Clint Colding    Archive    Feed    About

Generate a Windows Memory Dump from VMware

This is a simple process to generate a full memory dump for a Windows server running on VMware. There are no actions required within the VM itself, the only requirement is that you’re able to suspend the VM.

  1. Download the Vmss2core tool from VMware Flings.
  2. Suspend the VM you want to collect the memory dump for, this will generate a .vmss file.
  3. Navigate to the datastore your VM resides on and download the .vmss and .vmem files.
  4. Move the VM and the Vmss2core files into the same folder.
  5. Run the following command to generate a .dmp file:
.\vmss2core-sb-8456865.exe -W8 TESTVM-4409dd21.vmss TESTVM-4409dd21.vmem

You will now have a memory.dmp file that you can further analyze.