Error: Cannot translate linear address fffff78000000000 when using vmss2core on Windows VBS enabled VMs - VMware vCenter Server

Products

• VMware vCenter Server

Issue/Introduction

Symptoms: When converting a virtual machine snapshot (.vmsn) or suspend file (.vmss) to a memory dump using the vmss2core.exe utility, the process fails.

• The console displays: Error: Cannot translate linear address fffff78000000000
• The console displays: Error parsing Windows data. Cannot create memory.dmp
• The resulting file is 0KB or invalid.

Environment

• VMware vCenter Server 7.x / 8.x
• Windows Server 2019 / 2022 Guest OS
• Virtualization-Based Security (VBS) enabled in VM Options

Cause

The vmss2core utility fails to translate the linear address because the virtual machine is configured with Virtualization-Based Security (VBS) support at the hypervisor level (vhv.enable = "TRUE"). Even if VBS is reported as "Enabled but not running" within the guest, this configuration modifies the memory map to support the secure kernel. This obfuscates the linear address fffff78000000000 (KUSER_SHARED_DATA), preventing the tool's Windows parser (-W or -W8) from locating the Debugger Data Block.

Resolution

Use one of the following methods to obtain a valid memory dump.

Method 1: Use the Generic Parsing Flag Run the vmss2core utility with the -N flag to skip Windows-specific structure parsing.

1. Open a command prompt.
2. Execute the following command: vmss2core.exe -N <filename>.vmsn <filename>.vmem Note: This creates a core file, not a standard .dmp file.
3. Refer to Converting a snapshot file to memory dump using the vmss2core tool (323788) for further details.

Method 2: Trigger a Native Guest OS Dump (Recommended) If Method 1 does not provide the required data, capture a dump directly from the Guest OS using a Non-Maskable Interrupt (NMI).

1. Configure the Guest OS to generate a dump on NMI.
2. Send an NMI to the virtual machine.
3. Refer to How to send NMI to Guest OS on ESXi 6.x or Later (301246) for specific steps.

Additional Information

• To speak with a customer representative or a Support Engineer see Contact Support. Scroll to the bottom of the page and click on your respective region.