- debug running process - memory dumps  - system calls / library call / instruction trace  - network packet captures
- debug running process - memory dumps  - system calls / library call / instruction trace  - network packet captures
exam code while the software is executed. fed inputs and checking outputs.