For the initial analysis, and maybe also for the resulting program, I'd suggest playing with gdb, the debugger. This has the ability to attach to a running process, to inspect and modify memory, and much more besides; and because it freezes the process while attached you aren't trying to hit a moving target.

Some scattered clues to this approach may be found in how to write a program to control gdb and Re: Is there any way of determining the current line number of a child process while it is running?.

Hugo