Converting a snapshot file to memory dump using the vmss2core tool

Products

• VMware Desktop Hypervisor
• VMware vSphere ESXi

Issue/Introduction

This article provides steps to convert a snapshot file to a memory dump using the vmss2core tool.

Developers can use this tool to debug guest operating systems and applications by converting a virtual machine checkpoint into a core dump file.
The checkpoint can either be a snapshot (.vmss) or a suspend file, and a variety of core dump formats can be selected for use with standard debuggers (such as WinDbg or GDB).

vmss2core is included with VMware Workstation and Fusion and supports different guest OS types through appropriate flags.

Environment

VMware Fusion

VMware Workstation 
VMware vSphere ESXi

Resolution

vmss2core is used to convert a suspended virtual machine's snapshot into a core dump for analysis.
Depending on where the VM is running (VMware Workstation, Fusion, or ESXi), the steps differ slightly.

For VMware Workstation 7.x and Above or Fusion 3.x and Above

Locate the vmss2core Tool

Change to the appropriate directory based on the OS and installation:

• Windows (32-bit):
  C:\Program Files\VMware\VMware Workstation\

• Windows (64-bit):
  C:\Program Files (x86)\VMware\VMware Workstation\

• Linux:
  /usr/bin/

• macOS (Fusion):
  /Library/Application Support/VMware Fusion/

To obtain the latest version of vmss2core, download and install the appropriate VMware product:

• Download VMware Workstation Pro

• Download VMware Fusion

---

Run vmss2core

Choose the appropriate flag depending on the guest OS of the virtual machine:

• For Windows (Vista/7/10/Server 2008):
  vmss2core.exe -W virtual_machine_name.vmss virtual_machine_name.vmem

• For Windows 8/8.1, Server 2012, 2016, 2019:
  vmss2core.exe -W8 virtual_machine_name.vmss virtual_machine_name.vmem

• For Linux guests:
  ./vmss2core-Linux64 -N virtual_machine_name.vmss

Note: The -W, -W8, and -N flags refer to the guest operating system of the VM, not the OS where vmss2core is executed.

---

For Virtual Machines Running on ESXi

1. Connect to the ESXi Host via SSH.

2. Identify the World ID of the VM:

   • For ESXi 6.7 and above:
     esxcli vm process list

   • For other versions:
     vm-support -x

3. Suspend the Virtual Machine:

   vm-support -Z <world_ID>
   ⚠️ If vm-support -Z is not supported on your ESXi version, refer to this article to suspend from the GUI:
   Broadcom KB 326327

4. Copy the Suspended VM Files:

   • Transfer the .vmss file to the system where vmss2core is located.

   • If present, also copy the .vmem file to the same directory.

5. Run vmss2core on the Copied Files:

   • Default Windows core dump conversion:
     vmss2core virtual_machine_name.vmss virtual_machine_name.vmem

   • For Windows 8/8.1 or Windows Server 2012/2016/2019 guests:
     vmss2core -W8 virtual_machine_name.vmss

   • For Linux guests:
     ./vmss2core-Linux64 -N virtual_machine_name.vmss

Important Notes

• vmss2core-sb-8456865.exe from the VMware Flings site does not support newer guest OS like Windows 11 or Windows Server 2025.

• To generate core dumps for modern guest operating systems, use the version bundled with VMware Workstation Pro or VMware Fusion:

  • Download Fusion or Workstation Pro

Additional Information

For additional information, see the Debugging Virtual Machines with the Checkpoint to Core Tool Guide.

Suspending a virtual machine on ESX/ESXi to collect diagnostic information
vmss2core ツールを使用してスナップショット ファイルをメモリ ダンプに変換する