Converting a snapshot file to memory dump using the vmss2core tool
search cancel

Converting a snapshot file to memory dump using the vmss2core tool

book

Article ID: 323788

calendar_today

Updated On:

Products

VMware Desktop Hypervisor VMware vSphere ESXi

Issue/Introduction

This article provides steps to convert a snapshot file to a memory dump using the vmss2core tool.

Developers can use this tool to debug guest operating systems and applications by converting a virtual machine checkpoint into a core dump file.
The checkpoint can either be a snapshot (.vmss) or a suspend file, and a variety of core dump formats can be selected for use with standard debuggers (such as WinDbg or GDB).

vmss2core is included with VMware Workstation and Fusion and supports different guest OS types through appropriate flags.

Environment

VMware Fusion
VMware Workstation 
VMware vSphere ESXi

Resolution

vmss2core is used to convert a suspended virtual machine's snapshot into a core dump for analysis.
Depending on where the VM is running (VMware Workstation, Fusion, or ESXi), the steps differ slightly.

For VMware Workstation 7.x and Above or Fusion 3.x and Above

Locate the vmss2core Tool

Change to the appropriate directory based on the OS and installation:

  • Windows (32-bit):
    C:\Program Files\VMware\VMware Workstation\

  • Windows (64-bit):
    C:\Program Files (x86)\VMware\VMware Workstation\

  • Linux:
    /usr/bin/

  • macOS (Fusion):
    /Library/Application Support/VMware Fusion/

To obtain the latest version of vmss2core, download and install the appropriate VMware product, and for modern guest operating systems use the version bundled with VMware Workstation Pro or VMware Fusion.

Run vmss2core

Choose the appropriate flag depending on the guest OS of the virtual machine:

  • For Windows (Vista/7/10/Server 2008):
    vmss2core.exe -W virtual_machine_name.vmss virtual_machine_name.vmem

  • For Windows 8/8.1, Server 2012, 2016, 2019:
    vmss2core.exe -W8 virtual_machine_name.vmss virtual_machine_name.vmem

  • For Linux guests:
    ./vmss2core-Linux64 -N virtual_machine_name.vmss

Note: The -W, -W8, and -N flags refer to the guest operating system of the VM, not the OS where vmss2core is executed.

For Virtual Machines Running on ESXi

  1. Connect to the ESXi Host via SSH.

  2. Identify the World ID of the VM:

    • For ESXi 6.7 and above:
      esxcli vm process list

    • For other versions:
      vm-support -x

  3. Suspend the Virtual Machine:

    vm-support -Z <world_ID>

    ⚠️ If vm-support -Z is not supported on your ESXi version, refer to this article to suspend from the GUI: Broadcom KB 326327

  4. Copy the Suspended VM Files:

    • Transfer the .vmss file to the system where vmss2core is located.

    • If present, also copy the .vmem file to the same directory.

  5. Run vmss2core on the Copied Files:

    • Default Windows core dump conversion:
      vmss2core virtual_machine_name.vmss virtual_machine_name.vmem

    • For Windows 8/8.1 or Windows Server 2012/2016/2019 guests:
      vmss2core -W8 virtual_machine_name.vmss

    • For Linux guests:
      ./vmss2core-Linux64 -N virtual_machine_name.vmss

Additional Information

 

Troubleshooting

  • If you run vmss2core tool and get an output including this message, it means the files do not contain usable data:
    • Error parsing Windows data.
      Cannot create memory.dmp

  • The OS needs to have loaded the kernel in order to get usable data for vmss2core. Examples of VMs in a boot state that would not have usable data:
    • You see a message on boot that says:
      Windows failed to start. A recent hardware or software change might be the cause. 
    • The VM boot up does not progress past the BIOS boot screen

  • Examples of a VM that would have usable data:
    • The VM booted with a Windows Blue Screen error (BSOD)
    • The VM booted and a Linux kernel panic occurred 
    • The VM is frozen after the OS boots



For additional information, see the Debugging Virtual Machines with the Checkpoint to Core Tool Guide.

Suspending a virtual machine on ESX/ESXi to collect diagnostic information
vmss2core ツールを使用してスナップショット ファイルをメモリ ダンプに変換する


Note : For the vmss2core tool to successfully process snapshot files from a Windows virtual machine, features such as Virtualization-Based Security (VBS) and Hyper-V must be disabled. If either of these features is enabled, the tool will instead produce a .core memory dump rather than a standard format.

Powered by Wolken Software