Flings
Apps and tools built by our engineers that are intended to be played with and explored.

Vmss2core

Vmss2core

Summary

Vmss2core is a tool to convert VMware checkpoint state files into formats that third party debugger tools understand. It can handle both suspend (.vmss) and snapshot (.vmsn) checkpoint state files (hereafter referred to as a ‘vmss file’) as well as both monolithic and non-monolithic (separate .vmem file) encapsulation of checkpoint state data.

Features

The vmss2core tool can produce core dump files for the Windows debugger (WinDbg), Red Hat crash compatible core files, a physical memory view suitable for the Gnu debugger gdb, Solaris MDB (XXX), and Mac OS X formats. Debugging Virtual Machines with the Checkpoint to Core Tool provides the usage information for the vmss2core tool.

Note: This last update has improved support for Win 8.1/Win2012 R2 vmss files.

System Requirements

VMware Fusion Support Center FAQs and VMware Workstation 9 System Requirements provide the system requirements.

In addition, Windows hosts also need to have Visual Studio 2008 Service Pack 1 runtime installed. Please see http://www.microsoft.com/en-us/download/details.aspx?id=26368 for instructions on getting the runtime.

Workstation Host System Requirements:
https://www.vmware.com/pdf/ws80-getting-started.pdf

Fusion Host System Requirements:
https://www.vmware.com/pdf/fusion_getting_started_40.pdf

Instructions

For instructions on how to use vmss2core see Debugging Virtual Machines with the
Checkpoint to Core Tool

Video

Change Log

Engineers

Doug Covelli

Monitor
Add Feedback

48 thoughts on “Vmss2core

  1. Helge Mahrt

    I’m trying to convert a checkpoint of a Windows Server 2008 SP2 x64 machine but it won’t work. The tool is unable to find the Windows data:

    vmss2core version 2452889 Copyright (C) 1998-2015 VMware, Inc. All rights reserved.
    region[0]: start=0 end=c0000000.
    region[1]: start=100000000 end=23fc00000.
    Cannot recognize Windows VM.
    Error parsing Windows data.
    Cannot create memory.dmp
    Finished writing core.

    Reply
  2. Dominic Cadorette

    I’m trying to create a memory.dmp file from a suspended W2012R2 VM. I used the command “vmss2core.exe -W8 vm.vmss” and it always creates an empty memory.dmp file. I also tried with a snapshot of the VM instead of a suspended VM and I have the same problem.

    The process seems to finish correctly, but the output memory.dmp file is always empty (0 byte file).

    I tried to run the vmss2core.exe executable from a file downloaded on this page and the one included in VMware Workstation 11. I tried to run the command from a W7 and a W2012R2 computer.

    Anyone having an idea ?

    Reply
  3. Jonny

    I also have the problem with Windows 2012 Machines. Appearently vmss2core cant read data for the dump generation process.

    I used the switch -WK and -W8

    vmss2core version 2452889 Copyright (C) 1998-2015 VMware, Inc. All rights reserv
    ed.
    region[0]: start=0 end=c0000000.
    region[1]: start=100000000 end=840000000.
    Cannot read L1 page table la=9b6800000 l2e=60a000068975d867 l2offs=64979d000 2 4
    096.
    Cannot read L1 page table la=9b6a00000 l2e=60b000068975e867 l2offs=64979e000 2 4
    096.
    Cannot read L1 page table la=9d5200000 l2e=7000000688653867 l2offs=648693000 2 4
    096.
    Cannot read L1 page table la=9d5400000 l2e=5d50000689754867 l2offs=649794000 2 4
    096.
    Cannot read L1 page table la=9f5400000 l2e=10000688655867 l2offs=648695000 2 409
    6.
    Cannot read L1 page table la=ad7c00000 l2e=71900007f5d70867 l2offs=7b5db0000 2 4
    096.
    Cannot read L1 page table la=af7a00000 l2e=1800007f5c70867 l2offs=7b5cb0000 2 40
    96.
    Cannot read L1 page table la=b17800000 l2e=11800007f5b70867 l2offs=7b5bb0000 2 4
    096.
    Cannot read L1 page table la=b37600000 l2e=21700007f5a70867 l2offs=7b5ab0000 2 4
    096.
    Cannot read L1 page table la=b57400000 l2e=31700007f5970867 l2offs=7b59b0000 2 4
    096.
    Cannot read L1 page table la=b77200000 l2e=41600007f5e70867 l2offs=7b5eb0000 2 4
    096.
    Cannot read L1 page table la=b97000000 l2e=51600007f5f70867 l2offs=7b5fb0000 2 4
    096.
    Cannot read L1 page table la=2800000 l2e=69c000066ec78867 l2offs=62ecb8000 2 409
    6.
    Cannot read L1 page table la=5c00000 l2e=3c30000635865867 l2offs=5f58a5000 2 409
    6.
    Cannot read L1 page table la=6200000 l2e=52900006100ce867 l2offs=5d010e000 2 409
    6.
    Cannot read physmem page 31fcf000.
    WinWriteKernelDump: Core_DumpMemory returned 0xfffffffe
    WinWriteKernelDump returned 0xfffffffe
    Finished writing core.

    Reply
  4. Joris de Vos

    It seems that VMware Workstation is equipped with a newer version than the one published here:

    vmss2core version 2496824 (VMware WS11) versus vmss2core version 2452889 (VMware Labs version).

    What are the differences?

    Reply
  5. Jason Hogsten

    Downloaded the newest version and unable to run the command against a snapshot of a Win2012 OS. I get the following when running vmss2core_win.exe -W8 or vmss2core_win.exe -W or vmss2core_win.exe -WSCAN

    vmss2core version 2452889 Copyright (C) 1998-2015 VMware, Inc. All rights reserved.
    region[0]: start=0 end=c0000000.
    region[1]: start=100000000 end=240000000.
    Cannot create memory.dmp
    Finished writing core.

    Reply
    1. Doug Covelli

      It looks like the VM wasn’t running Windows. Can you clarify when the snapshot was taken? Was it before the bootloader handed off control to the Windows kernel?

      Reply
  6. Rob Scheepens

    When trying to convert a 64GB snapshot, we run into:

    C:\>vmss2core_win.exe -W machine.vmsn
    vmss2core version 2452889 Copyright (C) 1998-2015 VMware, Inc. All rights reserved.
    region[0]: start=0 end=c0000000.
    region[1]: start=100000000 end=1040000000.
    Cannot recognize Windows VM.
    Error parsing Windows data.
    Cannot create memory.dmp
    Finished writing core.

    Is this a known issue?

    Reply
    1. Doug Covelli

      What Windows version was the guest running? If it was Win8/2012 or later you need to use “-W8” instead of “-W”

      Reply
  7. Reginaldo C. Tunisi

    I also have the problem with Win2K12R2 Machines. Appearently vmss2core cant find the memory space to start reading data for the dump generation process

    Win2k12R2 version and build is 6.3.9600
    vmss2core version is 3156346

    Output from vmss2core (used W8 switch and even with WSCAN result is pretty much the same)

    vmss2core version 3156346 Copyright (C) 1998-2013 VMware, Inc. All rights reserved.
    region[0]: start=0 end=c0000000.
    region[1]: start=100000000 end=140000000.
    scanning pa=0 len=0x10000000
    scanning pa=0xfffffab len=0x10000000
    scanning pa=0x1fffff56 len=0x10000000
    scanning pa=0x2fffff01 len=0x10000000
    scanning pa=0x3ffffeac len=0x10000000
    scanning pa=0x4ffffe57 len=0x10000000
    scanning pa=0x5ffffe02 len=0x10000000
    scanning pa=0x6ffffdad len=0x10000000
    scanning pa=0x7ffffd58 len=0x10000000
    scanning pa=0x8ffffd03 len=0x10000000
    scanning pa=0x9ffffcae len=0x10000000
    scanning pa=0xaffffc59 len=0x10000000
    scanning pa=0xbffffc04 len=0x3fc
    scanning pa=0x100000000 len=0x10000000
    scanning pa=0x10fffffab len=0x10000000
    scanning pa=0x11fffff56 len=0x10000000
    scanning pa=0x12fffff01 len=0x10000000
    scanning pa=0x13ffffeac len=0x154

    Reply
    1. Doug Covelli

      From the copyright it looks like you are using an old version. Can you please try the new version? It should fix the problem.

      Reply
      1. Reginaldo C. Tunisi

        Thanks for the quick reply, Doug

        I just redownloaded the tool and it appears to be an older version…

        My version is 3156346
        downloaded version is 2452889 (just downloaded from the big Download button on the left! :) )

        is there any other link for a newer one?

        Reply
        1. Doug Covelli

          It appears the linux64 version was not updated only the linux32 one was for some reason. I’ll contact the sites maintainer. Sorry about that.

          Reply
  8. Doug Covelli

    We have a new version that will work with newer builds of Windows Server 2012 R2 . We’ll try to get it uploaded shortly.

    Reply
  9. Richard Leung

    vmss2core won’t generate a memory dump file. It worked two weeks ago and I am not sure why this time the memory.dmp file is always 0KB in size

    The VM is a Windows Server 2012 R2

    Command I run:
    vmss2core_win.exe -W8 server1-snapshot1.vmsn

    The commnad stopped after it finished scanning the server1-snapshot1.vmsn. It used to continue by writting to memory.dmp file after the scanning

    Reply
    1. Doug Covelli

      Sorry I missed this. Unfortunately there’s no options to control where the dump file is created. You probably already realized this but as a workaround you can run it from the directory where you want the dump file created and specify the full path to the input files.

      Thanks,
      Doug

      Reply
  10. Khiew Ma Fah

    not able to create memory dump for Window 2008 32bit Enterprise Edition with 8GB PEA enabled.

    F:\>vmss2core_win.exe xx.vmss -W
    vmss2core version 3156346 Copyright (C) 1998-2013 VMware, Inc. All rights reserved.
    region[0]: start=0 end=c0000000.
    region[1]: start=100000000 end=240000000.
    Cannot recognize Windows VM.
    Error parsing Windows data.
    Cannot create memory.dmp
    Finished writing core.

    Reply
    1. Khiew Ma Fah

      It only fail with 3GB switch in Windows.


      Windows Boot Loader
      ——————-
      identifier {current}
      device partition=C:
      path \Windows\system32\winload.exe
      description Microsoft Windows Server 2008
      locale en-US
      inherit {bootloadersettings}
      osdevice partition=C:
      systemroot \Windows
      resumeobject {79bc2a67-edec-11df-a101-005056a317e4}
      nx OptOut
      increaseuserva 3072

      Reply
  11. Tom

    Given a VMSS file from a 6GB VM running a 32-bit Debian Linux guest, I only get a 3G vmss.core file, when running vmss2core-Linux64 with the “-M” flag. There also appears to be a truncation warning.

    vmss2core version 3156346 Copyright (C) 1998-2013 VMware, Inc. All rights reserved.
    region[0]: start=0 end=c0000000.
    region[1]: start=100000000 end=1c0000000.
    vmss2core: Warning: Truncating 0 – 0x180000000
    Started core writing.
    Writing note section header.
    Writing 2 memory section headers.
    Writing notes.
    … 10 MBs written.
    … 20 MBs written.
    …. …..
    … 3060 MBs written.
    … 3070 MBs written.
    Finished writing core.

    Reply
    1. Doug Covelli

      > Given a VMSS file from a 6GB VM running a 32-bit Debian Linux guest, I only get a 3G vmss.core file, when running vmss2core-Linux64 with the “-M” flag. There also appears to be a truncation warning.

      For 32-bit guests we generate a 32-bit core file with 32-bit ELF section headers. Since 32-bit ELF section headers have only 32-bits for the address and file offset fields we have to truncate the core file to 4GB in this case. Since our VMs typically don’t have any physical memory between 3GB and 4GB you will likely get a 3GB core file.

      Reply
      1. Tom

        With Debian “bigmem” kernels, which have PAE support, 32-bit guest OSs can address more than 4GB of physical memory. Ubuntu also ships “-pae” kernels that could address more than 4GB. Rather than generate ELF32 core files for VMSS’s with more than 4GB of physical memory, could not ELF64 core files be used, even for 32-bit guests?

        Reply
  12. Jesse

    To Akash getting the error message “Cannot locate cpu.CR0 for VCPU 0 trying HWV9.”, you need to run it with the “-W8” parameter instead of just “-W” for Windows 8 / Server 2012 VMs.

    Reply
      1. Doug Covelli

        I suspect we need to upload a new version. Do you know the exact version of Windows 2012 R2 you are using such as :

        9600.16404.amd64fre.winblue_gdr.130913-2141 or
        9600.16384.amd64fre.winblue_rtm.130821-1623

        Thanks,
        Doug

        Reply
          1. Doug Covelli

            Thanks. Do you know where I can get a copy of Build: 6.3.9600.16500? The new version should work with

            9600.16404.amd64fre.winblue_gdr.130913-2141
            9600.16384.amd64fre.winblue_rtm.130821-1623

            and hopefully others. I’ll try to get it uploaded shortly.

            Reply
            1. Niklas

              If you have Windows 8.1 it should be same builds as Windows 2012 R2 besides some more features you can add.

              Is it possible to do -W9200 (Windows 8/2012) and -W9600 (Windows 8.1/2012 R2) also or did it change from builds to -W8 instead? Should it be same -W8 for Windows 8.1/2012 also or is it limited to Windows 8/2012 currently?

              We get “Cannot recognize Windows VM.” error.

              Could it be a problem if you have one snapshot before and then you create saved state or new snapshot and try to do it from this latest file? Is there some additional steps for this?

              I heard there is also vmdumper tool also. Is this working in similar way? Could it be used instead? Where is this tool?

              Reply
  13. pkoetsier

    The Linux 64-bit, the Linux 32-bit and the Mac versions all crashed for me. The Mac version with an “Illegal instruction”, the Linux versions with a segmentation fault. They all appear to be build number 1245615.

    Luckily the Windows version worked for me, but it somehow seems wrong to have to build a Linux kernel core dump using a tool on Windows :-)

    Reply
  14. Doug Covelli

    > Cannot translate linear address ffff880045600000.
    > Cannot read kernel stack pointer.

    This usually means the VM’s page tables were somehow corrupted. What state was the VM in when you suspended it? Had it panicked or triple faulted?

    Thanks,
    Doug

    Reply
  15. liubing

    vmss2core version 1245615 Copyright (C) 1998-2013 VMware, Inc. All rights reserv
    ed.
    region[0]: start=0 end=c0000000.
    region[1]: start=100000000 end=840000000.
    Started core writing.
    Writing note section header.
    Writing 2 memory section headers.
    Writing notes.
    Cannot translate linear address ffff880045600000.
    Cannot read kernel stack pointer.
    Cannot read pointer to current task
    Cannot write Elf header.
    Finished writing core.

    Reply
  16. Akash

    I am also using the same version and getting the following error:

    vmss2core version 1245615 Copyright 1998-2013 VMware

    region[0]: start=0 end=c0000000.
    region[1]: start=100000000 end=440000000.
    Cannot locate cpu.CR0 for VCPU 0 trying HWV9.
    Cannot recognize Windows VM.
    Error parsing Windows data.
    Cannot create memory.dmp
    Finished writing core

    Reply
  17. Akash

    I am also using the same version and getting the same error:

    vmss2core version 1245615 Copyright 1998-2013 VMware
    ed.
    region[0]: start=0 end=c0000000.
    region[1]: start=100000000 end=440000000.
    Cannot locate cpu.CR0 for VCPU 0 trying HWV9.
    Cannot recognize Windows VM.
    Error parsing Windows data.
    Cannot create memory.dmp
    Finished writing core

    Reply
  18. Dolan

    Hi,

    The Windows download here appears to behave differently from the one installed on my work laptop with Workstation 9. I ran the command specified in the documentation (vmss2core -W .vmss .vmem); the old version ran perfectly on all Windows VMs, but the fresh download failed with the message
    “cannot locate cpu.CR[0] for VCPU 0.
    Cannot create memory.dmp
    Finished writing core. ”
    What changed and how should I alter my behavior to make it work?

    Reply
      1. Sunil Nair

        I seem to be getting this message when I attempt to run “VMSS2CORE -W
        Cannot locate cpu.cpu:numVCPUs

        – I tested this against a Workstation 9.0 VM snapshot and a ESX 3.5 VM snapshot – Same results.
        – Is there any other dependency that I am perhaps overlooking?

        Reply

Leave a Reply

Your email address will not be published. Required fields are marked *