Embodiments of the invention are associated with an application process that comprises multiple threads, wherein threads of the process are disposes to run on a data processing system, and each thread can have a user mode or a kernel mode machine state, or both, selectively, when it is running. An embodiment directed to a method comprises the steps of allocating a specified memory location for each of the threads, and responsive to a given thread entering a sleep state, selectively saving the kernel mode machine state of the given thread in the specified memory location for the given thread. The saved machine state comprises the state of the given thread immediately prior to the given thread entering the sleep state. In response to detecting a hang condition in the operation of the process, a debugger is attached to the process to access at least one of the saved user mode machine states. The method further includes analyzing information provided by the at least one accessed machine state to determine the cause of the hang condition, and restoring the original state upon detachment, so the debugger attachment is completely transparent to the target process.