the trace detail tree 350 will be that of the data to which the pointer points. However, for pointer fields that reside within arguments, only the address contained in the pointer will be displayed. In other words, in the preferred embodiment, the pointer is de-referenced only for the first level arguments. One skilled in the art will understand that other pointers could be de-referenced as well, and that the trace detail tree 350 could display the value pointed to by arguments deeper than the first level.
  • In one embodiment, the [0134] trace detail pane 316 also shows time stamps. The time stamps display the time that a function is called and the time that the function returns to its caller.
  • If the argument is an array of known size, then the elements of the array will be displayed. If the array size is unknown, then the value displayed is the value of the first array element. If the argument is of character pointer type, then the string value is displayed. If the argument is numeric, then the decimal, hex, or decimal and hex values are displayed, depending on the selection made in the advanced trace options. Right-clicking the mouse when it points in the [0135] trace detail pane 316 displays a popup menu which allows the developer 112 to select how numeric arguments are displayed (as decimal, hex, or decimal and hex values).
  • The [0136] source pane 318 shows the source code for the selected function or source line selected in the trace tree 330. The source code listed in the source pane 318 is automatically scrolled to the location of the selected object, if possible. The line in the source code is displayed in bold and is pointed to by an arrow. The analyzer 106 looks for the source file in the current directory and in the directory indicated in the .PDB file. If the source file is not found, the source pane remains blank. In this case, the developer 112 can change the source file search path in order to display the source code. To change the source file path the developer should select a function in the trace tree 330, then right-click in the source pane to open a pop-up menu, and then select the “Source Location” from the pop-up menu. Alternatively, the developer 112 can add additional source directories and remove source directories by selecting the “Options” command from the “View” menu on the menu bar 304. Source file paths can also be removed.
  • The [0137] analyzer 106 provides several features which make it easier to analyze trace information and pinpoint a bug in the client 102. These features can be used both while performing an online trace and while viewing trace information from a remote log file 122. Analysis features include: saving trace information to a log file 122; printing the trace tree 350; searching for trace elements; locating a function in the trace options window 500; filtering the trace information; adding, editing, deleting and locating bookmarks; clearing the trace tree pane; and displaying multiple windows. Additional features available for online tracing include saving trace information to the log file 122.
  • The “Find” button on the [0138] toolbar 306 is used to initiate a search for an element in the trace tree 330. Clicking the Find button opens a “Find what” dialog box in which the developer 112 can enter a search text string. The find what dialog provides a “Find Next” button to start a search for the occurrence of the specified search text. The first occurrence of the specified text is highlighted in the relevant pane. Functions in the source code displayed in source pane 318 can be located in the trace options dialog 500 by right-clicking inside the source code in the source pane 318. The right-click opens a pop-up menu. The developer then selects a “Locate in Trace Options” command from the pop-up menu to open the trace options window 500. The trace options window 500 will open with the desired function displayed and highlighted.
  • The trace filter previously described in the text relating to FIG. 5 is a tool that enables the [0139] developer 112 to select the functions to trace. When using the trace filter to change the display while performing an online trace, the trace continues in the background, and when the developer 112 closes the trace options window 500 the new filter is applied to the display in the trace window 300. The developer 112 can also use the trace options window 500 to change the display while performing an off-line trace. This enables the developer 112 to filter out traced elements and display a subset of the traced information. The information contained in the log file is not modified, only the display changes.
  • A bookmark allows the [0140] developer 112 to mark trace lines (functions or source lines) in the trace tree 330. The developer 112 can also edit the name of a bookmark or delete the bookmark it as required. Bookmarks are inserted in the trace tree 330 by using the bookmark button on the toolbar 306. Bookmarks allow easy jumps to the bookmarked element. To insert a bookmark in the trace tree 330, the developer will: select the trace line (a function or source line in the trace tree 330) to mark; press the bookmark button to open the bookmark window; type the bookmark name in the bookmark widow; and click the OK button. A waiving flag icon 332 appears on the left of the bookmarked trace line in the trace tree 330. The bookmark name is displayed whenever the cursor is placed over the bookmarked line. To change a bookmark name, the developer 112 repeats the steps to create a bookmark. To delete a bookmark from the trace tree 300, the developer 112 can press a delete button on the bookmark window. The “Goto Bookmark” command from the “Edit” menu is used to go to a bookmark in the trace tree 330.
  • Multiple instances of the [0141] analyzer 106 can be open simultaneously. Each instance can define different filter options for each window. This feature is especially useful for multi-threaded applications, where it is convenient to observe each thread in a separate window.
  • The [0142] analyzer 106 provides for starting and stopping of an online trace. All trace points are disabled when tracing is stopped. Stop is helpful if the trace adversely influences the application performance and it appears that the subsequent operations in the client 102 are not relevant to the problem being analyzed. The Start/Stop Tracing button on the toolbar 306 is used to toggle tracing on and off. Tracing is stopped or restarted as specified. When tracing is stopped, the boundaries of the lost tree portion appear in the trace tree pane 330 as a tear 1202, as shown in FIG. 12. When tracing is resumed, the trace tree 330 continues under the tear 1202.
  • Internal Implementation Details of the BugTrapper System [0143]
  • The sections that follow discuss various internal operational and implementation details of the [0144] agent 104, the analyzer 106, the trace libraries 124, 125, and how these elements interact with the client 102 and the operating system.
  • The Attaching Mechanism [0145]
  • One aspect of the present invention is the attaching mechanism used by the BugTrapper to collect trace information. With traditional tools, it was necessary to manually enter trace points in the application's source code, or at a minimum, even if trace points were automatically added to the source, to re-compile the source code. With BugTrapper, tracing is accomplished by attaching to the memory image of the application (i.e., the copy of the executable code that is loaded into RAM or other memory for execution). There is no need to enter trace points into, or to otherwise modify, the source, object, or executable files of the [0146] client 102 application. No special tracing version of the client 102 is needed, and the client 102 need not be written in any special manner. Attaching to the client 102 in memory allows function calls, returns, and other source lines to be traced. The attaching mechanism also allows for the tracing of any executable, including optimized (release) builds, multi-threading and multi-processes, longjumps, signals, exceptions, and recursions.
  • The BugTrapper client-[0147] side trace library 125 is attached to the client 102, in part, by modifying certain executable instructions of the memory image of the client 102. This process is generally called “executable code instrumentation,” or simply “instrumentation.” The instrumentation process is performed such that the functionality of the client 102 is preserved. Because the instrumentation is made only on the memory image, there is no need to pre-process or modify the source code or executable files of the client 102. Use of the client-side trace library 125 provides significant advantages over the prior art by eliminating the need for context switches when debugging a program. Context switching has the effect of significantly slowing down the rate of execution. The tracing implementation provided by BugTrapper can therefore be used to study the real time behavior of a program and detect bugs resulting from such behavior. Although one skilled in the art will recognize that the present invention can advantageously be used with any operating system, a preferred embodiment runs under the Windows-NT/2000, Windows-95/98 and similar operating systems supplied by Microsoft Inc. The following description of the internal details of the BugTrapper will thus be described in terms of the Windows-NT/2000/95/98 operating systems with the understanding that the invention is not limited to said systems.
  • The [0148] trace libraries 124, 125 include a number of callable functions (discussed below). By using the callable functions, and system functions provided by the Win32 API (application program interface), the trace libraries performs two major tasks: (1) attaching specialty functions to application, and (2) tracing the execution of the application's executable code. Both of these tasks are described separately below. The agent-side trace library 124 is primarily responsible for attaching the client-side trace library 125 to the client 102. The agent-side trace library 124 also provides communication with the client-side library 125. The client-side trace library 125 is primarily responsible for placing data in the trace buffer 105. In the following description, the term “client process” is used to refer to the executable code of the client 102 that has been loaded into a memory space for execution. BugTrapper refers both to BugTrapper Agent or BugTrapper Analyzer, depending whether it is operating in the Online mode or the Remote mode.
  • The act of attaching to a currently running process is known as a Process Attach. The act of attaching to a new process, during the creation of the new process, in order to trace the new process from its start is known as a Creation Attach. In a Creation Attach it is desirable to pause the [0149] client 102 process as close as possible to its entry point so that virtually all of the functions executed by the client 102 will be traced.
  • In the Windows-NT/2000 compatible and Windows-95/98 compatible operating systems, each process resides at a distinct location or “address space” in memory. A DLL, such as the client-[0150] side trace library 125, which resides in another address space, cannot simply be loaded into the same address space as the client process. To overcome this limitation, BugTrapper forces the client process to load the client-side trace library 125 DLL (using a process called injection) into the process space of the client process.
  • Attaching to a Client Running Under Windows-NT/2000 [0151]
  • In a preferred embodiment, the injection process for Process Attach in Windows-NT is accomplished by using the CreateRemoteThread( ) function of the Win32 API, to create a remote thread in the client process and to force the newly created thread to run code in the client process. The code that is run by the remote thread is a copy of an injection function copied to the remote thread using the Win32 API WriteProcessMemory( ) function. The Process Attach involves the following sequence of events shown in FIG. 13 beginning with a [0152] procedure block 1302 where the function inst_attach( ) of the tracing library is called in BugTrapper, using the process ID (“PID”) of the client (client) process as an argument. The function inst_attach( ) performs the following operations:
  • 1) It obtains a handle to the client process using OpenProcess( ); [0153]
  • 2) It allocates memory in the client process's address space using the Win32 API function VirtualAllocEx( ); [0154]
  • 3) It copies the code for the injection function and other various data (including the full path of the Trace Library) onto the allocated memory space using the WriteProcessMemory( ) function; and [0155]
  • 4) It creates a new thread in the client process with CreateRemoteThread( ). [0156]
  • The new thread created in [0157] step 4 starts executing at the address to which the injection function was previously copied in step 3. The procedure then advances from the procedure block 1302 to a procedure block 1304 where the injection function starts running in the new thread of the client process. Using data passed to it via other parts of the memory space, the injection function loads the client-side trace library 125.
  • The procedure advances from the [0158] procedure block 1304 to a procedure block 1306 where the client-side trace library 125 runs in the context of the new thread while the instrumentation is taking place. The client-side trace library 125 communicates with BugTrapper (i.e., the agent-side trace library 124), handling commands, and actually performing the instrumentation.
  • The procedure advances from the [0159] procedure block 1306 to a procedure block 1308 where the client-side trace library 125 exits, and the injection function destroys its own thread and stops executing by calling the ExitThread( ) function. Unlike other debuggers that terminate the debugged process on exit, here the client 102 continues to run, without any substantial alteration to the functionality of the client 102.
  • Creation Attach is accomplished under Windows-NT by creating the client process in a suspended state, by using the CREATE_SUSPENDED flag in the CreateProcess( ) function. In this case, the previously described procedure cannot be used, since none of the system DLLs in the client process have been initialized. In particular, since KERNEL32.DLL is not loaded, the client-[0160] side trace library 125 cannot be loaded. The present attaching procedure overcomes this difficulty by performing the following attaching procedure, which begins at a procedure block 1402 shown in FIG. 14.
  • To attach to a [0161] new client 102, the attaching procedure begins in block 1402, in which the client process is created in a CREATE_SUSPENDED state. The attaching procedure then advances to a procedure block 1404. In the procedure block 1404, BugTrapper makes a call to the inst_prepare( ) of the agent-side trace library 124. The inst_prepare function, using WriteProcessMemory( ) and VirtualAllocEx( ), allocates memory in the client process and copies a small assembly language code segment into the allocated space. The procedure then proceeds to a procedure block 1406 where the inst_prepare function overwrites the entry point of the client executable in the client process with a jump instruction to the new assembly code. The attaching procedure then advances to a procedure block 1408 wherein the inst_prepare function allows the client process to resume, and thereby start the initialization process for the client process. After all DLLs are initialized, including the client-side trace library 125, execution continues to the entry point of the client executable, which now contains a jump to the new assembly code. When the jump occurs, the attaching procedure advances from the procedure block 1408 to a procedure block 1410. In the procedure block 1410, the assembly code restores the original client entry point, and suspends the client process. At this point, the client process is suspended without running any executable code, but is past the initialization stage. The attaching procedure then advances to a procedure block 1412.
  • In the [0162] procedure block 1412, BugTrapper can now call inst_attach( ) to attach to the client process and start instrumenting it. When the attaching procedure is complete, it can allow the client process to resume. The assembly code simply jumps directly is back to the original entry point of the client 102, and execution of the client 102 starts with the proper instrumentation.
  • Attaching to a Client Running Under Windows-95/98 [0163]
  • In Windows-95/98, Process Attach and Creation Attach are implemented in a manner different from the Windows-NT/2000 manner discussed above because the CreateRemoteThread API call is not supported in this operating system. [0164]
  • Creation Attach under Windows-95/98 exploits the fact that process initialization starts from a known entry point of kernel32.dll. BugTrapper creates the client process in the suspended mode and then calls to the inst95_attach function. This function performs the following sequence of operations: [0165]
  • 1) It initializes the communication channel for IPC with the client process. [0166]
  • 2) It copies various data (such as the Injection Function code and the path for the client-side trace library [0167] 125) into the client's address space, using WriteProcessMemory function.
  • 3) It initializes a shared heap memory. [0168]
  • 4) It copies onto the heap a small piece of assembler code (a patch) that executes the jump to the function that creates thread in the client process [0169]
  • 5) It copies the injection function itself [0170]
  • 6) It patches the entry point of kernel32.dll so that the entry point points to the shared heap address where the assembler code is located. Because of the lack of “Copy on Write” mechanism in Windows-95, this patching applies also to the client process. [0171]
  • 7) It resumes the main thread of the client process. [0172]
  • 8) In the client process, the entry point of kernel32.dll is called and, thus, the applied patch starts execution. The patch performs the following operations: [0173]
  • a) The patch removes the patch applied on the kernel32.dll entry point and restores the original kernel32.dll code. [0174]
  • b) The patch creates a new thread, which runs the injection function. [0175]
  • c) The injection function loads the client-[0176] side trace library 125.
  • d) The injection function initializes the client-[0177] side trace library 125 and the communication channel in the client process so that the two trace libraries 124, 125 can communicate.
  • 9) If inst95_attach returns successfully, then the initial instrumentation of the client process is done and the tracing begins. [0178]
  • During a Process Attach, BugTrapper calls the inst95_attach_to_running_process function in the agent-[0179] side trace library 124. The inst95_attach_to_running_process function executes the following sequence of operations:
  • 1) It initializes the communication channel for IPC with a client process [0180]
  • 2) It calls a function create_remote_thread (not to be confused with the CreateRemoteThread API call in Windows-NT), that performs the following operations: [0181]
  • a) It allocates memory on the shared heap. [0182]
  • b) It copies various data (such as the Injection Function code and the path for the client-side trace library [0183] 125) onto the heap
  • c) It finds a valid thread handle from the client process. [0184]
  • d) It suspends the valid thread [0185]
  • e) It sets the single step flag in the valid thread context [0186]
  • f) It releases the valid thread [0187]
  • A device driver, which will be further described below, intercepts the [0188] INT 1 interrupt that is caused by the first executed instruction of the above mentioned valid thread. Upon receiving the interrupt, the device driver sets the instruction pointer to the start address of the injection function that was copied onto the shared heap, and clears the single step flag in the valid thread context. After clearing the single step flag, the driver proceeds as if the interrupt was successfully handled, and returns the control to Windows-95.
  • Since the instruction pointer now points to the injection function, the injection function starts to execute in the context of the client process. The injection function continues as in the case of Creation Attach described above and creates a new thread that subsequently performs the loading of the client-[0189] side trace library 125 into the address space of the client 102.
  • In order to leave the interrupted valid thread intact, the injection function executes the breakpoint instruction, which immediately causes an [0190] INT 3 interrupt that is intercepted by the device driver. The device driver restores the thread context that was stored immediately after the thread was suspended and then the device driver returns the control to Windows-95.
  • Tracing Execution [0191]
  • The trace function involves tracing the execution of the instrumented client process and reporting certain events to BugTrapper. The client-[0192] side trace library 125 accomplishes the tracing function by using breakpoints, and by reporting information concerning the status of the client process upon reaching the breakpoints.
  • During the execution of the client process, the execution trace is stored within a fixed size [0193] circular trace buffer 105 in memory. In the remote mode of operation the contents of the trace buffer 105 are copied to a trace log file 122. The trace log file 122 thus contains trace information that reflects a time window ending with the writing of the log file 122. The length of this time window is generally dependent upon the size of the trace buffer 105. In a preferred embodiment, the trace buffer 105 is small enough to allow the trace log file 122 to be sent to the developer's site using standard email programs. In the online mode of operation, the display is constantly being updated mirroring the trace buffer 105. The displayed information can also be saved to a log file 122 and later re-displayed.
  • After the client process has been attached, the process of tracing the execution of the [0194] client 102 involves the steps of installing breakpoints, triggering breakpoints, and catching breakpoints. Breakpoints are installed by overwriting the target address of the assembly instruction to be traced with an INT 3 instruction, occupying a single byte of space. The original byte at that address, along with other information, is stored in a data structure created by the agent-side trace library 124. The data structure, which describes all trace points, is preferably a hash table comprising a corresponding array of records for each hash value. The hashing is implemented with the target address as a parameter, allowing for a very fast searching for information concerning a trace point by using its address.
  • Breakpoints are triggered whenever the target address gets executed. When the target address is executed, the breakpoint instruction generates an [0195] INT 3 interrupt. On Windows NT/2000 this interrupt is handled by the Windows-NT/2000 kernel-mode handler. The kernel-mode handler transfers the execution to the user-mode routine KiUserExceptionDispatcher inside NTDLL.DLL (the system DLL). The KiUserExceptionDispatcher routine handles the task of locating a corresponding exception filter for the particular kind of exception.
  • Catching of breakpoints occurs within the context of the [0196] client 102. With standard debuggers, control would pass to the debugger process at this point. BugTrapper, takes a new approach, eliminating the need for context switching to properly trace the execution (for better performance). Since no context switching takes place, control remains with the client 102.
  • When the client-[0197] side trace library 125 is initially loaded, a patch is applied to the KiUserExceptionDispatcher function, having the effect of forcing a call to a function in the client-side trace library 125 before processing the exception. This function (the BugTrapper exception handler), determines whether the breakpoint occurred as a result of the tracing or for another reason. An exception that is not the result of tracing (i.e., no trace point has been installed at this target address) will result in a return of execution to KiUserExceptionDispatcher. When an exception is the result of the tracing, the handler notifies the appropriate routines in the tracing library 125 and defers the breakpoint, thereby allowing the original instruction at the target address to execute.
  • To defer a breakpoint, the original byte at the target address is restored, returning execution while setting a trap flag in the FLAGS register of an x86 processor. The trap flag causes an [0198] INT 1 interrupt to occur as a result of the execution of the original instruction. This interrupt is also treated as an exception, eventually reflecting into the BugTrapper exception handler. The handler restores the breakpoint instruction at the target address and returns for second time, allowing the client process code to continue running as if nothing happened.
  • In Windows 95/98, interception of the INT3 and INT1 interrupts is done by a device driver. The driver registers its interrupt handler for INT1 and INT3 interrupts. When the interrupt handler is called, it checks to see if the interrupt occurred in the context of the client process. If the interrupt occurred in the client process, then the interrupt handler changes the instruction pointer of the thread to the address of a routine in the client-[0199] side trace library 125, and passes back on its stack any data needed by the function (such as thread context). After this function handles the trace point, it triggers an additional INT 3 interrupt that is recognized by the device driver. The device driver acts as if the interrupt has been successfully handled, causing the traced thread to continue execution. When the device driver recognizes that an interrupt has occurred not in the context of the client process, then the device driver passes the interrupt to the operating system interrupt handler (thus not affecting the normal behavior of other programs in the system or the operating system itself).
  • When tracing a plain source line (e.g., not a function entry or exit point), the client-[0200] side trace library 125 inserts data in the trace buffer to indicate that a trace point has been reached. When reaching a function entry trace point (apart from writing data to the trace buffer) a special mechanism is used because tracing of information regarding both the entry to and exit from the function is desired. This is preferably accomplished by modifyfing the return address of the function. The return address is located on the stack. The original return address is saved and a new return address point is inserted. The new return address points to a special assembly stub inside the client-side trace library 125. Therefore, when the function returns the assembly stub is called. The stub reports to the client-side trace library 125 function that the function has exited, and the client-side trace library 125 writes this trace point to the trace buffer. The stub then jumps to the real return address of the function.
  • In certain environments it is possible for a function to be entered but not properly exited. The function ceases running (with its stack erased and execution continuing elsewhere), but never returns to its caller. Therefore, for tracing purposes, it never returned to the BugTrapper assembly stub. For example, this would happen when a C++ exception occurs inside the a function and the exception handler at an outer function instructs the function generating the exception to exit, or when the setjmp( )/longjmp( ) functions are used in C/C++ programs. To detect and trace such events, the microprocessor's stack pointer register (ESP) is checked whenever a trace point triggers to determine whether any functions have exited. The stack pointer normally grows down. Its position is registered at the entry of each function together with the above-mentioned return address. If the stack pointer has moved to a higher point than that at entry, the function is deemed to have exited, and the client-[0201] side trace library 125 reports that the function has exited. Several different redundant checks are also performed to ensure the reliability of this mechanism.
  • Additional Tracing and Attaching Features [0202]
  • The BugTrapper attaching technology can be used with multi-process and multi-threaded applications. Every trace record is associated with a process and a thread. Stack information is separately kept for each context. Therefore, the BugTrapper can trace two or more client executables at the same time. This allows BugTrapper to display any context switches between the processes and threads of the client(s) [0203] 102.
  • The BugTrapper supports the tracing of Dynamically Linked Libraries (DLLs), including all sub-formats such as OCX, Active-X, drivers (DRV), etc. The tracing of DLLs is accomplished by analyzing the [0204] client 102 process to find the DLLs it uses, and by displaying the source structures of the DLLs to the user. The user can then specify trace points within the DLLs as is done for any other executable. When applying trace points to a DLL, BugTrapper finds the base address into which the DLL was loaded, and uses the address to translate the addresses in the debug information to actual addresses in the running image.
  • The BugTrapper also supports the tracing of DLLs for which no debug information is available, such as system DLL's. The tracing of such DLLs is accomplished by tracking the exported functions used by the DLLs. This is done by analyzing the DLL exported function table in the [0205] client 102 to retrieve information concerning the exported function names and addresses.
  • The BugTrapper also supports tracing of sub-processes. For example, when a first process P[0206] 1 and a second process P2 are listed in the executable pane 314, and P1 spawns P2 as a sub-process, then BugTrapper will start tracing P2. This is done by tracing the CreateProcess function in all of the traced processes, even if the developer 112 did not specify tracing the CreateProcess function. By tracing CreateProcess, BugTrapper will know that PI spawned a sub-process, and BugTrapper can identify that the sub-process name (P2 in the present example) is listed in the executable pane 314. When the sub-process is created, BugTrapper will attach to the sub-process using the “Creation Attach” mechanism discussed above.
  • Variables and memory values can also be traced by BugTrapper. The user can view variable values as in an ordinary debugger. The variables may include function arguments, the C++ “this” pointer, function return values, local variables, global variables, static variables, etc. The data to which a pointer is pointing can also be traced. This information can be viewed for optimized builds, which cannot always be done by current debuggers. Tracking of variables in memory is accomplished by first analyzing the debug information to find the address (global, static, stack, or dynamic address) of the variable and the data it holds. BugTrapper then uses these addresses to dump to the [0207] trace log file 122 the memory content according to variable size.
  • When the traced application crashes, BugTrapper records the point where the failure occurred, even if the line was not specified in the [0208] TCI file 120. All stack variables are saved by using the Win32 debug API and the system library IMAGEHLP.DLL.
  • Interprocess Communication [0209]
  • Communication between the client-[0210] side trace library 125 and the agent-side trace library 124 (in the agent 104 or the analyzer 106) can be divided into two categories. Category one comprises normal messages. Category two comprises trace data.
  • Category one communication is accomplished using standard Windows InterProcess Communication (IPC) primitives, such as shared memory to pass data, and semaphores to signal and synchronize. Normal messages include commands sent to the client-[0211] side trace library 125 such as, start trace function at a given address, or suspend tracing. Normal messages also include notifications sent by the client-side trace library 125, such as creation of a sub-process or run-time loading of a DLL.
  • The trace data itself is sent using a different mechanism, because of the quantity of data. Trace data comprises: function calls (including the assembly address of the called function); values of parameters for each call; function return values (including function address); tracing of other source lines specified in the TCI file [0212] 120 (including their address); variables value at these addresses; etc. The trace records are written to a shared memory area called the trace buffer 105, and from there either displayed in the BugTrapper user interface by the analyzer 106 (when performing an online trace) or written to a log file by the agent 104 (when performing a remote trace).
  • The client-[0213] side trace library 125 and the agent-side trace library 124 prevent simultaneous access to the trace buffer using standard locking mechanism such as Mutex (in Windows-95) or Interlocked Functions (in Windows-NT). For performance reasons, when collecting trace data, the client-side trace library 125 preferably only writes trace data to the trace buffer 125 in shared memory. The client-side trace library 125 preferably performs no I/O to the disk or to the display. Disk I/O and display updates are done later by the agent 104 or the analyzer 106. This reduces the performance penalty imposed on the client 102.
  • Indexing of the Trace Data [0214]
  • In order to process scrolling of the trace tree efficiently, there should desirably be direct access to records in the [0215] trace buffer 105 or trace log file 122. Serial access would be inefficient because it would require a search for the needed data in the trace buffer 125 upon every tree scroll operation. To facilitate direct access, an index is maintained with every trace tree window. The index contains the locations of all of the “function call” records in the trace buffer, which are included in the filter of the corresponding window in which the trace tree is displayed. In addition to the location information, some user-interface related information such as whether the record is invisible (“collapsed”) is kept. The developer 112 can “collapse” (remove from display) part of a tree which is located under a specific call in the tree hierarchy. Collapsing part of a tree influences the current displayed portion of the tree.
  • For example, assuming that only one record is displayed on a tree having a scroll bar, if the tree includes records (1 2 3 4 5) and the scroll bar is located at the middle, [0216] record 3 should be displayed. However, if records 2 and 3 are collapsed (leaving 1 4 5), then record 4 should be displayed. For a tree including more than a million lines, including thousands of collapsed records, the calculation of the location of the displayed portion of the trace data might be a time-consuming task. In order to do this efficiently, the analyzer 106 holds, together with the above-mentioned calls index, a special array SA, where SA[i] contains the number of visible records from record number 1000*i to 1000*(i+1). Use of the SA array greatly speeds up the task of locating desired trace information. For example, assume that records 500-550 are invisible (collapsed by the developer 112) and that the vertical scroll bar position is 1500. In this case SA[0]=950 and the appropriate record is 1550. The analyzer 106 calculates this number directly, without the need to scan the whole calls index: 1000-SA[0]+1500(scroll bar position)=1550. The SA array provides for very fast vertical scrolling. The SA array is updated each time a new record is read from the trace buffer 105 or the log file 122, or when the developer 112 collapses or expands some of the trace tree. In general, when the analyzer 106 draws a trace tree, it performs the following steps: (1) lock the trace buffer 105; (2) scan new records and update the calls index and the SA array; (3) read and analyze the records that must be shown; (4) merge the records with the debug information 121 and create strings for each record; (5) draw the page; and (6) unlock the shared memory trace buffer 105. Note that when reading data from a trace log file 122 only steps 3-5 are performed, since steps 1, 2, and 6 are unnecessary.
  • Visual Problem Monitor [0217]
  • In one embodiment, a visual problem monitor assists a support technician (e.g., a help desk person, a system administrator, etc.) in remotely analyzing problems by gathering run-time information about: program execution; interaction between the executing program and the operating system; system resources; user actions; file operations; failed operations and screen output. For example, file interactions, DLL loading and/or registry accesses can be monitored non-intrusively. The support technician can remotely view user interactions with the program and corresponding reactions by the system. This mitigates (or in some cases eliminates) the “questions and answers” game that support technicians usually play with users in order to understand what the user did and what happened on the customer's PC. [0218]
  • By using the dynamic analysis capabilities of the visual problem monitor, the support technician can check the parameters that influenced the program more effectively than by scanning static data gathered from the user's computer. For example, there is no need to check the versions of all the DLL's in the user's computer or to dump the entire registry from the user's computer. Rather, by using the visual problem monitor, the support technician can choose to view only the DLL's used by the traced program, or the registry entries or files accessed by the traced program. The visual problem monitor helps the support technician understand the details of problems in cases where programs produce cryptic messages and in cases where the programs simply crash without any specific error message. [0219]
  • In one embodiment, the visual problem monitor uses the executable hooking technology described above. The hooking technology allows trace points to be added to a running program while preserving the program's original operation. Support and help desk technicians can use this technology for tracing software interaction with the system and other API functions, without access to the source code, and therefore it does not require extra work to be done by the software vendors. In one embodiment, tracing of API functions using BugTrapper hooking technology requires one standard TCI file for all Windows applications. [0220]
  • FIG. 15 is a block diagram showing the components of a visual [0221] problem monitor system 1500. The visual problem monitor system 1500 includes an information-gathering module 1501 that runs on the user's computer along with a client program 1509, and an information-display module 1502 that runs on the support technician's computer. The information-gathering module 1501 includes an Application Programming Interface (API) event hooking module 1506, a message event hooking module 1507, and a program code event hooking module 1508. The API event hooking module 1506, the message event hooking module 1507, and the program code event hooking module 1508 are controlled by, and send data to, an event processing engine 1503. The event processing engine 1503 stores information gathered from the program 1509 and the user's computer system in a log file 1505. The event processing engine retrieves commands and event tracing instructions from an event knowledge base 1504.
  • System interaction tracing allows support personnel to gather information about behavior of the [0222] program 1509, and to diagnose sources of errors. The dynamic tracing mechanism provided by the visual problem monitor system 1500 provides logging the following Windows API functions and GUI events:
  • Calls of Windows API functions related to: [0223]
  • File and Directory operations [0224]
  • Registry operations [0225]
  • Environment variables [0226]
  • Spawned sub-processes [0227]
  • Loaded DLL's and other system components [0228]
  • IPC (semaphores, shared memory, messages, etc.) [0229]
  • WinSocket, RPC [0230]
  • SQL calls and related database operations [0231]
  • Keyboard input events [0232]
  • Mouse movement and mouse clicking events [0233]
  • Graphical screen capture of application windows updates [0234]
  • Calls to internal functions and code lines of applications. (This an optional functionality for software producers, depending on availability of source code and debug information as described in the text accompanying FIGS. [0235] 1-14 above.)
  • The events are synchronized by time and logged into the [0236] log file 1505. Several mechanisms can be used for gathering information for event logging. Monitoring of Win32 API calls can be done using any of the following tools and techniques:
  • The hooking and tracing techniques described in connection with FIGS. [0237] 1-14 above.
  • The Microsft Detours library [0238]
  • DLL redirection [0239]
  • The Microsoft Standard debug API [0240]
  • Different techniques can be used to capture user interactions and screen updates, including those used in such programs and products as: [0241]
  • Screen-capture tools (e.g. Lotus SreenCam) [0242]
  • Remote PC administration tools (e.g. Norton PCAnywhere, Netvision OpSession, AT&T WinVNC) [0243]
  • One embodiment of the visual [0244] problem monitor system 1500 uses the following logging mechanisms: (1) the hooking mechanism described above is used to gather event data for logging of Windows API functions; and (2) hooking to Windows messages related to keyboard and mouse events and screen updates is used to gather event data for logging of GUI interactions and screen capture. In one embodiment, standard data compression techniques are used for compression of the visual information and other records in the log file 1505.
  • More specifically, the following system interaction functions are traced by the visual problem monitor system [0245] 1500:
  • File operations [0246]
  • Open/Close/Lock/Unlock [0247]
  • Create/Delete [0248]
  • Read/Write/Copy [0249]
  • Find [0250]
  • Get disk free space [0251]
  • Directory operations (SetCurrentDirectory, RemoveDirectory etc.) [0252]
  • Tracing of these operations allows detecttion of problems such as: [0253]
  • Attempts by the [0254] program 1509 to access a non-existing file
  • File operations by the [0255] program 1509 that violate file access permissions
  • File operations by the [0256] program 1509 to a full disk
  • File operations by the [0257] program 1509 to a file that is locked by another application
  • Environment values: [0258]
  • Registry operations (For example, the information-[0259] gathering module 1501 can detect when the application 1509 tries to read a non-existent key, a key has a wrong value, a key points to a missing file, etc.)
  • Environment variables [0260]
  • INI files (e.g. Profile Strings) [0261]
  • Loaded DLLs: For example, the information-[0262] gathering module 1501 can detect loaded DLL name, version, date, location on disk, etc. and pinpoint to a missing DLL or a DLL having an incorrect version number.)
  • Requested services/drivers: The information-[0263] gathering module 1501 can collect information on missing, incorrect, and misbehaved NT services and drivers.
  • Spawned sub-process: The information-[0264] gathering module 1501 can collect information regarding spawned executables (e.g., executable name, version, id, etc.). The information-gathering module 1501 can also log information regarding unsuccessful attempts to create a sub-process (e.g. because the executable was not found, etc.)
  • Crash information: The information-[0265] gathering module 1501 collects information regarding the name of an executable (or DLL) where a crash occurred, contents of the stack at the time of the crash, memory status, sequence of function calls before the crash, etc.
  • Communication Information [0266]
  • Event Log [0267]
  • Inter-Process Communication (e.g., Common Object Model (COM) messages, Distributed COM (DCOM) messages, semaphores, shared memory, messages, etc.) [0268]
  • Open DataBase Connectivity (ODBC) events [0269]
  • Networking events (e.g., Winsocket messages, Remote Procedure Call (RPC) information, etc.) [0270]
  • In one embodiment, the information collected by the information-[0271] gathering module 1501 and stored in the log file 1505 is passed to a remote support technician in order to allow the support technician to resolve software support issues related to the program 1509. The log file 1505 created by the information-gathering module 1501 is transferred to the information-display module 1502 running on the support technician's computer. The log file 1505 can be transferred using email, WEB access, network file transfer protocols and the like.
  • The support technician can select between two modes of operation. In a first mode, the information-[0272] gathering module 1501 is continuously active. When a problem occurs, the log file 1505 is created. If the user chooses to call the help desk, the support technician can obtain the log file 1505 and use it for analysis. In a second mode, the information-gathering module 1501 is active on demand. In the second mode, when the user calls the help desk, the support technician activates the information-gathering module 1501 on the user's computer and receives the log file 1505 using network communication protocols. In one embodiment, the support technician receives the log file 1505 by using a TCP/IP-based communication protocol.
  • The information-[0273] display module 1502 is used by the support technician to view the data from the log file 1505 (as shown in FIG. 16 below). The information-display module 1502 allows the support technician to filter the display to show only specific types of events or the whole scenario. In one embodiment, suspicious events (e.g. loading a non-existing DLL) are highlighted.
  • FIG. 16 shows the graphical user interface (GUI) [0274] 1600 provided to the support technicianby the information-display module 1502. The GUI 1600 includes a window 1609 that lists executable modules (by file name) that comprise the program 1509 and the processes created by the executable modules. A window 1608 lists module information including the DLLs (with version numbers) used by the executable module. A window 1605 (shown as a tab) provides crash information in the event of a crash of the program 1509. A window 1607 (shown as a tab) lists environment information including environment variables, registry variables, and INI variables used by the program 1509. A window 1607 (shown as a tab) lists system information about the user's computer (that is, the computer running the program 1509 that is being traced). A window 1603 lists event information (by process) in chronological order. A window 1606 (shown as a tab) provides options to allow the support technician to define filters for the event information shown in the window 1603. The filters allow the support technician to specify which types of events are traced and displayed in the window 1603. A window 1602 shows screen captures from the user's computer. A group of video controls 1601 allows the support technician to “play the movie” of screen capture events obtained from the user's computer using standard video-type controls such as stop, play, rewind, fast forward, next frame, etc.
  • The GUI [0275] 1601 provides verbalization of data from the log file 1505. Events logged in the log file 1505 are displayed as textual strings in plain English, or another natural language in the window 1603. Thus the support technician and PC users need relatively less programming experience to use the system 1500. In one embodiment, the screen captures shown in the window 1602 are replayed synchronously with the even displays provided by the GUI 1601. This allows the support technician to see what was happening on the user's screen when various events occurred in the user's system. Thus, for example, screen captures in the window 1602 are replayed synchronously with the replay of events in the window 1603, 1608, etc. The support technician can use the controls 1601 to control (e.g., pause, rewind, etc) the animated screen-capture display (in the window 1602) and the animated event displays provided by the GUI 1601.
  • In one embodiment, the [0276] log file 1505 is an extension of the trace log file 122 shown in FIG. 1B. The log file 1505 includes records related to logging of screen updates and user interaction with the application as follows:
  • vlSetFramebufferFormat (corresponding to a Set Framebuffer Format operation) [0277]
  • vlFramebufferUpdate (corresponding to a Framebuffer Update operation) [0278]
  • vlMouseMove (corresponding to a Mouse Move operation) [0279]
  • vlMouseClick (corresponding to a Mouse Click operation) [0280]
  • vlKeyPressure (corresponding to a Key Pressure operation) [0281]
  • vlNumBookmark (corresponding to a Numeric Bookmark) [0282]
  • vlStrBookmark (corresponding to a String Bookmark) [0283]
  • vlProcessAttached (corresponding to an Attach Process operation) [0284]
  • vlProcessDetached (corresponding to a Detach Process operation) [0285]
  • vlProcessTerminated (corresponding to a Terminate Process operation) [0286]
  • In one embodiment, the recording of GUI-related objects is based on intercepting Windows messages by the message [0287] event hooking module 1507. The message event hooking module 1507 is supplied with an Attach(ThreadIdent) method that sets a hooking function with help of the Windows SetWindowsHookEx( ) function and creates an additional thread. The Hook( ) function in the current thread analyzes intercepted messages and window regions that are re-drawn. As a result, special messages are generated and directed to the additional thread for transforming into records and writing into DirectAccessStream objects.
  • The vlFramebufferUpdate records are generated to save bitmaps of invalidated regions of windows. In one embodiment, bitmaps are created by reading video memory using Microsoft DirectX methods. In one embodiment, each created bitmap stores only a minimal rectangle corresponding to the window update region. [0288]
  • A significant number of software problems arise from the deletion or corruption of critical files. In many cases the diagnostic messages issued by programs do not provide enough information for troubleshooting. The visual [0289] problem monitor system 1500 provides more information about the missing file problem. Consider, for example, a simple example with Acrobat Reader. If font file Zd______ .pfb is missing, then the Acrobat Reader is not started and the user gets the cryptic message “No Zapff)ingbats or Multiple Master fonts found.” After getting this cryptic message, the user has to guess what happened with the application or the system and where it is possible to find the suddenly lacking fonts and how to restore the system to working order. A typical solution in such a case is to reinstall the whole application. Since the visual problem monitor system 1500 tracks file access operations, the visual problem monitor system 1500 can easily detect that the program lacks the file Zd______.pfb in the directory C:Acrobat3ReaderFonts, thus providing a better way for the problem resolution.
  • DLL management represents a significant challenge for Windows users. The following scenario illustrates the problem. Assume that installation of a vendor's program overrides the system DLL mapi32.dll with an older version without any warning message. As a result, after installing the vendor's program the Microsoft Notepad+ program fails to send any mail and gives the user a nonspecific message “SendMail failed to send message.” Since the visual [0290] problem monitor system 1500 tracks the use of DLLs, visual problem monitor system 1500 can show a support technician that a function from mapi32.dll made a call to a nonexistent executable mapisrv.exe (the problem lies in MAPI version mismatch). In one implementation, visual problem monitor system 1500 includes a DLL management module that monitors DLL-related operations and detects typical DLL problems.
  • In one embodiment, the visual problem monitor and the BugTrapper can be used in concert to locate problems in software. Support technicians typically analyze visual problem monitor trace information without access to the source code. When the problem is caused by a bug in the source code of the client program, the trace log is transferred to a software developer. Software developers can open visual problem monitor trace logs using the BugTrapper analyzer and by accessing source code can view the calls of traced API functions in the source code. The escalation workflow is illustrated in the [0291] flowchart 1700 shown in FIG. 17. The flowchart 1700 begins at a process block 1701 where a visual problem monitor agent (comprising the event processing engine 1503 and one or more of the hooking modules 1506-1508) and the event knowledge database 1504 (an API-level TCI file) is sent to a user (e.g., a customer) site. The process block 1701 typically happens in response to a user complaint (regarding a software problem) to a support site. In a subsequent block 1702, the user generates a trace log file 1505 by running (or attempting to run) the malfunctioning program client in connection with the visual problem monitor agent. In a subsequent block 1703, the trace log file 1505 is transferred to the support site (e.g. by using the Internet, computer network, etc.). In a subsequent process block 1704, the trace log file 1505 is analyzed by using the visual problem monitor. If the reason for the software malfunction is found by using the visual problem monitor, then the process advances to a process block 1706 where the user is informed of the nature of the problem and, typically, how to correct the problem; otherwise, the process advances to a process block 1707. In the process block 1707, the trace log file 1505 is transferred to a developer (e.g., at a developer site). In a subsequent process block 1708, the developer uses the BugTrapper source code analyzer (with application source code inputs from a process block 1709) to search for program bugs in the malfunctioning application.
  • Other Embodiments [0292]
  • Although the present invention has been described with reference to a specific embodiment, other embodiments will occur to those skilled in the art. It is to be understood that the embodiment described above has been presented by way of example, and not limitation, and that the invention is defined by the appended claims. [0293]

Claims (32)

What is claimed is:
1. A software system that facilitates the process of identifying and isolating software execution problems within a program without requiring modifications to the executable of the client program, said system comprising:
an information-gathering module that monitors selected events occurring during execution of the client program and store data describing said events in a log file, said information-gathering module configured to monitor API events, message events, and program events, said information-gathering module further configured to obtain screen captures during execution of the client program, said information-gathering module configured to connect to said client program at runtime by hooking an in-memory executable image of said client program; and
an information-display module that displays information from said log file, said information-display module configured to list events logged in said log file, said information-display module further configured to display screen captures obtained by said information-gathering module, said information-display module configured to run on a different computer than said information-gathering module, thereby allowing remote troubleshooting of said client program.
2. The software system of claim 1, wherein said information-gathering module monitors file access operations.
3. The software system of claim 1, wherein said information-gathering module monitors and highlights failed system interactions
4. The software system of claim 1, wherein said information-display module displays screen captures synchronized with logged events.
5. The software system of claim 1, wherein said information-display module replays screen captures in sequence.
6. The software system of claim 1, wherein said information-display module replays screen captures in sequence to produce a screen capture sequence, said information-display module also showing event information in sequence to produce an event information sequence, said event information sequence synchronized with said screen capture sequence.
7. The software system of claim 1, wherein said information-gathering module monitors attempts by said client program to access a windows registry.
8. The software system of claim 1, wherein said information-gathering module monitors use of DLLs.
9. The software system of claim 1, wherein said information-gathering module monitors attempts by said client program to spawn a subprocess or create a thread.
10. The software system of claim 1, wherein said information-gathering module monitors database operations.
11. The software system of claim 1, wherein said information-display module includes filters to control displaying of events in said log file.
12. The software system of claim 1, wherein said information-gathering module monitors interprocess communication performed by said client program.
13. The software system of claim 12, wherein said interprocess communication includes communication using COM.
14. The software system of claim 12, wherein said interprocess communication includes communication using DCOM.
15. The software system of claim 12, wherein said interprocess communication includes communication using semaphores.
16. The software system of claim 12, wherein said interprocess communication includes communication using shared memory.
17. The software system of claim 12, wherein said interprocess communication includes communication using network protocols.
18. A method for remotely troubleshooting problems occurring when trying to execute a client program on a remote computer, comprising:
loading a client program on a remote computer to create an in-memory executable image of said client program;
loading an information-gathering module on said remote computer, said information-gathering module configured to connect to said client program at runtime by hooking said in-memory executable image, said information-gathering module configured to monitor selected events occurring during execution of said client program and store event data describing said events, said information-gathering module configured to monitor API events, message events, and program events, said information-gathering module further configured to obtain screen captures during execution of said client program;
loading an information-display module on a second computer; and
sending said event data to said information-display module, said information-display module configured to receive said event data and list events logged in said event data, said information-display module further configured to display screen captures obtained by said information-gathering module.
19. The method of claim 18, wherein said information-gathering module monitors file access operations.
20. The method of claim 18, wherein said information-gathering module monitors attempts by said client program to access non-existent files.
21. The method of claim 18, wherein said information-gathering module monitors attempts by said client program to access protected files.
22. The method of claim 18, wherein said information-gathering module monitors attempts by said client program to write to a full disk.
23. The method of claim 18, wherein said information-gathering module monitors attempts by said client program to access locked files.
24. The method of claim 18, wherein said information-gathering module monitors attempts by said client program to access one or more registry entries.
25. The method of claim 18, wherein said information-gathering module monitors use of one or more DLLs.
26. The method of claim 18, wherein said information-gathering module monitors attempts by said client program to spawn a subprocess.
27. The method of claim 18, wherein said information-gathering module monitors attempts by said client program to create a thread.
28. The method of claim 18, wherein said information-gathering module monitors interprocess communication performed by said client program.
29. The method of claim 18, further comprising the step of defining one or more filters to control how said information-display module displays said event data.
30. The method of claim 18, wherein said information-display module creates a first window to display a list of events monitored by said information-gathering module, and wherein said information-display module creates a second window to display screen capture information from said remote computer.
31. The method of claim 30, wherein said information-display module creates a third window to display a list of DLLs used by said client program.
32. A system for remotely troubleshooting problems occurring when trying to execute a client program on a remote computer, comprising:
means for monitoring events and capturing screenshots occurring during execution of a client program and storing data describing said events, said events including API events, message events, and program events;
means for hooking said means for monitoring to an in-memory executable copy of said client program; and
an information-display module that displaying said data describing said events, said information-display module configured to list events in chronological order, said information-display module further configured to display screen captures obtained by said information-gathering module.
US09/799,338 2000-03-03 2001-03-05 System and method for software diagnostics using a combination of visual and dynamic tracing Abandoned US20020087949A1 (en)

Priority Applications (2)

Application Number Priority Date Filing Date Title
US09/799,338 US20020087949A1 (en) 2000-03-03 2001-03-05 System and method for software diagnostics using a combination of visual and dynamic tracing
US12/575,357 US8504994B2 (en) 2000-03-03 2009-10-07 System and method for software diagnostics using a combination of visual and dynamic tracing

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
US18663600P 2000-03-03 2000-03-03
US09/799,338 US20020087949A1 (en) 2000-03-03 2001-03-05 System and method for software diagnostics using a combination of visual and dynamic tracing

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US12/575,357 Continuation US8504994B2 (en) 2000-03-03 2009-10-07 System and method for software diagnostics using a combination of visual and dynamic tracing

Publications (1)

Publication Number Publication Date
US20020087949A1 true US20020087949A1 (en) 2002-07-04

Family

ID=26882280

Family Applications (2)

Application Number Title Priority Date Filing Date
US09/799,338 Abandoned US20020087949A1 (en) 2000-03-03 2001-03-05 System and method for software diagnostics using a combination of visual and dynamic tracing
US12/575,357 Expired - Lifetime US8504994B2 (en) 2000-03-03 2009-10-07 System and method for software diagnostics using a combination of visual and dynamic tracing

Family Applications After (1)

Application Number Title Priority Date Filing Date
US12/575,357 Expired - Lifetime US8504994B2 (en) 2000-03-03 2009-10-07 System and method for software diagnostics using a combination of visual and dynamic tracing

Country Status (1)

Country Link
US (2) US20020087949A1 (en)

Cited By (192)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20030056200A1 (en) * 2001-09-19 2003-03-20 Jun Li Runtime monitoring in component-based systems
US20030140334A1 (en) * 2001-12-13 2003-07-24 Granston Elana D. Method for selective solicitation of user assistance in the performance tuning process
US20040078789A1 (en) * 2002-06-11 2004-04-22 Rakesh Ghiya Methods and apparatus for determining if a user-defined software function is a memory allocation function during compile-time
US20040190773A1 (en) * 2003-03-31 2004-09-30 American Megatrends, Inc. Method, apparatus, and computer-readable medium for identifying character coordinates
US20040201627A1 (en) * 2001-01-31 2004-10-14 Maddocks Peter M. Method and apparatus for analyzing machine control sequences
US20040222944A1 (en) * 2002-09-20 2004-11-11 American Megatrands, Inc. In-line video, keyboard and mouse remote management unit
US20040243883A1 (en) * 2003-05-27 2004-12-02 American Megatrends, Inc. Method and system for remote software debugging
US20040255276A1 (en) * 2003-06-16 2004-12-16 Gene Rovang Method and system for remote software testing
US20040260759A1 (en) * 2003-06-06 2004-12-23 Fuji Xerox Co., Ltd. Systems and methods for capturing customer service engagements
US20050015359A1 (en) * 2003-07-18 2005-01-20 Bernhard Kidalka Method for representing a file structure
US20050050523A1 (en) * 2003-08-29 2005-03-03 International Business Machines Corporation Method to generate a formatted trace for an embedded device
US20050066337A1 (en) * 2003-09-18 2005-03-24 Carmody Quinn Portable operating environment
US20050061221A1 (en) * 2001-11-02 2005-03-24 Mariusz Paszkowski Superhydrophobic coating
US20050065803A1 (en) * 2003-09-19 2005-03-24 International Business Machines Corporation Using ghost agents in an environment supported by customer service providers
US20050108562A1 (en) * 2003-06-18 2005-05-19 Khazan Roger I. Technique for detecting executable malicious code using a combination of static and dynamic analyses
US20050144599A1 (en) * 2003-12-26 2005-06-30 Microsoft Corporation Source server
US20050146348A1 (en) * 2003-12-30 2005-07-07 Solid State Measurements, Inc. Method and apparatus for determining the dielectric constant of a low permittivity dielectric on a semiconductor wafer
US20050160431A1 (en) * 2002-07-29 2005-07-21 Oracle Corporation Method and mechanism for debugging a series of related events within a computer system
US20050159656A1 (en) * 2003-03-07 2005-07-21 Hockersmith Linda J. Method and apparatus for presentation of noninvasive glucose concentration information
US20050187439A1 (en) * 2003-03-07 2005-08-25 Blank Thomas B. Sampling interface system for in-vivo estimation of tissue analyte concentration
US20050203359A1 (en) * 2000-05-02 2005-09-15 Blank Thomas B. Optical sampling interface system for in-vivo measurement of tissue
US20050223364A1 (en) * 2004-03-30 2005-10-06 Peri Ramesh V Method and apparatus to compact trace in a trace buffer
US20050251794A1 (en) * 2004-04-16 2005-11-10 Taylor Jason A Method of debugging code and software debugging tool
US20050283765A1 (en) * 2004-06-19 2005-12-22 Apple Computer, Inc. Software performance analysis using data mining
US20060005149A1 (en) * 2001-04-20 2006-01-05 Microsoft Corporation Method and system for displaying categorized information on a user interface
US20060005078A1 (en) * 2004-06-30 2006-01-05 Microsoft Corporation System and method of identifying the source of a failure
US20060015853A1 (en) * 2004-07-14 2006-01-19 International Business Machines Corporation Method and apparatus for on demand debugging, tracing, and logging of applications
US20060015612A1 (en) * 2004-06-03 2006-01-19 Fujitsu Limited Trace processing program, method and apparatus
US20060075390A1 (en) * 2004-09-16 2006-04-06 International Business Machines Corporation Method and system for tracing components of computer applications
US20060112126A1 (en) * 2004-11-16 2006-05-25 Carlos Soto Automatic screen pop showing troubleshooting information
US20060173254A1 (en) * 2002-03-08 2006-08-03 Acosta George M Compact apparatus for noninvasive measurement of glucose through near-infrared spectroscopy
US7103876B1 (en) * 2001-12-26 2006-09-05 Bellsouth Intellectual Property Corp. System and method for analyzing executing computer applications in real-time
US20060259823A1 (en) * 2005-05-16 2006-11-16 Texas Instruments Incorporated Determining operating context of an executed instruction
US20060259830A1 (en) * 2005-05-10 2006-11-16 Lucent Technologies Inc. Real-time software diagnostic tracing
US20060277527A1 (en) * 2005-06-01 2006-12-07 Microsoft Corporation Non-destructive debugging for add-ins
US20060277540A1 (en) * 2005-06-07 2006-12-07 International Business Machines Corporation Employing a mirror probe handler for seamless access to arguments of a probed function
US7165190B1 (en) * 2002-07-29 2007-01-16 Oracle International Corporation Method and mechanism for managing traces within a computer system
US7200588B1 (en) * 2002-07-29 2007-04-03 Oracle International Corporation Method and mechanism for analyzing trace data using a database management system
US20070079288A1 (en) * 2005-09-30 2007-04-05 Chad Willwerth System and method for capturing filtered execution history of executable program code
US7216336B1 (en) * 2003-02-28 2007-05-08 Emc Corporation Sequential event monitoring module
US20070168537A1 (en) * 2006-01-18 2007-07-19 Archan Misra Method for intelligent and automated transmission of local context in converged signaling
US20070168457A1 (en) * 2006-01-18 2007-07-19 International Business Machines Corporation Apparatus and method for addressing computer-related problems
US20070168746A1 (en) * 2005-12-14 2007-07-19 Stefano Righi System and method for debugging a target computer using SMBus
US20070234300A1 (en) * 2003-09-18 2007-10-04 Leake David W Method and Apparatus for Performing State-Table Driven Regression Testing
US20070234306A1 (en) * 2006-03-31 2007-10-04 Klinger Uwe D Tracing performance of machine-readable instructions
US20070255579A1 (en) * 2006-04-28 2007-11-01 Boland Conor T Method and system for recording interactions of distributed users
US20070276692A1 (en) * 2003-12-19 2007-11-29 International Business Machines Corporaion Method for Debugging a Business Process Flow
US20080028370A1 (en) * 2006-07-28 2008-01-31 Apple Computer, Inc. Simultaneous viewing of multiple tool execution results
US20080034084A1 (en) * 2006-08-04 2008-02-07 International Business Machines Corporation Method, system and program product for monitoring client programs in a client-server environment
US20080034349A1 (en) * 2006-08-04 2008-02-07 Microsoft Corporation Incremental program modification based on usage data
US7376937B1 (en) 2001-05-31 2008-05-20 Oracle International Corporation Method and mechanism for using a meta-language to define and analyze traces
US7380239B1 (en) 2001-05-31 2008-05-27 Oracle International Corporation Method and mechanism for diagnosing computer applications using traces
US20080127112A1 (en) * 2006-11-23 2008-05-29 International Business Machines Corporation Software tracing
US20080126003A1 (en) * 2006-07-28 2008-05-29 Apple Computer, Inc. Event-based setting of process tracing scope
US20080127043A1 (en) * 2006-08-30 2008-05-29 Yuanyuan Zhou Automatic Extraction of Programming Rules
US20080162272A1 (en) * 2006-12-29 2008-07-03 Eric Jian Huang Methods and apparatus to collect runtime trace data associated with application performance
US20080166105A1 (en) * 2007-01-05 2008-07-10 Verizon Services Corp. Apparatus for remotely controlling set-top boxes and an associated method and computer program product
US7409711B1 (en) * 2002-12-24 2008-08-05 The Chamberlain Group, Inc. Method and apparatus for troubleshooting a security gate system remotely
US20080235667A1 (en) * 2007-03-13 2008-09-25 Steve Nelson Application Software Flight Recorder Test Server
US20080244328A1 (en) * 2007-03-30 2008-10-02 International Business Machines Corporation Generalized trace and log facility for first error data collection
US20080276127A1 (en) * 2007-05-03 2008-11-06 Mcfarland Norman R Diagnostic and Trouble-Shooting Methods in a Wireless Control and Sensor Network
US20080307266A1 (en) * 2004-09-24 2008-12-11 Sashikanth Chandrasekaran Techniques for automatically tracking software errors
US20090036759A1 (en) * 2007-08-01 2009-02-05 Ault Timothy E Collapsible noninvasive analyzer method and apparatus
US20090083525A1 (en) * 2004-09-30 2009-03-26 Rockwell Automation Technologies, Inc. Systems and methods that facilitate management of add-on instruction generation, selection, and/or monitoring during execution
US7519749B1 (en) 2004-08-25 2009-04-14 American Megatrends, Inc. Redirecting input and output for multiple computers
US20090106739A1 (en) * 2007-10-19 2009-04-23 Paul Allan Weatherbee Systems and methods for debugging multiple workflow instances
US20090138859A1 (en) * 2007-11-27 2009-05-28 Sun Microsystems, Inc. Sampling based runtime optimizer for efficient debugging of applications
US7543277B1 (en) 2003-06-27 2009-06-02 American Megatrends, Inc. Method and system for remote software debugging
US20090150868A1 (en) * 2007-12-10 2009-06-11 Al Chakra Method and System for Capturing Movie Shots at the Time of an Automated Graphical User Interface Test Failure
US20090222646A1 (en) * 2008-02-28 2009-09-03 International Business Machines Corporation Method and apparatus for detecting processor behavior using instruction trace data
US7587484B1 (en) * 2001-10-18 2009-09-08 Microsoft Corporation Method and system for tracking client software use
US20090265692A1 (en) * 2008-04-21 2009-10-22 Microsoft Corporation Active property checking
US7613815B1 (en) * 2001-10-15 2009-11-03 Netapp, Inc. Method and apparatus for customized logging in a network cache
US20090287962A1 (en) * 2008-05-15 2009-11-19 International Business Machines Corporation Solution for automatically incorporating diagnostic data within screen capture images
US20090318786A1 (en) * 2002-03-08 2009-12-24 Blank Thomas B Channeled tissue sample probe method and apparatus
US20090328008A1 (en) * 2008-06-26 2009-12-31 Microsoft Corporation Dynamically monitoring application behavior
US20100037211A1 (en) * 2008-07-15 2010-02-11 A VIcode, Inc. Automatic incremental application dependency discovery through code instrumentation
US20100042745A1 (en) * 2007-05-25 2010-02-18 Fujitsu Limited Workflow diagram generation program, apparatus and method
US20100064284A1 (en) * 2008-09-10 2010-03-11 Microsoft Corporation Satisfying Missing Dependencies on a Running System
US20100088683A1 (en) * 2000-03-03 2010-04-08 Identify Software, Ltd. System and method for software diagnostics using a combination of visual and dynamic tracing
US7697966B2 (en) 2002-03-08 2010-04-13 Sensys Medical, Inc. Noninvasive targeting system method and apparatus
US20100095281A1 (en) * 2008-10-14 2010-04-15 Riverside Research Institute Internal Function Debugger
US20100153069A1 (en) * 2008-12-17 2010-06-17 Microsoft Corporation Monitoring activity on a computer
US20100192229A1 (en) * 2009-01-27 2010-07-29 Fujitsu Limited Privilege violation detecting program
US7783799B1 (en) 2006-08-31 2010-08-24 American Megatrends, Inc. Remotely controllable switch and testing methods using same
US7793229B1 (en) * 2003-12-19 2010-09-07 Unisys Corporation Recording relevant information in a GUI window of a panel dump browser tool
EP2238543A1 (en) * 2007-12-21 2010-10-13 Symantec Corporation Providing image-based guidance for remote assistance
CN101859413A (en) * 2010-06-11 2010-10-13 用友软件股份有限公司 Method and system for collecting defects of enterprise resource planning (ERP) product
US7827258B1 (en) 2004-03-01 2010-11-02 American Megatrends, Inc. Method, system, and apparatus for communicating with a computer management device
US7827539B1 (en) 2004-06-25 2010-11-02 Identify Software Ltd. System and method for automated tuning of program execution tracing
US20100318852A1 (en) * 2009-06-16 2010-12-16 Microsoft Corporation Visualization tool for system tracing infrastructure events
US20110022896A1 (en) * 2007-02-20 2011-01-27 Red Hat, Inc. Methods and systems for first occurence debugging
US20110022895A1 (en) * 2009-07-23 2011-01-27 International Business Machines Corporation Software Component Self-Scrubbing
US20110040811A1 (en) * 2009-08-17 2011-02-17 International Business Machines Corporation Distributed file system logging
US7917904B2 (en) 2006-01-06 2011-03-29 Microsoft Corporation Automated analysis tasks of complex computer system
US7970263B1 (en) * 2004-05-28 2011-06-28 Adobe Systems Incorporated Seamless integration of video capture in demonstration applications
US20110214119A1 (en) * 2007-02-15 2011-09-01 Oracle America, Inc. Apparatus and method for providing software configurations on a plurality of platforms
US20110214108A1 (en) * 2010-02-26 2011-09-01 Roland Grunberg Architecture, system and method for generating visualizations from running executable code
US20110219387A1 (en) * 2010-03-04 2011-09-08 Microsoft Corporation Interactive Remote Troubleshooting of a Running Process
US8032866B1 (en) 2003-03-27 2011-10-04 Identify Software Ltd. System and method for troubleshooting runtime software problems using application learning
US8051332B2 (en) 2008-07-15 2011-11-01 Avicode Inc. Exposing application performance counters for .NET applications through code instrumentation
US20110320971A1 (en) * 2010-06-23 2011-12-29 Joachim Seeger Cross-domain business service management
US8091074B2 (en) 2007-06-21 2012-01-03 Microsoft Corporation Execution-centric source code view
US20120079087A1 (en) * 2010-09-27 2012-03-29 Ebay Inc. Online help system using session details
US8185868B1 (en) 2004-12-20 2012-05-22 The Mathworks, Inc. System and method for cell-based code editing and publishing
US8312435B2 (en) 2000-12-26 2012-11-13 Identify Software Ltd. (IL) System and method for conditional tracing of computer programs
US20130036330A1 (en) * 2006-07-28 2013-02-07 Apple Inc. Execution difference identification tool
US20130055211A1 (en) * 2011-08-26 2013-02-28 Apple Inc. Client-side policy enforcement of developer api use
US20130091342A1 (en) * 2011-10-08 2013-04-11 Yingzhi Liu Tracing software execution of a business process
US20130117542A1 (en) * 2011-11-04 2013-05-09 International Business Machines Corporation Code coverage framework
US8458671B1 (en) * 2008-02-12 2013-06-04 Tilera Corporation Method and system for stack back-tracing in computer programs
US8498987B1 (en) * 2008-09-25 2013-07-30 Vmware, Inc. Snippet search
US8522210B1 (en) * 2009-12-29 2013-08-27 Cadence Design Systems, Inc. Detecting indexing errors in declarative languages
US20130339931A1 (en) * 2012-06-19 2013-12-19 Sap Ag Application trace replay and simulation systems and methods
US20140068346A1 (en) * 2012-08-29 2014-03-06 Freescale Semiconductor, Inc. Data processor device for handling a watchpoint and method thereof
US20140068349A1 (en) * 2012-08-29 2014-03-06 Freescale Semiconductor, Inc. Data processor device for handling a watchpoint and method thereof
US8718738B2 (en) 2002-03-08 2014-05-06 Glt Acquisition Corp. Method and apparatus for coupling a sample probe with a sample site
US8726092B1 (en) * 2011-12-29 2014-05-13 Google Inc. Identifying causes of application crashes
US8762958B2 (en) 2002-11-06 2014-06-24 Identify Software, Ltd. System and method for troubleshooting software configuration problems using application tracing
US8762956B1 (en) * 2007-01-31 2014-06-24 The Mathworks, Inc. Generating a report document from code
US20140189654A1 (en) * 2006-05-31 2014-07-03 Angelos D. Keromytis Systems, methods, and media for testing software patches
EP2763028A1 (en) * 2013-02-04 2014-08-06 Hon Hai Precision Industry Co., Ltd. Remote control system and method
US8868147B2 (en) 2004-04-28 2014-10-21 Glt Acquisition Corp. Method and apparatus for controlling positioning of a noninvasive analyzer sample probe
US20140337301A1 (en) * 2013-05-08 2014-11-13 Almondsoft Co., Ltd. Big data extraction system and method
US20150066814A1 (en) * 2013-08-28 2015-03-05 International Business Machines Corporation Sentiment Analysis of Data Logs
US20150066869A1 (en) * 2013-09-04 2015-03-05 Concurix Corporation Module Database with Tracing Options
US20150067652A1 (en) * 2013-09-04 2015-03-05 Concurix Corporation Module Specific Tracing in a Shared Module Environment
US20150067654A1 (en) * 2013-09-04 2015-03-05 Concurix Corporation Tracing System for Application and Module Tracing
US20150106572A1 (en) * 2013-10-11 2015-04-16 Red Hat, Inc. Scripted multiprocess probing without system privilege
US9026578B2 (en) 2004-05-14 2015-05-05 Microsoft Corporation Systems and methods for persisting data between web pages
US20150149984A1 (en) * 2013-11-22 2015-05-28 International Business Machines Corporation Determining instruction execution history in a debugger
CN104794046A (en) * 2014-01-21 2015-07-22 腾讯科技(深圳)有限公司 Method and system for symbolizing program running log
US20150205651A1 (en) * 2014-01-17 2015-07-23 International Business Machines Corporation Computer flight recorder with active error detection
US9111038B2 (en) 2011-11-04 2015-08-18 International Business Machines Corporation Integrated debugger and code coverage tool
TWI506420B (en) * 2009-12-23 2015-11-01 Intel Corp Relational modeling for performance analysis of multi-core processors
US20150317232A1 (en) * 2012-11-29 2015-11-05 Qizhi Software (Beijing) Company Limited Method And Apparatus For Positioning Crash
US20150378870A1 (en) * 2014-06-30 2015-12-31 Microsoft Corporation Time travel debugging in managed runtime
US20160026679A1 (en) * 2011-04-12 2016-01-28 Microsoft Technology Licensing, Llc Navigating performance data from different subsystems
US20160042358A1 (en) * 2014-08-11 2016-02-11 International Business Machines Corporation Mapping user actions to historical paths to determine a predicted endpoint
WO2015195676A3 (en) * 2014-06-16 2016-02-18 Silverthread, Inc. Computer-implemented tools and methods for extracting information about the structure of a large computer software system, exploring its structure, discovering problems in its design, and enabling refactoring
US9292311B2 (en) 2012-12-20 2016-03-22 International Business Machines Corporation Method and apparatus for providing software problem solutions
US9317257B2 (en) 2012-06-22 2016-04-19 Microsoft Technology Licensing, Llc Folded views in development environment
US20160119208A1 (en) * 2013-02-07 2016-04-28 International Business Machines Corporation Transparently tracking provenance information in distributed data systems
US20160147559A1 (en) * 2014-11-24 2016-05-26 Red Hat, Inc. Modification of context saving functions
US20160171640A1 (en) * 2014-12-13 2016-06-16 Microsoft Technology Licensing, Llc Frame Invalidation Control with Causality Attribution
CN105723357A (en) * 2013-09-04 2016-06-29 肯赛里克斯公司 Module specific tracing in a shared module environment
US9424026B2 (en) * 2014-09-29 2016-08-23 Sap Se Visualizations of inter-entity calls
US20160246950A1 (en) * 2014-03-04 2016-08-25 Xi'an Jiaotong University Method for plagiarism detection of multithreaded program based on thread slice birthmark
US20160314036A1 (en) * 2014-04-11 2016-10-27 Tencent Technology (Shenzhen) Company Limited Method and Apparatus for Repairing Dynamic Link Library File
US20160335167A1 (en) * 2006-10-31 2016-11-17 Microsoft Technology Licensing, Llc Stepping and application state viewing between points
US9575874B2 (en) 2013-04-20 2017-02-21 Microsoft Technology Licensing, Llc Error list and bug report analysis for configuring an application tracer
US20170109258A1 (en) * 2015-03-26 2017-04-20 Emc Corporation Smart logging of trace data for storage systems
US9658943B2 (en) 2013-05-21 2017-05-23 Microsoft Technology Licensing, Llc Interactive graph for navigating application code
US9658936B2 (en) 2013-02-12 2017-05-23 Microsoft Technology Licensing, Llc Optimization analysis using similar frequencies
US9665474B2 (en) 2013-03-15 2017-05-30 Microsoft Technology Licensing, Llc Relationships derived from trace data
US20170220336A1 (en) * 2016-02-02 2017-08-03 International Business Machines Corporation System and method for automatic api candidate generation
US9734040B2 (en) 2013-05-21 2017-08-15 Microsoft Technology Licensing, Llc Animated highlights in a graph representing an application
US9754396B2 (en) 2013-07-24 2017-09-05 Microsoft Technology Licensing, Llc Event chain visualization of performance data
US9767006B2 (en) 2013-02-12 2017-09-19 Microsoft Technology Licensing, Llc Deploying trace objectives using cost analyses
US9772927B2 (en) 2013-11-13 2017-09-26 Microsoft Technology Licensing, Llc User interface for selecting tracing origins for aggregating classes of trace data
US9804949B2 (en) 2013-02-12 2017-10-31 Microsoft Technology Licensing, Llc Periodicity optimization in an automated tracing system
US9823993B2 (en) 2015-03-04 2017-11-21 International Business Machines Corporation Preemptive trouble shooting using dialog manager
US20180024909A1 (en) * 2016-07-25 2018-01-25 International Business Machines Corporation Monitoring growth of memory buffers in logging and dynamically adapting quantity and detail of logging
US20180121659A1 (en) * 2016-10-28 2018-05-03 Tala Security, Inc. Application security service
US10037362B1 (en) 2017-07-24 2018-07-31 International Business Machines Corpoation Mining procedure dialogs from source content
US20180278476A1 (en) * 2015-09-09 2018-09-27 International Business Machines Corporation Client-configured server class tracing to a configurable threshold
US10178031B2 (en) 2013-01-25 2019-01-08 Microsoft Technology Licensing, Llc Tracing with a workload distributor
US10176800B2 (en) 2017-02-10 2019-01-08 International Business Machines Corporation Procedure dialogs using reinforcement learning
US10296464B2 (en) * 2016-12-09 2019-05-21 Intel Corporation System, apparatus and method for dynamic profiling in a processor
US10310977B2 (en) 2016-10-20 2019-06-04 Microsoft Technology Licensing, Llc Facilitating recording a trace file of code execution using a processor cache
US10324851B2 (en) 2016-10-20 2019-06-18 Microsoft Technology Licensing, Llc Facilitating recording a trace file of code execution using way-locking in a set-associative processor cache
US10346292B2 (en) 2013-11-13 2019-07-09 Microsoft Technology Licensing, Llc Software component recommendation based on multiple trace runs
US10394690B1 (en) * 2015-12-30 2019-08-27 Square, Inc. Serialize view model for debugging and application support
US10417116B2 (en) * 2016-07-28 2019-09-17 International Business Machines Corporation System, method, and apparatus for crowd-sourced gathering of application execution events for automatic application testing and replay
CN110263004A (en) * 2019-05-08 2019-09-20 北京字节跳动网络技术有限公司 Log recording method, device, electronic equipment and storage medium
US20190340104A1 (en) * 2018-05-03 2019-11-07 Sap Se Error finder tool
US10592394B2 (en) * 2016-10-11 2020-03-17 Green Hills Software Llc Systems, methods, and devices for vertically integrated instrumentation and trace reconstruction
US10713145B2 (en) * 2018-01-05 2020-07-14 International Business Machines Corporation Automated debugging with combined static and dynamic analysis
US10728112B2 (en) * 2009-03-24 2020-07-28 Amazon Technologies, Inc. System and method for tracking service results
US10963367B2 (en) 2016-08-31 2021-03-30 Microsoft Technology Licensing, Llc Program tracing for time travel debugging and analysis
CN112711365A (en) * 2020-12-30 2021-04-27 航天信息股份有限公司 Method and system for passing list control checking event
US11138092B2 (en) 2016-08-31 2021-10-05 Microsoft Technology Licensing, Llc Cache-based tracing for time travel debugging and analysis
WO2022015506A1 (en) * 2020-07-16 2022-01-20 Metawork Corporation Trace anomaly grouping and visualization technique
US20220019511A1 (en) * 2020-07-15 2022-01-20 Metawork Corporation Instrumentation overhead regulation technique
US11238017B2 (en) * 2018-01-30 2022-02-01 Salesforce.Com, Inc. Runtime detector for data corruptions
US11256604B2 (en) * 2020-01-24 2022-02-22 Splunk Inc. Multiple modes of data collection and analysis in a microservices-based architecture
US11295213B2 (en) * 2019-01-08 2022-04-05 International Business Machines Corporation Conversational system management
US11354220B2 (en) 2020-07-10 2022-06-07 Metawork Corporation Instrumentation trace capture technique
US11392483B2 (en) 2020-07-16 2022-07-19 Metawork Corporation Dynamic library replacement technique
US11481376B2 (en) 2018-06-19 2022-10-25 Salesforce, Inc. Platform for handling data corruptions
US11588912B2 (en) * 2019-06-13 2023-02-21 FullStory, Inc. Synchronized console data and user interface playback
US20230252182A1 (en) * 2022-02-06 2023-08-10 Adusso Oy System And Method For Recording User's On-Screen Activity Including The Confidentiality Of the Processed Data and Data Export To An External System

Families Citing this family (61)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US7831930B2 (en) 2001-11-20 2010-11-09 Universal Electronics Inc. System and method for displaying a user interface for a remote control application
US8086720B2 (en) * 2002-01-31 2011-12-27 International Business Machines Corporation Performance reporting in a network environment
US8418145B2 (en) 2002-11-07 2013-04-09 Ca, Inc. Simple method optimization
GB0303977D0 (en) * 2003-02-21 2003-03-26 Ibm A method and system for generating a tutorial application
US8490073B2 (en) * 2007-03-30 2013-07-16 International Business Machines Corporation Controlling tracing within compiled code
US8069371B2 (en) * 2007-04-26 2011-11-29 Hewlett-Packard Development Company, L.P. Method and system for remotely debugging a hung or crashed computing system
EP2001164A1 (en) * 2007-05-14 2008-12-10 Abb Research Ltd. Simplified support of an isolated computer network
US20090182798A1 (en) * 2008-01-11 2009-07-16 Mediatek Inc. Method and apparatus to improve the effectiveness of system logging
US7877642B2 (en) * 2008-10-22 2011-01-25 International Business Machines Corporation Automatic software fault diagnosis by exploiting application signatures
US8095520B2 (en) * 2008-11-03 2012-01-10 Oracle International Corporation Event recording with local event record locking
US8015450B1 (en) * 2009-03-26 2011-09-06 Symantec Corporation Systems and methods for detecting and automatically installing missing software components
US9582396B2 (en) * 2009-10-23 2017-02-28 Novell, Inc. Techniques for generating an executable debugger script
US9189367B2 (en) * 2010-04-20 2015-11-17 Salesforce.Com, Inc. Methods and systems for debugging bytecode in an on-demand service environment
US8966447B2 (en) * 2010-06-21 2015-02-24 Apple Inc. Capturing and displaying state of automated user-level testing of a graphical user interface application
US20110321017A1 (en) * 2010-06-29 2011-12-29 International Business Machines Corporation Computer code debugging method and apparatus providing exception breakpoints
US9747187B2 (en) 2010-10-27 2017-08-29 International Business Machines Corporation Simulating black box test results using information from white box testing
CN102063367B (en) * 2010-10-29 2013-07-17 凌阳科技股份有限公司 Off-line analysis method and device aiming at computer crash program
US8938720B2 (en) * 2010-11-30 2015-01-20 Sap Se Trace visualization for object oriented programs
US8549360B2 (en) 2011-01-07 2013-10-01 International Business Machines Corporation Early collection of diagnostic information
US9256510B2 (en) * 2011-06-09 2016-02-09 International Business Machines Corporation Automatic rules based capturing of graphical objects for specified applications
US20130081001A1 (en) * 2011-09-23 2013-03-28 Microsoft Corporation Immediate delay tracker tool
CN103092742B (en) * 2011-10-31 2015-08-19 国际商业机器公司 Program log recording optimization method and system
US8930886B2 (en) * 2011-12-15 2015-01-06 Microsoft Corporation Identifying application resources through implicit application models
US9215266B2 (en) * 2012-01-26 2015-12-15 Zoom International S.R.O. System and method for zero-footprint screen capture
US10133653B2 (en) 2012-02-23 2018-11-20 Cadence Design Systems, Inc. Recording and playback of trace and video log data for programs
US8572573B2 (en) * 2012-03-09 2013-10-29 Nvidia Corporation Methods and apparatus for interactive debugging on a non-preemptible graphics processing unit
US9262301B2 (en) * 2012-05-10 2016-02-16 Telefonaktiebolaget L M Ericsson (Publ) Observability control with observability information file
US8943370B2 (en) 2012-06-21 2015-01-27 International Business Machines Corporation Trace value correlation with data field declarations
US8832664B2 (en) * 2012-07-20 2014-09-09 Intel Mobile Communications GmbH Method and apparatus for interconnect tracing and monitoring in a system on chip
US20140068569A1 (en) * 2012-08-31 2014-03-06 Microsoft Corporation User directed profiling
JP5983308B2 (en) * 2012-10-25 2016-08-31 ブラザー工業株式会社 Image reading device
NL2009756C2 (en) * 2012-11-05 2014-05-08 Realworld Holding B V Method and arrangement for collecting timing data related to a computer application.
US9665465B1 (en) * 2012-11-19 2017-05-30 Amazon Technologies, Inc. Automated determination of application permissions
US8984484B2 (en) * 2012-11-27 2015-03-17 Nvidia Corporation Video sequence recording during a testing session on a data processing device to enable fault detection
US9164821B2 (en) 2012-12-14 2015-10-20 International Business Machines Corporation Performing diagnostic tracing of an executing application to identify suspicious pointer values
US8938718B2 (en) * 2012-12-18 2015-01-20 International Business Machines Corporation Managing window focus while debugging a graphical user interface program
US8943477B2 (en) * 2012-12-18 2015-01-27 International Business Machines Corporation Debugging a graphical user interface code script with non-intrusive overlays
US9021262B2 (en) * 2013-01-25 2015-04-28 Concurix Corporation Obfuscating trace data
US9773216B2 (en) * 2013-02-21 2017-09-26 Atlassian Pty Ltd Workflow sharing
US9559928B1 (en) * 2013-05-03 2017-01-31 Amazon Technologies, Inc. Integrated test coverage measurement in distributed systems
US9195570B2 (en) 2013-09-27 2015-11-24 International Business Machines Corporation Progressive black-box testing of computer software applications
US10289411B2 (en) * 2013-11-18 2019-05-14 Microsoft Technology Licensing, Llc Diagnosing production applications
WO2015195125A1 (en) * 2014-06-19 2015-12-23 Hewlett-Packard Development Company, L.P. Install runtime agent for security test
US10445166B2 (en) 2014-06-24 2019-10-15 International Business Machines Corporation System verification of interactive screenshots and log files between client systems and server systems within a network computing environment
US9998348B2 (en) * 2014-07-31 2018-06-12 Cisco Technology, Inc. Monitoring a business transaction utilizing PHP engines
US9262132B1 (en) * 2015-04-13 2016-02-16 Semmle Limited Incremental local source code analysis
US10235266B2 (en) * 2015-07-10 2019-03-19 Ca, Inc. Application screen mapping for mobile analytics
US9697104B2 (en) * 2015-12-07 2017-07-04 Sap Se End-to end tracing and logging
CN106971103B (en) * 2016-02-25 2018-12-14 三星半导体(中国)研究开发有限公司 The method of application program permission is managed in electric terminal
US10572245B1 (en) * 2016-08-30 2020-02-25 Amazon Technologies, Inc. Identifying versions of running programs using signatures derived from object files
US10216610B2 (en) 2016-09-27 2019-02-26 International Business Machines Corporation Debug session analysis for related work item discovery
US10579400B2 (en) * 2016-11-11 2020-03-03 International Business Machines Corporation Path-sensitive contextual help system
US11016862B2 (en) 2017-05-23 2021-05-25 International Business Machines Corporation Error-initiated mirror redrive to collect diagnostic information
US10649884B2 (en) 2018-02-08 2020-05-12 The Mitre Corporation Methods and system for constrained replay debugging with message communications
US11327993B2 (en) * 2018-03-26 2022-05-10 Verizon Patent And Licensing Inc. Systems and methods for managing and delivering digital content
US10761965B2 (en) * 2018-09-28 2020-09-01 Atlassian Pty Ltd. Detecting method calls based on stack trace data
US11200053B2 (en) * 2018-11-09 2021-12-14 Affirm, Inc. Deployment models
US11645192B2 (en) * 2020-03-11 2023-05-09 Nec Corporation Graph-based method for inductive bug localization
US11762858B2 (en) 2020-03-19 2023-09-19 The Mitre Corporation Systems and methods for analyzing distributed system data streams using declarative specification, detection, and evaluation of happened-before relationships
US11726897B2 (en) * 2020-04-13 2023-08-15 The Toronto-Dominion Bank System and method for testing applications
US11604642B2 (en) 2021-01-04 2023-03-14 Bank Of America Corporation System for computer program code issue detection and resolution using an automated progressive code quality engine

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US5483468A (en) * 1992-10-23 1996-01-09 International Business Machines Corporation System and method for concurrent recording and displaying of system performance data
US5781720A (en) * 1992-11-19 1998-07-14 Segue Software, Inc. Automated GUI interface testing
US6237138B1 (en) * 1996-11-12 2001-05-22 International Business Machines Corp. Buffered screen capturing software tool for usability testing of computer applications
US6360331B2 (en) * 1998-04-17 2002-03-19 Microsoft Corporation Method and system for transparently failing over application configuration information in a server cluster
US6467052B1 (en) * 1999-06-03 2002-10-15 Microsoft Corporation Method and apparatus for analyzing performance of data processing system

Family Cites Families (84)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US4511960A (en) 1982-01-15 1985-04-16 Honeywell Information Systems Inc. Data processing system auto address development logic for multiword fetch
US4503495A (en) 1982-01-15 1985-03-05 Honeywell Information Systems Inc. Data processing system common bus utilization detection logic
US4598364A (en) 1983-06-29 1986-07-01 International Business Machines Corporation Efficient trace method adaptable to multiprocessors
US4782461A (en) 1984-06-21 1988-11-01 Step Engineering Logical grouping of facilities within a computer development system
US5481740A (en) 1986-04-14 1996-01-02 National Instruments Corporation Method and apparatus for providing autoprobe features in a graphical data flow diagram
JPH0731615B2 (en) 1986-04-18 1995-04-10 日本電気株式会社 Information processing equipment
US5021949A (en) 1988-02-29 1991-06-04 International Business Machines Corporation Method and apparatus for linking an SNA host to a remote SNA host over a packet switched communications network
US5121489A (en) 1988-08-02 1992-06-09 International Business Machines Corporation Tracing method for identifying program execution paths using a trace points bit map with one-to-one correspondence with embedded trace points
EP0396833A1 (en) 1989-05-12 1990-11-14 International Business Machines Corporation Trace facility for use in a multiprocessing environment
US5394544A (en) 1989-08-07 1995-02-28 Ricoh Co., Ltd. Software system debugger with distinct interrupt vector maps for debugging and application programs
US5465258A (en) 1989-11-13 1995-11-07 Integrity Systems, Inc. Binary image performance evaluation tool
JPH03217949A (en) 1990-01-23 1991-09-25 Hitachi Ltd Computer system
US5410685A (en) 1990-06-12 1995-04-25 Regents Of The University Of Michigan Non-intrinsive method and system for recovering the state of a computer system and non-intrusive debugging method and system utilizing same
US5657438A (en) 1990-11-27 1997-08-12 Mercury Interactive (Israel) Ltd. Interactive system for developing tests of system under test allowing independent positioning of execution start and stop markers to execute subportion of test script
US5297274A (en) 1991-04-15 1994-03-22 International Business Machines Corporation Performance analysis of program in multithread OS by creating concurrently running thread generating breakpoint interrupts to active tracing monitor
US5193180A (en) 1991-06-21 1993-03-09 Pure Software Inc. System for modifying relocatable object code files to monitor accesses to dynamically allocated memory
US5265254A (en) 1991-08-14 1993-11-23 Hewlett-Packard Company System of debugging software through use of code markers inserted into spaces in the source code during and after compilation
US5450586A (en) 1991-08-14 1995-09-12 Hewlett-Packard Company System for analyzing and debugging embedded software through dynamic and interactive use of code markers
US5386522A (en) 1991-12-30 1995-01-31 International Business Machines, Corp. Dynamic physical address aliasing during program debugging
US5430586A (en) 1992-08-03 1995-07-04 Koo; Kah O. Tape extractor and pad lifter for extracting tape from a cassette center well, and related method
US5513317A (en) 1992-09-10 1996-04-30 International Business Machines Corporation System and method for permitting rapid refinement of data output from a debugger
US5574897A (en) 1992-09-30 1996-11-12 International Business Machines Corporation System managed logging of objects to speed recovery processing
US5408650A (en) 1993-06-29 1995-04-18 Digital Equipment Corporation Memory analysis system for dynamically displaying memory allocation and de-allocation events associated with an application program
DE69415600T2 (en) 1993-07-28 1999-07-15 Koninkl Philips Electronics Nv Microcontroller with hardware troubleshooting support based on the boundary scan method
US5551037A (en) 1993-11-19 1996-08-27 Lucent Technologies Inc. Apparatus and methods for visualizing operation of a system of processes
US5421009A (en) 1993-12-22 1995-05-30 Hewlett-Packard Company Method of remotely installing software directly from a central computer
US5581697A (en) 1994-01-28 1996-12-03 Sun Microsystems, Inc. Method and apparatus for run-time error checking using dynamic patching
US5632032A (en) 1994-02-07 1997-05-20 International Business Machines Corporation Cross address space thread control in a multithreaded environment
US5446876A (en) 1994-04-15 1995-08-29 International Business Machines Corporation Hardware mechanism for instruction/data address tracing
US5533192A (en) 1994-04-21 1996-07-02 Apple Computer, Inc. Computer program debugging system and method
US5615331A (en) 1994-06-23 1997-03-25 Phoenix Technologies Ltd. System and method for debugging a computing system
EP0690378A1 (en) 1994-06-30 1996-01-03 Tandem Computers Incorporated Tool and method for diagnosing and correcting errors in a computer programm
US5694539A (en) 1994-08-10 1997-12-02 Intrinsa Corporation Computer process resource modelling method and apparatus
US5526485A (en) 1994-10-13 1996-06-11 Microsoft Corporation Just-in-time debugging system and methods under the windows 3.0 and windows 3.1 operating systems
US5745748A (en) 1994-12-09 1998-04-28 Sprint Communication Co. L.P. System and method for direct accessing of remote data
US5642478A (en) 1994-12-29 1997-06-24 International Business Machines Corporation Distributed trace data acquisition system
US5612898A (en) 1995-02-09 1997-03-18 Intel Corporation Communication protocol event logging system for use with various protocols
CA2224689C (en) 1995-06-02 2002-10-29 Rational Software Corporation Remote monitoring of computer programs
JP3426428B2 (en) 1995-10-27 2003-07-14 富士通株式会社 Transaction tracing device
US5867643A (en) 1995-11-06 1999-02-02 Apple Computer, Inc. Run-time data type description mechanism for performance information in an extensible computer system
US5848274A (en) 1996-02-29 1998-12-08 Supercede, Inc. Incremental byte code compilation system
US5838910A (en) 1996-03-14 1998-11-17 Domenikos; Steven D. Systems and methods for executing application programs from a memory device linked to a server at an internet site
US5732210A (en) 1996-03-15 1998-03-24 Hewlett-Packard Company Use of dynamic translation to provide fast debug event checks
US5771385A (en) 1996-03-29 1998-06-23 Sun Microsystems, Inc. Setting and getting system debug flags by name at runtime
US5870606A (en) 1996-05-01 1999-02-09 International Business Machines Corp. Data triggered trace technique for debugging software programs
US5928369A (en) 1996-06-28 1999-07-27 Synopsys, Inc. Automatic support system and method based on user submitted stack trace
US6219826B1 (en) 1996-08-01 2001-04-17 International Business Machines Corporation Visualizing execution patterns in object-oriented programs
US5852720A (en) * 1996-08-16 1998-12-22 Compaq Computer Corp. System for storing display data during first time period prior to failure of computer and during second time period after reset of the computer
US5896535A (en) 1996-08-20 1999-04-20 Telefonaktiebolaget L M Ericsson (Publ) Method and system for testing computer system software
US5903718A (en) 1996-09-16 1999-05-11 International Business Machines Corporation Remote program monitor method and system using a system-under-test microcontroller for self-debug
US6253317B1 (en) 1997-01-09 2001-06-26 Sun Microsystems, Inc. Method and apparatus for providing and handling traps
US6026433A (en) 1997-03-17 2000-02-15 Silicon Graphics, Inc. Method of creating and editing a web site in a client-server environment using customizable web site templates
US5960198A (en) 1997-03-19 1999-09-28 International Business Machines Corporation Software profiler with runtime control to enable and disable instrumented executable
US5983366A (en) 1997-03-19 1999-11-09 Optimay Corporation Data processing system having monitoring of software activity
CA2205096C (en) 1997-05-09 2001-10-09 Ibm Canada Limited-Ibm Canada Limitee A system for remote debugging of client/server applications
US6282701B1 (en) 1997-07-31 2001-08-28 Mutek Solutions, Ltd. System and method for monitoring and analyzing the execution of computer programs
US6202199B1 (en) 1997-07-31 2001-03-13 Mutek Solutions, Ltd. System and method for remotely analyzing the execution of computer programs
US5940618A (en) 1997-09-22 1999-08-17 International Business Machines Corporation Code instrumentation system with non intrusive means and cache memory optimization for dynamic monitoring of code segments
US5895535A (en) * 1997-09-24 1999-04-20 Eastman Kodak Company Apparatus and method for measuring web alignment at a splice
US6108330A (en) 1997-09-26 2000-08-22 3Com Corporation Apparatus and methods for use therein for an ISDN LAN modem that selects among a plurality of DNS servers for responding to a DNS query
US6047124A (en) 1997-10-31 2000-04-04 Sun Microsystems, Inc. System and method for tracing device drivers using a computer
US6026438A (en) 1997-10-31 2000-02-15 Merrill Lynch & Co., Inc. Dynamic workstation configuration processor
US5938778A (en) 1997-11-10 1999-08-17 International Business Machines Corporation System and method for tracing instructions in an information handling system without changing the system source code
US6507805B1 (en) 1997-12-12 2003-01-14 International Business Machines Corporation Method and system for compensating for instrumentation overhead in trace data by detecting minimum event times
US6321375B1 (en) 1998-05-14 2001-11-20 International Business Machines Corporation Method and apparatus for determining most recently used method
US6587969B1 (en) * 1998-06-22 2003-07-01 Mercury Interactive Corporation Software system and methods for testing the functionality of a transactional server
US6593940B1 (en) * 1998-12-23 2003-07-15 Intel Corporation Method for finding errors in multithreaded applications
US6415394B1 (en) 1999-05-10 2002-07-02 Delphi Technologies, Inc. Method and circuit for analysis of the operation of a microcontroller using signature analysis during operation
US6374369B1 (en) 1999-05-21 2002-04-16 Philips Electronics North America Corporation Stochastic performance analysis method and apparatus therefor
US6511263B2 (en) * 1999-10-19 2003-01-28 Cutler-Malone Industries, Inc. System for spreading particulate materials
US6490696B1 (en) 1999-12-15 2002-12-03 Electronics For Imaging, Inc. System and method for printer output regression testing using display lists
US7058928B2 (en) 1999-12-23 2006-06-06 Identify Software Ltd. System and method for conditional tracing of computer programs
US20020087949A1 (en) 2000-03-03 2002-07-04 Valery Golender System and method for software diagnostics using a combination of visual and dynamic tracing
US7089536B2 (en) 2000-05-31 2006-08-08 Kabushiki Kaisha Toshiba Computer system and method for aiding log base debugging
US6637001B1 (en) * 2000-08-30 2003-10-21 Matsushita Electric Industrial Co., Ltd. Apparatus and method for image/voice transmission
US6557011B1 (en) 2000-10-31 2003-04-29 International Business Machines Corporation Methods for analyzing dynamic program behavior using user-defined classifications of an execution trace
US8312435B2 (en) 2000-12-26 2012-11-13 Identify Software Ltd. (IL) System and method for conditional tracing of computer programs
US7320125B2 (en) 2001-05-24 2008-01-15 Techtracker, Inc. Program execution stack signatures
JP2003203001A (en) 2001-12-28 2003-07-18 Toshiba Corp Method and program for analyzing log
AU2003254027A1 (en) 2002-07-19 2004-02-09 Xaffire, Inc. Method and apparatus for instrumentation on/off
US7386839B1 (en) 2002-11-06 2008-06-10 Valery Golender System and method for troubleshooting software configuration problems using application tracing
US7114150B2 (en) 2003-02-13 2006-09-26 International Business Machines Corporation Apparatus and method for dynamic instrumenting of code to minimize system perturbation
US6865506B1 (en) * 2003-09-30 2005-03-08 Hitachi Global Storage Technologies Netherlands B.V. Computer system having drive temperature self-adjustment for temperature-sensitive measurements
US7703094B2 (en) 2004-12-30 2010-04-20 Intel Corporation Adaptive and dynamic filtering of threaded programs

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US5483468A (en) * 1992-10-23 1996-01-09 International Business Machines Corporation System and method for concurrent recording and displaying of system performance data
US5781720A (en) * 1992-11-19 1998-07-14 Segue Software, Inc. Automated GUI interface testing
US6237138B1 (en) * 1996-11-12 2001-05-22 International Business Machines Corp. Buffered screen capturing software tool for usability testing of computer applications
US6360331B2 (en) * 1998-04-17 2002-03-19 Microsoft Corporation Method and system for transparently failing over application configuration information in a server cluster
US6467052B1 (en) * 1999-06-03 2002-10-15 Microsoft Corporation Method and apparatus for analyzing performance of data processing system

Cited By (356)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20100088683A1 (en) * 2000-03-03 2010-04-08 Identify Software, Ltd. System and method for software diagnostics using a combination of visual and dynamic tracing
US8504994B2 (en) 2000-03-03 2013-08-06 Identify Software, Ltd. System and method for software diagnostics using a combination of visual and dynamic tracing
US20050203359A1 (en) * 2000-05-02 2005-09-15 Blank Thomas B. Optical sampling interface system for in-vivo measurement of tissue
US8312435B2 (en) 2000-12-26 2012-11-13 Identify Software Ltd. (IL) System and method for conditional tracing of computer programs
US7367017B2 (en) * 2001-01-31 2008-04-29 Hewlett-Packard Development Company, L.P. Method and apparatus for analyzing machine control sequences
US20040201627A1 (en) * 2001-01-31 2004-10-14 Maddocks Peter M. Method and apparatus for analyzing machine control sequences
US7539950B2 (en) * 2001-04-20 2009-05-26 Microsoft Corporation Method and system for displaying categorized information on a user interface
US20060005149A1 (en) * 2001-04-20 2006-01-05 Microsoft Corporation Method and system for displaying categorized information on a user interface
US20060005150A1 (en) * 2001-04-20 2006-01-05 Microsoft Corporation Method and system for displaying categorized information on a user interface
US7689937B2 (en) * 2001-04-20 2010-03-30 Microsoft Corporation Method and system for displaying categorized information on a user interface
US7376937B1 (en) 2001-05-31 2008-05-20 Oracle International Corporation Method and mechanism for using a meta-language to define and analyze traces
US7380239B1 (en) 2001-05-31 2008-05-27 Oracle International Corporation Method and mechanism for diagnosing computer applications using traces
US20030056200A1 (en) * 2001-09-19 2003-03-20 Jun Li Runtime monitoring in component-based systems
US8473922B2 (en) * 2001-09-19 2013-06-25 Hewlett-Packard Development Company, L.P. Runtime monitoring in component-based systems
US7613815B1 (en) * 2001-10-15 2009-11-03 Netapp, Inc. Method and apparatus for customized logging in a network cache
US7587484B1 (en) * 2001-10-18 2009-09-08 Microsoft Corporation Method and system for tracking client software use
US20050061221A1 (en) * 2001-11-02 2005-03-24 Mariusz Paszkowski Superhydrophobic coating
US7237234B2 (en) * 2001-12-13 2007-06-26 Texas Instruments Incorporated Method for selective solicitation of user assistance in the performance tuning process
US20030140334A1 (en) * 2001-12-13 2003-07-24 Granston Elana D. Method for selective solicitation of user assistance in the performance tuning process
US7103876B1 (en) * 2001-12-26 2006-09-05 Bellsouth Intellectual Property Corp. System and method for analyzing executing computer applications in real-time
US7787924B2 (en) 2002-03-08 2010-08-31 Sensys Medical, Inc. Compact apparatus for noninvasive measurement of glucose through near-infrared spectroscopy
US20090318786A1 (en) * 2002-03-08 2009-12-24 Blank Thomas B Channeled tissue sample probe method and apparatus
US8718738B2 (en) 2002-03-08 2014-05-06 Glt Acquisition Corp. Method and apparatus for coupling a sample probe with a sample site
US7697966B2 (en) 2002-03-08 2010-04-13 Sensys Medical, Inc. Noninvasive targeting system method and apparatus
US20060173254A1 (en) * 2002-03-08 2006-08-03 Acosta George M Compact apparatus for noninvasive measurement of glucose through near-infrared spectroscopy
US7243342B2 (en) * 2002-06-11 2007-07-10 Intel Corporation Methods and apparatus for determining if a user-defined software function is a memory allocation function during compile-time
US20040078789A1 (en) * 2002-06-11 2004-04-22 Rakesh Ghiya Methods and apparatus for determining if a user-defined software function is a memory allocation function during compile-time
US7165190B1 (en) * 2002-07-29 2007-01-16 Oracle International Corporation Method and mechanism for managing traces within a computer system
US7512954B2 (en) 2002-07-29 2009-03-31 Oracle International Corporation Method and mechanism for debugging a series of related events within a computer system
US20050160431A1 (en) * 2002-07-29 2005-07-21 Oracle Corporation Method and mechanism for debugging a series of related events within a computer system
US7200588B1 (en) * 2002-07-29 2007-04-03 Oracle International Corporation Method and mechanism for analyzing trace data using a database management system
US20040222944A1 (en) * 2002-09-20 2004-11-11 American Megatrands, Inc. In-line video, keyboard and mouse remote management unit
US7454490B2 (en) 2002-09-20 2008-11-18 American Megatrends, Inc. In-line video, keyboard and mouse remote management unit
US8762958B2 (en) 2002-11-06 2014-06-24 Identify Software, Ltd. System and method for troubleshooting software configuration problems using application tracing
US10073760B2 (en) 2002-11-06 2018-09-11 Indentify Software Ltd. (IL) System and method for troubleshooting software configuration problems using application tracing
US7409711B1 (en) * 2002-12-24 2008-08-05 The Chamberlain Group, Inc. Method and apparatus for troubleshooting a security gate system remotely
US7216336B1 (en) * 2003-02-28 2007-05-08 Emc Corporation Sequential event monitoring module
US20050159656A1 (en) * 2003-03-07 2005-07-21 Hockersmith Linda J. Method and apparatus for presentation of noninvasive glucose concentration information
US20050187439A1 (en) * 2003-03-07 2005-08-25 Blank Thomas B. Sampling interface system for in-vivo estimation of tissue analyte concentration
US8032866B1 (en) 2003-03-27 2011-10-04 Identify Software Ltd. System and method for troubleshooting runtime software problems using application learning
US7418141B2 (en) 2003-03-31 2008-08-26 American Megatrends, Inc. Method, apparatus, and computer-readable medium for identifying character coordinates
US20040190773A1 (en) * 2003-03-31 2004-09-30 American Megatrends, Inc. Method, apparatus, and computer-readable medium for identifying character coordinates
US7412625B2 (en) 2003-05-27 2008-08-12 American Megatrends, Inc. Method and system for remote software debugging
US20040243883A1 (en) * 2003-05-27 2004-12-02 American Megatrends, Inc. Method and system for remote software debugging
US7287223B2 (en) * 2003-06-06 2007-10-23 Fuji Xerox Co., Ltd. System for editing and aligning captured events and data to a common time base to create customer service engagement multimedia document
US20040260759A1 (en) * 2003-06-06 2004-12-23 Fuji Xerox Co., Ltd. Systems and methods for capturing customer service engagements
US20040255276A1 (en) * 2003-06-16 2004-12-16 Gene Rovang Method and system for remote software testing
US7546584B2 (en) * 2003-06-16 2009-06-09 American Megatrends, Inc. Method and system for remote software testing
US7945899B2 (en) 2003-06-16 2011-05-17 American Megatrends, Inc. Method and system for remote software testing
US20090235122A1 (en) * 2003-06-16 2009-09-17 Gene Rovang Method and System for Remote Software Testing
US8539435B1 (en) 2003-06-16 2013-09-17 American Megatrends, Inc. Method and system for remote software testing
US20050108562A1 (en) * 2003-06-18 2005-05-19 Khazan Roger I. Technique for detecting executable malicious code using a combination of static and dynamic analyses
US7543277B1 (en) 2003-06-27 2009-06-02 American Megatrends, Inc. Method and system for remote software debugging
US8898638B1 (en) 2003-06-27 2014-11-25 American Megatrends, Inc. Method and system for remote software debugging
US8046743B1 (en) 2003-06-27 2011-10-25 American Megatrends, Inc. Method and system for remote software debugging
US20050015359A1 (en) * 2003-07-18 2005-01-20 Bernhard Kidalka Method for representing a file structure
US8326089B2 (en) * 2003-07-18 2012-12-04 Siemens Aktiengesellschaft Method for representing a file structure
US7305660B2 (en) * 2003-08-29 2007-12-04 International Business Machines Corporation Method to generate a formatted trace for an embedded device
US20050050523A1 (en) * 2003-08-29 2005-03-03 International Business Machines Corporation Method to generate a formatted trace for an embedded device
US20070234300A1 (en) * 2003-09-18 2007-10-04 Leake David W Method and Apparatus for Performing State-Table Driven Regression Testing
US20050066337A1 (en) * 2003-09-18 2005-03-24 Carmody Quinn Portable operating environment
US8024713B2 (en) 2003-09-19 2011-09-20 International Business Machines Corporation Using ghost agents in an environment supported by customer service providers
US20050065803A1 (en) * 2003-09-19 2005-03-24 International Business Machines Corporation Using ghost agents in an environment supported by customer service providers
US7386837B2 (en) * 2003-09-19 2008-06-10 International Business Machines Corporation Using ghost agents in an environment supported by customer service providers
US20080104578A1 (en) * 2003-09-19 2008-05-01 International Business Machines Corporation Using ghost agents in an environment supported by customer service providers
US7607124B2 (en) 2003-12-19 2009-10-20 International Business Machines Corporation Method for debugging a business process flow
US20070276692A1 (en) * 2003-12-19 2007-11-29 International Business Machines Corporaion Method for Debugging a Business Process Flow
US7519960B2 (en) 2003-12-19 2009-04-14 International Business Machines Corporation Method and system for debugging business process flow
US7793229B1 (en) * 2003-12-19 2010-09-07 Unisys Corporation Recording relevant information in a GUI window of a panel dump browser tool
US7730451B2 (en) * 2003-12-26 2010-06-01 Microsoft Corporation Source server
US20050144599A1 (en) * 2003-12-26 2005-06-30 Microsoft Corporation Source server
US20050146348A1 (en) * 2003-12-30 2005-07-07 Solid State Measurements, Inc. Method and apparatus for determining the dielectric constant of a low permittivity dielectric on a semiconductor wafer
US8359384B2 (en) 2004-03-01 2013-01-22 American Megatrends, Inc. Method, system, and apparatus for communicating with a computer management device
US20110015918A1 (en) * 2004-03-01 2011-01-20 American Megatrends, Inc. Method, system, and apparatus for communicating with a computer management device
US7827258B1 (en) 2004-03-01 2010-11-02 American Megatrends, Inc. Method, system, and apparatus for communicating with a computer management device
US20050223364A1 (en) * 2004-03-30 2005-10-06 Peri Ramesh V Method and apparatus to compact trace in a trace buffer
US20050251794A1 (en) * 2004-04-16 2005-11-10 Taylor Jason A Method of debugging code and software debugging tool
US8868147B2 (en) 2004-04-28 2014-10-21 Glt Acquisition Corp. Method and apparatus for controlling positioning of a noninvasive analyzer sample probe
US9026578B2 (en) 2004-05-14 2015-05-05 Microsoft Corporation Systems and methods for persisting data between web pages
US7970263B1 (en) * 2004-05-28 2011-06-28 Adobe Systems Incorporated Seamless integration of video capture in demonstration applications
US20060015612A1 (en) * 2004-06-03 2006-01-19 Fujitsu Limited Trace processing program, method and apparatus
US8543988B2 (en) * 2004-06-03 2013-09-24 Fujitsu Limited Trace processing program, method and system
US7644397B2 (en) * 2004-06-19 2010-01-05 Apple Inc. Software performance analysis using data mining
US20050283765A1 (en) * 2004-06-19 2005-12-22 Apple Computer, Inc. Software performance analysis using data mining
US7827539B1 (en) 2004-06-25 2010-11-02 Identify Software Ltd. System and method for automated tuning of program execution tracing
US7321988B2 (en) * 2004-06-30 2008-01-22 Microsoft Corporation Identifying a code library from the subset of base pointers that caused a failure generating instruction to be executed
US20060005078A1 (en) * 2004-06-30 2006-01-05 Microsoft Corporation System and method of identifying the source of a failure
US7581211B2 (en) * 2004-07-14 2009-08-25 International Business Machines Corporation Method and apparatus for on demand debugging, tracing, and logging of applications
US20060015853A1 (en) * 2004-07-14 2006-01-19 International Business Machines Corporation Method and apparatus for on demand debugging, tracing, and logging of applications
US7861020B1 (en) 2004-08-25 2010-12-28 American Megatrends, Inc. Redirecting input and output for multiple computers
US20110066773A1 (en) * 2004-08-25 2011-03-17 American Megatrends, Inc. Redirecting input and output for multiple computers
US7519749B1 (en) 2004-08-25 2009-04-14 American Megatrends, Inc. Redirecting input and output for multiple computers
US8001302B2 (en) 2004-08-25 2011-08-16 American Megatrends, Inc. Redirecting input and output for multiple computers
US7840728B1 (en) 2004-08-25 2010-11-23 American Megatrends, Inc. Redirecting input and output for multiple computers
US7793019B1 (en) 2004-08-25 2010-09-07 American Megatrends, Inc. Redirecting input and output for multiple computers
US8078596B2 (en) 2004-09-16 2011-12-13 International Business Machines Corporation Method and system for a non-hierarchical trace system using a hierarchical control interface
US20060075390A1 (en) * 2004-09-16 2006-04-06 International Business Machines Corporation Method and system for tracing components of computer applications
US7987390B2 (en) * 2004-09-24 2011-07-26 Oracle International Corporation Techniques for automatically tracking software errors
US7975179B2 (en) 2004-09-24 2011-07-05 Oracle International Corporation Techniques for automatic software error diagnostics
US20080307266A1 (en) * 2004-09-24 2008-12-11 Sashikanth Chandrasekaran Techniques for automatically tracking software errors
US8365145B2 (en) 2004-09-30 2013-01-29 Rockwell Automation Technologies, Inc. Systems and methods that facilitate management of add-on instruction generation, selection, and/or monitoring during execution
US20090083698A1 (en) * 2004-09-30 2009-03-26 Rockwell Automation Technologies, Inc. Systems and methods that facilitate management of add-on instruction generation, selection, and/or monitoring during execution
US9250897B2 (en) 2004-09-30 2016-02-02 Rockwell Automation Technologies, Inc. Systems and methods that facilitate management of add-on instruction generation, selection, and/or monitoring during execution
US20090083525A1 (en) * 2004-09-30 2009-03-26 Rockwell Automation Technologies, Inc. Systems and methods that facilitate management of add-on instruction generation, selection, and/or monitoring during execution
US20060112126A1 (en) * 2004-11-16 2006-05-25 Carlos Soto Automatic screen pop showing troubleshooting information
US8185868B1 (en) 2004-12-20 2012-05-22 The Mathworks, Inc. System and method for cell-based code editing and publishing
US20060259830A1 (en) * 2005-05-10 2006-11-16 Lucent Technologies Inc. Real-time software diagnostic tracing
US7661094B2 (en) * 2005-05-10 2010-02-09 Alcatel-Lucent Usa Inc. Real-time software diagnostic tracing
US20060259823A1 (en) * 2005-05-16 2006-11-16 Texas Instruments Incorporated Determining operating context of an executed instruction
US7987393B2 (en) * 2005-05-16 2011-07-26 Texas Instruments Incorporated Determining operating context of an executed instruction
US20060277527A1 (en) * 2005-06-01 2006-12-07 Microsoft Corporation Non-destructive debugging for add-ins
US7716650B2 (en) * 2005-06-01 2010-05-11 Microsoft Corporation Non-destructive debugging for add-ins
US7568186B2 (en) * 2005-06-07 2009-07-28 International Business Machines Corporation Employing a mirror probe handler for seamless access to arguments of a probed function
US20060277540A1 (en) * 2005-06-07 2006-12-07 International Business Machines Corporation Employing a mirror probe handler for seamless access to arguments of a probed function
US20070079288A1 (en) * 2005-09-30 2007-04-05 Chad Willwerth System and method for capturing filtered execution history of executable program code
US8010843B2 (en) 2005-12-14 2011-08-30 American Megatrends, Inc. System and method for debugging a target computer using SMBus
US20070168746A1 (en) * 2005-12-14 2007-07-19 Stefano Righi System and method for debugging a target computer using SMBus
US8566644B1 (en) 2005-12-14 2013-10-22 American Megatrends, Inc. System and method for debugging a target computer using SMBus
US7917904B2 (en) 2006-01-06 2011-03-29 Microsoft Corporation Automated analysis tasks of complex computer system
US8473604B2 (en) 2006-01-18 2013-06-25 International Business Machines Corporation Method for intelligent and automated transmission of local context in converged signaling
US20070168537A1 (en) * 2006-01-18 2007-07-19 Archan Misra Method for intelligent and automated transmission of local context in converged signaling
US20080285738A1 (en) * 2006-01-18 2008-11-20 International Business Machines Corporation Method for intelligent and automated transmission of local context in converged signaling
US20070168457A1 (en) * 2006-01-18 2007-07-19 International Business Machines Corporation Apparatus and method for addressing computer-related problems
US20070234306A1 (en) * 2006-03-31 2007-10-04 Klinger Uwe D Tracing performance of machine-readable instructions
US20070255579A1 (en) * 2006-04-28 2007-11-01 Boland Conor T Method and system for recording interactions of distributed users
US9606905B2 (en) * 2006-05-31 2017-03-28 The Trustees Of Columbia University In The City Of New York Systems, methods, and media for testing software patches
US20140189654A1 (en) * 2006-05-31 2014-07-03 Angelos D. Keromytis Systems, methods, and media for testing software patches
US8086904B2 (en) * 2006-07-28 2011-12-27 Apple Inc. Event-based setting of process tracing scope
US20080028370A1 (en) * 2006-07-28 2008-01-31 Apple Computer, Inc. Simultaneous viewing of multiple tool execution results
US8116179B2 (en) 2006-07-28 2012-02-14 Apple Inc. Simultaneous viewing of multiple tool execution results
US20130036330A1 (en) * 2006-07-28 2013-02-07 Apple Inc. Execution difference identification tool
US8930911B2 (en) * 2006-07-28 2015-01-06 Maxwell O. Drukman Execution difference identification tool
US20080126003A1 (en) * 2006-07-28 2008-05-29 Apple Computer, Inc. Event-based setting of process tracing scope
US20080034349A1 (en) * 2006-08-04 2008-02-07 Microsoft Corporation Incremental program modification based on usage data
US20080034084A1 (en) * 2006-08-04 2008-02-07 International Business Machines Corporation Method, system and program product for monitoring client programs in a client-server environment
US20080127043A1 (en) * 2006-08-30 2008-05-29 Yuanyuan Zhou Automatic Extraction of Programming Rules
US7783799B1 (en) 2006-08-31 2010-08-24 American Megatrends, Inc. Remotely controllable switch and testing methods using same
US20110040904A1 (en) * 2006-08-31 2011-02-17 American Megatrends, Inc. Remotely controllable switch and testing methods using same
US7979610B2 (en) 2006-08-31 2011-07-12 American Megatrends, Inc. Remotely controllable switch and testing methods using same
US20160335167A1 (en) * 2006-10-31 2016-11-17 Microsoft Technology Licensing, Llc Stepping and application state viewing between points
US10769047B2 (en) * 2006-10-31 2020-09-08 Microsoft Technology Licensing, Llc Stepping and application state viewing between points
US20080127112A1 (en) * 2006-11-23 2008-05-29 International Business Machines Corporation Software tracing
US8250543B2 (en) * 2006-11-23 2012-08-21 International Business Machines Corporation Software tracing
US20080162272A1 (en) * 2006-12-29 2008-07-03 Eric Jian Huang Methods and apparatus to collect runtime trace data associated with application performance
US8141051B2 (en) * 2006-12-29 2012-03-20 Intel Corporation Methods and apparatus to collect runtime trace data associated with application performance
US20080166105A1 (en) * 2007-01-05 2008-07-10 Verizon Services Corp. Apparatus for remotely controlling set-top boxes and an associated method and computer program product
US8312495B2 (en) * 2007-01-05 2012-11-13 Verizon Patent And Licensing Inc. Apparatus for remotely controlling set-top boxes and an associated method and computer program product
US8762956B1 (en) * 2007-01-31 2014-06-24 The Mathworks, Inc. Generating a report document from code
US8566819B2 (en) 2007-02-15 2013-10-22 Oracle America, Inc. Apparatus and method for providing software configurations on a plurality of platforms
US8589914B2 (en) 2007-02-15 2013-11-19 Oracle America, Inc. Apparatus and method to detect and track software installation errors
US8645946B2 (en) 2007-02-15 2014-02-04 Oracle America, Inc. Apparatus and method for rollback of software updates
US8719814B2 (en) 2007-02-15 2014-05-06 Oracle America, Inc. Apparatus and method for monitoring software installation performance
US8645947B2 (en) 2007-02-15 2014-02-04 Oracle America, Inc. Apparatus and method for establishing dependencies in a software dependency map
US8533704B2 (en) 2007-02-15 2013-09-10 Oracle America, Inc. Apparatus and method for automated software installation
US8640123B2 (en) 2007-02-15 2014-01-28 Oracle America, Inc. Apparatus and method for simulating software installation using software dependency map
US20110214119A1 (en) * 2007-02-15 2011-09-01 Oracle America, Inc. Apparatus and method for providing software configurations on a plurality of platforms
US20110225461A1 (en) * 2007-02-15 2011-09-15 Oracle America, Inc. Apparatus and method to detect and track software installation errors
US8631400B2 (en) 2007-02-15 2014-01-14 Oracle America, Inc. Apparatus and method for generating a software dependency map
US20110225577A1 (en) * 2007-02-15 2011-09-15 Oracle America, Inc. Apparatus and method for rollback of software updates
US20110231838A1 (en) * 2007-02-15 2011-09-22 Oracle America, Inc. Apparatus and method for installing software using a software dependency map
US8621453B2 (en) 2007-02-15 2013-12-31 Oracle America, Inc. Apparatus and method for installing software using a software dependency map
US8589915B2 (en) * 2007-02-15 2013-11-19 Oracle America, Inc. Apparatus and method for validating and repairing a software installation
US8527979B2 (en) 2007-02-15 2013-09-03 Oracle America, Inc. Apparatus and method fro maintaining a software repository
US8776047B2 (en) 2007-02-15 2014-07-08 Oracle America, Inc. Apparatus and method for managing a plurality of software dependency maps and software installation using the same
US20120151469A1 (en) * 2007-02-15 2012-06-14 Oracle America, Inc. Apparatus and method for validating and repairing a software installation
US8621454B2 (en) 2007-02-15 2013-12-31 Oracle America, Inc. Apparatus and method for generating a software dependency map
US20110022896A1 (en) * 2007-02-20 2011-01-27 Red Hat, Inc. Methods and systems for first occurence debugging
US8429460B2 (en) * 2007-02-20 2013-04-23 Red Hat, Inc. Methods and systems for first occurence debugging
US20080235667A1 (en) * 2007-03-13 2008-09-25 Steve Nelson Application Software Flight Recorder Test Server
US7757129B2 (en) * 2007-03-30 2010-07-13 International Business Machines Corporation Generalized trace and log facility for first error data collection
US20080244328A1 (en) * 2007-03-30 2008-10-02 International Business Machines Corporation Generalized trace and log facility for first error data collection
CN101802729A (en) * 2007-05-03 2010-08-11 西门子工业公司 Diagnostic and trouble-shooting methods in a wireless control and sensor network
US8332819B2 (en) * 2007-05-03 2012-12-11 Siemens Industry, Inc. Diagnostic and trouble-shooting methods in a wireless control and sensor network
US20080276127A1 (en) * 2007-05-03 2008-11-06 Mcfarland Norman R Diagnostic and Trouble-Shooting Methods in a Wireless Control and Sensor Network
US20100042745A1 (en) * 2007-05-25 2010-02-18 Fujitsu Limited Workflow diagram generation program, apparatus and method
US8091074B2 (en) 2007-06-21 2012-01-03 Microsoft Corporation Execution-centric source code view
US20090036759A1 (en) * 2007-08-01 2009-02-05 Ault Timothy E Collapsible noninvasive analyzer method and apparatus
US20090106739A1 (en) * 2007-10-19 2009-04-23 Paul Allan Weatherbee Systems and methods for debugging multiple workflow instances
WO2009055124A2 (en) * 2007-10-19 2009-04-30 Ge Fanuc Automation North America, Inc. Systems and methods for debugging multiple workflow instances
WO2009055124A3 (en) * 2007-10-19 2009-08-27 Ge Fanuc Automation North America, Inc. Systems and methods for debugging multiple workflow instances
US8060866B2 (en) * 2007-10-19 2011-11-15 GE Intelligent Platforms, Inc Systems and methods for debugging multiple workflow instances
US20090138859A1 (en) * 2007-11-27 2009-05-28 Sun Microsystems, Inc. Sampling based runtime optimizer for efficient debugging of applications
US8627302B2 (en) * 2007-11-27 2014-01-07 Oracle America, Inc. Sampling based runtime optimizer for efficient debugging of applications
US20090150868A1 (en) * 2007-12-10 2009-06-11 Al Chakra Method and System for Capturing Movie Shots at the Time of an Automated Graphical User Interface Test Failure
EP2238543A1 (en) * 2007-12-21 2010-10-13 Symantec Corporation Providing image-based guidance for remote assistance
US8151193B2 (en) 2007-12-21 2012-04-03 Symantec Corporation Providing image-based guidance for remote assistance
EP2238543A4 (en) * 2007-12-21 2010-12-22 Symantec Corp Providing image-based guidance for remote assistance
US8458671B1 (en) * 2008-02-12 2013-06-04 Tilera Corporation Method and system for stack back-tracing in computer programs
US20090222646A1 (en) * 2008-02-28 2009-09-03 International Business Machines Corporation Method and apparatus for detecting processor behavior using instruction trace data
US8549486B2 (en) * 2008-04-21 2013-10-01 Microsoft Corporation Active property checking
US20090265692A1 (en) * 2008-04-21 2009-10-22 Microsoft Corporation Active property checking
US20090287962A1 (en) * 2008-05-15 2009-11-19 International Business Machines Corporation Solution for automatically incorporating diagnostic data within screen capture images
US8060795B2 (en) 2008-05-15 2011-11-15 International Business Machines Corporation Solution for automatically incorporating diagnostic data within screen capture images
US20090328008A1 (en) * 2008-06-26 2009-12-31 Microsoft Corporation Dynamically monitoring application behavior
US8332825B2 (en) * 2008-06-26 2012-12-11 Microsoft Corporation Dynamically monitoring application behavior
US20100037211A1 (en) * 2008-07-15 2010-02-11 A VIcode, Inc. Automatic incremental application dependency discovery through code instrumentation
US8839041B2 (en) 2008-07-15 2014-09-16 Microsoft Corporation Exposing application performance counters for applications through code instrumentation
US8479052B2 (en) 2008-07-15 2013-07-02 Microsoft Corporation Exposing application performance counters for .NET applications through code instrumentation
US8051332B2 (en) 2008-07-15 2011-11-01 Avicode Inc. Exposing application performance counters for .NET applications through code instrumentation
US9104794B2 (en) 2008-07-15 2015-08-11 Microsoft Technology Licensing, Llc Automatic incremental application dependency discovery through code instrumentation
US9286083B2 (en) * 2008-09-10 2016-03-15 Microsoft Technology Licensing, Llc Satisfying missing dependencies on a running system
US20100064284A1 (en) * 2008-09-10 2010-03-11 Microsoft Corporation Satisfying Missing Dependencies on a Running System
US8498987B1 (en) * 2008-09-25 2013-07-30 Vmware, Inc. Snippet search
WO2010045317A1 (en) * 2008-10-14 2010-04-22 Riverside Research Institute Internal function debugger
US20100095281A1 (en) * 2008-10-14 2010-04-15 Riverside Research Institute Internal Function Debugger
US9577903B2 (en) 2008-12-17 2017-02-21 Microsoft Technology Licensing, Llc Monitoring activity on a computer
US10489264B2 (en) 2008-12-17 2019-11-26 Microsoft Technology Licensing, Llc Monitoring activity on a computer
US8868722B2 (en) 2008-12-17 2014-10-21 Microsoft Corporation Monitoring activity on a computer
US20100153069A1 (en) * 2008-12-17 2010-06-17 Microsoft Corporation Monitoring activity on a computer
US20100192229A1 (en) * 2009-01-27 2010-07-29 Fujitsu Limited Privilege violation detecting program
US8677501B2 (en) * 2009-01-27 2014-03-18 Fujitsu Limited Privilege violation detecting program
US10728112B2 (en) * 2009-03-24 2020-07-28 Amazon Technologies, Inc. System and method for tracking service results
US11356337B2 (en) 2009-03-24 2022-06-07 Amazon Technologies, Inc. System and method for tracking service requests
US8464221B2 (en) 2009-06-16 2013-06-11 Microsoft Corporation Visualization tool for system tracing infrastructure events
US20100318852A1 (en) * 2009-06-16 2010-12-16 Microsoft Corporation Visualization tool for system tracing infrastructure events
US20110022895A1 (en) * 2009-07-23 2011-01-27 International Business Machines Corporation Software Component Self-Scrubbing
US8205118B2 (en) * 2009-07-23 2012-06-19 International Business Machines Corporation Software component self-scrubbing
US20110040811A1 (en) * 2009-08-17 2011-02-17 International Business Machines Corporation Distributed file system logging
US8868601B2 (en) 2009-08-17 2014-10-21 International Business Machines Corporation Distributed file system logging
US8489558B2 (en) 2009-08-17 2013-07-16 International Business Machines Corporation Distributed file system logging
TWI506420B (en) * 2009-12-23 2015-11-01 Intel Corp Relational modeling for performance analysis of multi-core processors
US8522210B1 (en) * 2009-12-29 2013-08-27 Cadence Design Systems, Inc. Detecting indexing errors in declarative languages
US9047399B2 (en) * 2010-02-26 2015-06-02 Red Hat, Inc. Generating visualization from running executable code
US20110214108A1 (en) * 2010-02-26 2011-09-01 Roland Grunberg Architecture, system and method for generating visualizations from running executable code
US20110219387A1 (en) * 2010-03-04 2011-09-08 Microsoft Corporation Interactive Remote Troubleshooting of a Running Process
CN101859413A (en) * 2010-06-11 2010-10-13 用友软件股份有限公司 Method and system for collecting defects of enterprise resource planning (ERP) product
US8850321B2 (en) * 2010-06-23 2014-09-30 Hewlett-Packard Development Company, L.P. Cross-domain business service management
US20110320971A1 (en) * 2010-06-23 2011-12-29 Joachim Seeger Cross-domain business service management
US20120079087A1 (en) * 2010-09-27 2012-03-29 Ebay Inc. Online help system using session details
US20160026679A1 (en) * 2011-04-12 2016-01-28 Microsoft Technology Licensing, Llc Navigating performance data from different subsystems
US9430522B2 (en) * 2011-04-12 2016-08-30 Microsoft Technology Licensing, Llc Navigating performance data from different subsystems
US9619779B2 (en) * 2011-08-26 2017-04-11 Apple Inc. Client-side policy enforcement of developer API use
US20130055211A1 (en) * 2011-08-26 2013-02-28 Apple Inc. Client-side policy enforcement of developer api use
US20130091342A1 (en) * 2011-10-08 2013-04-11 Yingzhi Liu Tracing software execution of a business process
US8626543B2 (en) * 2011-10-08 2014-01-07 Sap Ag Tracing software execution of a business process
US9111038B2 (en) 2011-11-04 2015-08-18 International Business Machines Corporation Integrated debugger and code coverage tool
US20140101417A1 (en) * 2011-11-04 2014-04-10 International Business Machines Corporation Code coverage framework
US20130117542A1 (en) * 2011-11-04 2013-05-09 International Business Machines Corporation Code coverage framework
US9244815B2 (en) 2011-11-04 2016-01-26 International Business Machines Corporation Integrated debugger and code coverage tool
US9087153B2 (en) * 2011-11-04 2015-07-21 International Business Machines Corporation Code coverage framework
US9361205B2 (en) * 2011-11-04 2016-06-07 International Business Machines Corporation Code coverage framework
US9361206B2 (en) * 2011-11-04 2016-06-07 International Business Machines Corporation Code coverage framework
US20140109099A1 (en) * 2011-11-04 2014-04-17 International Business Machines Corporation Code coverage framework
US8726092B1 (en) * 2011-12-29 2014-05-13 Google Inc. Identifying causes of application crashes
US8898643B2 (en) * 2012-06-19 2014-11-25 Sap Se Application trace replay and simulation systems and methods
US20130339931A1 (en) * 2012-06-19 2013-12-19 Sap Ag Application trace replay and simulation systems and methods
US9317257B2 (en) 2012-06-22 2016-04-19 Microsoft Technology Licensing, Llc Folded views in development environment
US20140068349A1 (en) * 2012-08-29 2014-03-06 Freescale Semiconductor, Inc. Data processor device for handling a watchpoint and method thereof
US9047400B2 (en) * 2012-08-29 2015-06-02 Freescale Semiconductor, Inc. Data processor device for handling a watchpoint and method thereof
US9069896B2 (en) * 2012-08-29 2015-06-30 Freescale Semiconductor, Inc. Data processor device for handling a watchpoint and method thereof
US20140068346A1 (en) * 2012-08-29 2014-03-06 Freescale Semiconductor, Inc. Data processor device for handling a watchpoint and method thereof
US20150317232A1 (en) * 2012-11-29 2015-11-05 Qizhi Software (Beijing) Company Limited Method And Apparatus For Positioning Crash
US9594617B2 (en) * 2012-11-29 2017-03-14 Beijing Qihoo Technology Company Limited Method and apparatus for positioning crash
US9292311B2 (en) 2012-12-20 2016-03-22 International Business Machines Corporation Method and apparatus for providing software problem solutions
US10178031B2 (en) 2013-01-25 2019-01-08 Microsoft Technology Licensing, Llc Tracing with a workload distributor
US20140222942A1 (en) * 2013-02-04 2014-08-07 Hon Hai Precision Industry Co., Ltd. Remote control system and method
EP2763028A1 (en) * 2013-02-04 2014-08-06 Hon Hai Precision Industry Co., Ltd. Remote control system and method
US10212054B2 (en) * 2013-02-07 2019-02-19 International Business Machines Corporation Transparently tracking provenance information in distributed data systems
US20160119208A1 (en) * 2013-02-07 2016-04-28 International Business Machines Corporation Transparently tracking provenance information in distributed data systems
US20160134494A1 (en) * 2013-02-07 2016-05-12 International Business Machines Corporation Transparently tracking provenance information in distributed data systems
US10218587B2 (en) * 2013-02-07 2019-02-26 International Business Machines Corporation Transparently tracking provenance information in distributed data systems
US9658936B2 (en) 2013-02-12 2017-05-23 Microsoft Technology Licensing, Llc Optimization analysis using similar frequencies
US9767006B2 (en) 2013-02-12 2017-09-19 Microsoft Technology Licensing, Llc Deploying trace objectives using cost analyses
US9804949B2 (en) 2013-02-12 2017-10-31 Microsoft Technology Licensing, Llc Periodicity optimization in an automated tracing system
US9665474B2 (en) 2013-03-15 2017-05-30 Microsoft Technology Licensing, Llc Relationships derived from trace data
US9575874B2 (en) 2013-04-20 2017-02-21 Microsoft Technology Licensing, Llc Error list and bug report analysis for configuring an application tracer
US20140337301A1 (en) * 2013-05-08 2014-11-13 Almondsoft Co., Ltd. Big data extraction system and method
US9658943B2 (en) 2013-05-21 2017-05-23 Microsoft Technology Licensing, Llc Interactive graph for navigating application code
US9734040B2 (en) 2013-05-21 2017-08-15 Microsoft Technology Licensing, Llc Animated highlights in a graph representing an application
US9754396B2 (en) 2013-07-24 2017-09-05 Microsoft Technology Licensing, Llc Event chain visualization of performance data
US20150066814A1 (en) * 2013-08-28 2015-03-05 International Business Machines Corporation Sentiment Analysis of Data Logs
US9536200B2 (en) * 2013-08-28 2017-01-03 International Business Machines Corporation Sentiment analysis of data logs
US20150066869A1 (en) * 2013-09-04 2015-03-05 Concurix Corporation Module Database with Tracing Options
US9311213B2 (en) * 2013-09-04 2016-04-12 Microsoft Technology Licensing, Llc Module database with tracing options
US9864672B2 (en) 2013-09-04 2018-01-09 Microsoft Technology Licensing, Llc Module specific tracing in a shared module environment
EP3042314A1 (en) * 2013-09-04 2016-07-13 Concurix Corporation Module specific tracing in a shared module environment
US20150067652A1 (en) * 2013-09-04 2015-03-05 Concurix Corporation Module Specific Tracing in a Shared Module Environment
US20150067654A1 (en) * 2013-09-04 2015-03-05 Concurix Corporation Tracing System for Application and Module Tracing
EP3042314A4 (en) * 2013-09-04 2017-05-17 Concurix Corporation Module specific tracing in a shared module environment
CN105723357A (en) * 2013-09-04 2016-06-29 肯赛里克斯公司 Module specific tracing in a shared module environment
US9292415B2 (en) * 2013-09-04 2016-03-22 Microsoft Technology Licensing, Llc Module specific tracing in a shared module environment
US9298588B2 (en) * 2013-09-04 2016-03-29 Microsoft Technology Licensing, Llc Tracing system for application and module tracing
US20150106572A1 (en) * 2013-10-11 2015-04-16 Red Hat, Inc. Scripted multiprocess probing without system privilege
US9672134B2 (en) * 2013-10-11 2017-06-06 Red Hat, Inc. Scripted multiprocess probing without system privilege
US9772927B2 (en) 2013-11-13 2017-09-26 Microsoft Technology Licensing, Llc User interface for selecting tracing origins for aggregating classes of trace data
US10346292B2 (en) 2013-11-13 2019-07-09 Microsoft Technology Licensing, Llc Software component recommendation based on multiple trace runs
US10372590B2 (en) * 2013-11-22 2019-08-06 International Business Corporation Determining instruction execution history in a debugger
US10977160B2 (en) 2013-11-22 2021-04-13 International Business Machines Corporation Determining instruction execution history in a debugger
US10552297B2 (en) 2013-11-22 2020-02-04 International Business Machines Corporation Determining instruction execution history in a debugger
US20150149984A1 (en) * 2013-11-22 2015-05-28 International Business Machines Corporation Determining instruction execution history in a debugger
US9996445B2 (en) 2014-01-17 2018-06-12 International Business Machines Corporation Computer flight recorder with active error detection
US20150205651A1 (en) * 2014-01-17 2015-07-23 International Business Machines Corporation Computer flight recorder with active error detection
US9910758B2 (en) * 2014-01-17 2018-03-06 International Business Machines Corporation Computer flight recorder with active error detection
CN104794046A (en) * 2014-01-21 2015-07-22 腾讯科技(深圳)有限公司 Method and system for symbolizing program running log
US9652601B2 (en) * 2014-03-04 2017-05-16 Xi'an Jiaotong University Method for plagiarism detection of multithreaded program based on thread slice birthmark
US20160246950A1 (en) * 2014-03-04 2016-08-25 Xi'an Jiaotong University Method for plagiarism detection of multithreaded program based on thread slice birthmark
US9928134B2 (en) * 2014-04-11 2018-03-27 Tencent Technology (Shenzhen) Company Limited Method and apparatus for repairing dynamic link library file
US20160314036A1 (en) * 2014-04-11 2016-10-27 Tencent Technology (Shenzhen) Company Limited Method and Apparatus for Repairing Dynamic Link Library File
WO2015195676A3 (en) * 2014-06-16 2016-02-18 Silverthread, Inc. Computer-implemented tools and methods for extracting information about the structure of a large computer software system, exploring its structure, discovering problems in its design, and enabling refactoring
US10031748B2 (en) 2014-06-16 2018-07-24 Silverthread, Inc. Computer-implemented tools and methods for extracting information about the structure of a large computer software system, exploring its structure, discovering problems in its design, and enabling refactoring
US10459720B2 (en) 2014-06-16 2019-10-29 Silverthread, Inc. Computer-implemented tools and methods for extracting information about the structure of a large computer software system, exploring its structure, discovering problems in its design, and enabling refactoring
US9875173B2 (en) * 2014-06-30 2018-01-23 Microsoft Technology Licensing, Llc Time travel debugging in managed runtime
US20150378870A1 (en) * 2014-06-30 2015-12-31 Microsoft Corporation Time travel debugging in managed runtime
US10832254B2 (en) 2014-08-11 2020-11-10 International Business Machines Corporation Mapping user actions to historical paths to determine a predicted endpoint
US20160042358A1 (en) * 2014-08-11 2016-02-11 International Business Machines Corporation Mapping user actions to historical paths to determine a predicted endpoint
US9424026B2 (en) * 2014-09-29 2016-08-23 Sap Se Visualizations of inter-entity calls
US10496433B2 (en) * 2014-11-24 2019-12-03 Red Hat, Inc. Modification of context saving functions
US20160147559A1 (en) * 2014-11-24 2016-05-26 Red Hat, Inc. Modification of context saving functions
US10902548B2 (en) 2014-12-13 2021-01-26 Microsoft Technology Licensing, Llc Frame invalidation control with causality attribution
US10147158B2 (en) * 2014-12-13 2018-12-04 Microsoft Technology Licensing, Llc Frame invalidation control with causality attribution
US20160171640A1 (en) * 2014-12-13 2016-06-16 Microsoft Technology Licensing, Llc Frame Invalidation Control with Causality Attribution
US9830249B2 (en) 2015-03-04 2017-11-28 International Business Machines Corporation Preemptive trouble shooting using dialog manager
US9823993B2 (en) 2015-03-04 2017-11-21 International Business Machines Corporation Preemptive trouble shooting using dialog manager
US20170109258A1 (en) * 2015-03-26 2017-04-20 Emc Corporation Smart logging of trace data for storage systems
US9916220B2 (en) * 2015-03-26 2018-03-13 EMC IP Holding Company LLC Smart logging of trace data for storage systems
US10728095B2 (en) * 2015-09-09 2020-07-28 International Business Machines Corporation Client-configured server class tracing to a configurable threshold
US20180278476A1 (en) * 2015-09-09 2018-09-27 International Business Machines Corporation Client-configured server class tracing to a configurable threshold
US10394690B1 (en) * 2015-12-30 2019-08-27 Square, Inc. Serialize view model for debugging and application support
US10031745B2 (en) * 2016-02-02 2018-07-24 International Business Machines Corporation System and method for automatic API candidate generation
US20170220336A1 (en) * 2016-02-02 2017-08-03 International Business Machines Corporation System and method for automatic api candidate generation
US20180024909A1 (en) * 2016-07-25 2018-01-25 International Business Machines Corporation Monitoring growth of memory buffers in logging and dynamically adapting quantity and detail of logging
US10417116B2 (en) * 2016-07-28 2019-09-17 International Business Machines Corporation System, method, and apparatus for crowd-sourced gathering of application execution events for automatic application testing and replay
US11138092B2 (en) 2016-08-31 2021-10-05 Microsoft Technology Licensing, Llc Cache-based tracing for time travel debugging and analysis
US10963367B2 (en) 2016-08-31 2021-03-30 Microsoft Technology Licensing, Llc Program tracing for time travel debugging and analysis
US10592394B2 (en) * 2016-10-11 2020-03-17 Green Hills Software Llc Systems, methods, and devices for vertically integrated instrumentation and trace reconstruction
US11243871B2 (en) 2016-10-11 2022-02-08 Green Hills Software Llc Systems, methods, and devices for vertically integrated instrumentation and trace reconstruction
US10817404B2 (en) 2016-10-11 2020-10-27 Green Hills Software Llc Systems, methods, and devices for vertically integrated instrumentation and trace reconstruction
US11609840B2 (en) 2016-10-11 2023-03-21 Green Hills Software Llc Systems, methods, and devices for vertically integrated instrumentation and trace reconstruction
US10324851B2 (en) 2016-10-20 2019-06-18 Microsoft Technology Licensing, Llc Facilitating recording a trace file of code execution using way-locking in a set-associative processor cache
US10310977B2 (en) 2016-10-20 2019-06-04 Microsoft Technology Licensing, Llc Facilitating recording a trace file of code execution using a processor cache
US20180121659A1 (en) * 2016-10-28 2018-05-03 Tala Security, Inc. Application security service
US10592676B2 (en) * 2016-10-28 2020-03-17 Tala Security, Inc. Application security service
US11182298B2 (en) 2016-12-09 2021-11-23 Intel Corporation System, apparatus and method for dynamic profiling in a processor
US10296464B2 (en) * 2016-12-09 2019-05-21 Intel Corporation System, apparatus and method for dynamic profiling in a processor
US10176800B2 (en) 2017-02-10 2019-01-08 International Business Machines Corporation Procedure dialogs using reinforcement learning
US10037362B1 (en) 2017-07-24 2018-07-31 International Business Machines Corpoation Mining procedure dialogs from source content
US10169428B1 (en) 2017-07-24 2019-01-01 International Business Machines Corporation Mining procedure dialogs from source content
US10185753B1 (en) 2017-07-24 2019-01-22 International Business Machines Corporation Mining procedure dialogs from source content
US10713145B2 (en) * 2018-01-05 2020-07-14 International Business Machines Corporation Automated debugging with combined static and dynamic analysis
US11238017B2 (en) * 2018-01-30 2022-02-01 Salesforce.Com, Inc. Runtime detector for data corruptions
US20190340104A1 (en) * 2018-05-03 2019-11-07 Sap Se Error finder tool
US11237946B2 (en) * 2018-05-03 2022-02-01 Sap Se Error finder tool
US11481376B2 (en) 2018-06-19 2022-10-25 Salesforce, Inc. Platform for handling data corruptions
US11295213B2 (en) * 2019-01-08 2022-04-05 International Business Machines Corporation Conversational system management
CN110263004A (en) * 2019-05-08 2019-09-20 北京字节跳动网络技术有限公司 Log recording method, device, electronic equipment and storage medium
US11588912B2 (en) * 2019-06-13 2023-02-21 FullStory, Inc. Synchronized console data and user interface playback
US11256604B2 (en) * 2020-01-24 2022-02-22 Splunk Inc. Multiple modes of data collection and analysis in a microservices-based architecture
US11762759B1 (en) 2020-01-24 2023-09-19 Splunk Inc. Multiple modes of storing and querying trace data in a microservices-based architecture
US11354220B2 (en) 2020-07-10 2022-06-07 Metawork Corporation Instrumentation trace capture technique
US11327871B2 (en) * 2020-07-15 2022-05-10 Metawork Corporation Instrumentation overhead regulation technique
US20220019511A1 (en) * 2020-07-15 2022-01-20 Metawork Corporation Instrumentation overhead regulation technique
US11392483B2 (en) 2020-07-16 2022-07-19 Metawork Corporation Dynamic library replacement technique
WO2022015506A1 (en) * 2020-07-16 2022-01-20 Metawork Corporation Trace anomaly grouping and visualization technique
US11615015B2 (en) 2020-07-16 2023-03-28 Metawork Corporation Trace anomaly grouping and visualization technique
CN112711365A (en) * 2020-12-30 2021-04-27 航天信息股份有限公司 Method and system for passing list control checking event
US20230252182A1 (en) * 2022-02-06 2023-08-10 Adusso Oy System And Method For Recording User's On-Screen Activity Including The Confidentiality Of the Processed Data and Data Export To An External System

Also Published As

Publication number Publication date
US20100088683A1 (en) 2010-04-08
US8504994B2 (en) 2013-08-06

Similar Documents

Publication Publication Date Title
US8504994B2 (en) System and method for software diagnostics using a combination of visual and dynamic tracing
US6202199B1 (en) System and method for remotely analyzing the execution of computer programs
US6282701B1 (en) System and method for monitoring and analyzing the execution of computer programs
US7058928B2 (en) System and method for conditional tracing of computer programs
US8312435B2 (en) System and method for conditional tracing of computer programs
US10073760B2 (en) System and method for troubleshooting software configuration problems using application tracing
WO2000007100A1 (en) System and method for remotely analyzing the execution of computer programs
US8468502B2 (en) Generic, multi-instance method and GUI detection system for tracking and monitoring computer applications
US6026362A (en) Tool and method for diagnosing and correcting errors in a computer program
US6701519B1 (en) Managing hardware and software configuration information of systems being tested
US6216237B1 (en) Distributed indirect software instrumentation
US5600789A (en) Automated GUI interface testing
US7162664B2 (en) Debugging breakpoints on pluggable components
US5778230A (en) Goal directed object-oriented debugging system
US6668370B1 (en) Synchronous execution of object-oriented scripts and procedural code from within an interactive test facility
US7451455B1 (en) Apparatus and method for automatically manipulating software products
US10496517B2 (en) System and method for providing runtime diagnostics of executing applications
US20030159133A1 (en) Method and system for tracing and displaying execution of nested functions
EP2587380B1 (en) Runtime environment and method for non-invasive monitoring of software applications
Pearce Windows Forms Debugging
Buhr et al. KDB: Concurrent Debugger Reference Manual
Wallach 4th USENIX Windows Systems Symposium Paper 2000 [Technical Index]
Wallach Gemini Lite: a non-intrusive debugger for Windows NT
Zeller DDD-Data Display Debugger Writing DDD Themes
Titus et al. Debugging and Tracing Threads

Legal Events

Date Code Title Description
AS Assignment

Owner name: MUTEK SOLUTIONS, LTD., ISRAEL

Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNORS:GOLENDER, VALERY;MOSHE, IDO BEN;WYGODNY, SHLOMO;REEL/FRAME:011885/0327

Effective date: 20010503

AS Assignment

Owner name: INDENTIFY SOFTWARE LTD., ISRAEL

Free format text: CHANGE OF NAME;ASSIGNOR:MUTEK SOLUTIONS, LTD.;REEL/FRAME:013786/0669

Effective date: 20020411

AS Assignment

Owner name: PLENUS TECHNOLOGIES LTD. OF DELTA HOUSE, ISRAEL

Free format text: SECURITY INTEREST;ASSIGNOR:IDENTIFY SOFTWARE LTD.;REEL/FRAME:015596/0382

Effective date: 20041230

AS Assignment

Owner name: IDENTIFY SOFTWARE, LTD., ISRAEL

Free format text: RELEASE OF SECURITY INTEREST;ASSIGNOR:PLENUS TECHNOLOGIES LTD.;REEL/FRAME:020960/0243

Effective date: 20080514

STCB Information on status: application discontinuation

Free format text: ABANDONED -- FAILURE TO RESPOND TO AN OFFICE ACTION