Memory dumps from VMware images
Wednesday, October 31st, 2007Although I haven’t found the way to distinguish the process dump taken from a physical machine versus virtualized machine there is a way to see it from kernel and complete memory dumps if VMware Tools are installed inside the guest Windows OS:
kd> !vm
...
...
...
1098 VMwareUser.exe 350 ( 1400 Kb)
...
14e4 VMwareTray.exe 317 ( 1268 Kb)
...
0664 VMwareService.e 190 ( 760 Kb)
...
...
...
In case of a kernel minidump we can check for VMware drivers (as we can obviously do with kernel and complete memory dumps):
kd> lmt m vm*
start end module name
bf9e6000 bf9faa80 vmx_fb Tue Oct 04 08:13:32 2005
f6e8b000 f6e8ed80 vmx_svga Tue Oct 04 08:13:02 2005
f77e7000 f77ede80 vmxnet Sat Apr 22 23:13:11 2006
f7997000 f7998200 vmmouse Tue Aug 02 20:07:49 2005
f79c9000 f79ca5c0 vmmemctl Thu Jul 26 21:50:03 2007
If VMware Tools are not installed we can check machine id:
kd> !sysinfo machineid
Machine ID Information [From Smbios 2.31, DMIVersion 0, Size=1642]
BiosVendor = Phoenix Technologies LTD
BiosVersion = 6.00
BiosReleaseDate = 04/17/2006
SystemManufacturer = VMware, Inc.
SystemProductName = VMware Virtual Platform
SystemVersion = None
BaseBoardManufacturer = Intel Corporation
BaseBoardProduct = 440BX Desktop Reference Platform
BaseBoardVersion = None
- Dmitry Vostokov @ DumpAnalysis.org -
