# US 12,223,347 B2 · Volatile memory acquisition > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,223,347 B2 - Document ID: US12223347B2 - Status: Granted - Kind: B2 - Application number: 17/333,449 - Filed: 2021-05-28 - Published: 2022-07-28 - Granted: 2025-02-11 - Earliest claimed: 2021-01-28 - Assignees: Microsoft Technology Licensing, LLC - Applicants: Microsoft Technology Licensing, LLC - Inventors: Marsh Jordan Ray - Web page: https://patentgrep.com/patent/US12223347B2 ## CPC - G06F 9/4856: {resumption being on a different machine, e.g. task migration, virtual machine migration (G06F9/5088 takes precedence)} - G06F 9/45558: {Hypervisor-specific management and integration aspects} - G06F 9/5088: {involving task migration} - G06F 12/0646: {Configuration or reconfiguration} - G06F 21/53: by executing in a restricted environment, e.g. sandbox or secure virtual machine - G06F 21/562: {Static detection} - G06F 2009/4557: {Distribution of virtual machine instances; Migration and load balancing} - G06F 2009/45575: {Starting, stopping, suspending or resuming virtual machine instances} - G06F 2212/152: Virtualized environment, e.g. logically partitioned system - G06F 2221/034: Test or assess a computer or a system - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract Aspects of the present disclosure relate to volatile memory acquisition using live migration of an execution environment. In examples, a virtualization manager controls execution of an execution environment at a virtualization host. The virtualization manager may enable live migration of the execution environment, such that the execution environment may be migrated to another virtualization host (or “migration target”) for continued execution. Accordingly, such functionality may be used to capture a memory image at a migration target, after which the execution environment continues executing at the original virtualization host. The memory image may be analyzed to identify the presence of malware and/or to generate a list of processes that were executing at the time of the capture. Such aspects may enable capturing a substantially accurate and consistent memory image of the volatile memory of the execution environment without indicating, inadvertently or otherwise, that a capture is occurring to processes executing therein. ## Claims ### Claim 1 A system comprising: at least one processor; and memory storing instructions that, when executed by the at least one processor, causes the system to perform a set of operations, the set of operations comprising: receiving, as part of a live migration operation to migrate an execution environment of a current virtualization host from the current virtualization host, data comprising volatile memory content associated with the execution environment; storing the data as a memory image associated with the execution environment; and providing, to the current virtualization host: a completion indication indicating successful receipt of the data as part of the live migration operation; and an indication to the virtualization host to continue execution of the execution environment at the current virtualization host, thereby terminating the live migration operation. ### Claim 2 (depends on 1) The system of claim 1, wherein the set of operations further comprises: receiving state information associated with a virtual processor of the virtualization host; and storing the state information in association with the memory image. ### Claim 3 (depends on 1) The system of claim 1, wherein: the current virtualization host comprises a hypervisor; the execution environment is a virtual machine; and the data comprising the volatile memory content is received from the hypervisor of the current virtualization host. ### Claim 4 (depends on 3) The system of claim 3, wherein providing the indication to the current virtualization host comprises providing the indication to the hypervisor to terminate the live migration operation. ### Claim 5 (depends on 3) The system of claim 3, wherein: the current virtualization host comprises a live migration engine; and providing the indication to the virtualization host comprises providing the indication to the live migration engine to terminate the live migration operation by the hypervisor. ### Claim 6 (depends on 1) The system of claim 1, wherein: the current virtualization host comprises a container engine; the execution environment is a container; and the data comprising the volatile memory content is received from the container engine of the current virtualization host. ### Claim 7 (depends on 6) The system of claim 6, wherein providing the indication to the current virtualization host comprises providing the indication to the container engine to terminate the live migration operation. ### Claim 8 A method for memory acquisition of an execution environment, the method comprising: determining target information for a memory imaging target; providing an indication to a source hypervisor of a current virtualization host to initiate live migration of an execution environment from the current virtualization host. wherein the indication comprises the target information; determining that volatile memory content associated with the execution environment has been transmitted from the current virtualization host to the memory imaging target; and in response to determining that the volatile memory content has been transmitted, providing: a completion indication indicating successful receipt of the data as part of the live migration; and an indication to the source hypervisor to continue execution of the execution environment at the current virtualization host. ### Claim 9 (depends on 8) The method of claim 8, wherein determining the target information comprises: establishing a communication channel with the memory imaging target; and receiving the target information from the memory imaging target via the communication channel. ### Claim 10 (depends on 9) The method of claim 9, wherein establishing the communication channel comprises: providing, to the memory imaging target, an identifier associated with the execution environment. ### Claim 11 (depends on 9) The method of claim 9, wherein the received target information is usable to transmit the volatile memory content to the memory imaging target. ### Claim 12 (depends on 8) The method of claim 8, wherein determining that the volatile memory content has been transmitted comprises receiving an indication from the memory imaging target. ### Claim 13 (depends on 8) The method of claim 8, wherein determining that the volatile memory content has been transmitted comprises evaluating a state associated with the hypervisor. ### Claim 14 A method for memory acquisition of an execution environment, the method comprising: receiving, as part of a live migration operation to migrate the execution environment of a current virtualization host from the current virtualization host, data comprising volatile memory content associated with the execution environment; storing the data as a memory image associated with the execution environment; and providing, to the current virtualization host: a completion indication indicating successful receipt of the data as part of the live migration operation; and an indication to the virtualization host to continue execution of the execution environment at the current virtualization host, thereby terminating the live migration operation. ### Claim 15 (depends on 14) The method of claim 14, further comprising: receiving state information associated with a virtual processor of the virtualization host; and storing the state information in association with the memory image. ### Claim 16 (depends on 14) The method of claim 14, wherein: the current virtualization host comprises a hypervisor; the execution environment is a virtual machine; and the data comprising the volatile memory content is received from the hypervisor of the current virtualization host. ### Claim 17 (depends on 16) The method of claim 16, wherein providing the indication to the current virtualization host comprises providing the indication to the hypervisor to terminate the live migration operation. ### Claim 18 (depends on 16) The method of claim 16, wherein: the current virtualization host comprises a live migration engine; and providing the indication to the virtualization host comprises providing the indication to the live migration engine to terminate the live migration operation by the hypervisor. ### Claim 19 (depends on 14) The method of claim 14, wherein: the current virtualization host comprises a container engine; the execution environment is a container; and the data comprising the volatile memory content is received from the container engine of the current virtualization host. ### Claim 20 (depends on 19) The method of claim 19, wherein providing the indication to the current virtualization host comprises providing the indication to the container engine to terminate the live migration operation.