.VMSN File Format

VMware snapshot state

Introduction

A .vmsn file is the snapshot state file of a VMware virtual machine: VMware's article on the contents of a Fusion bundle says it "stores the running state of a virtual machine at the time you take the snapshot". It is named <name>-Snapshot<##>.vmsn, and the snapshot's RAM is in a .vmem file with the same name when the snapshot included memory. The .vmsd names the file in its snapshotX.filename key. The format is not published by VMware; this page follows Volatility's VMware address space (after Nir Izraeli's vmsnparser) and its wiki page "VMware Snapshot File", both read in full for this page. The .vmss file has the same layout.

Structure

All numbers are little-endian. The file starts with a header, then an array of group records; each group points to a run of tags.

  1. 0Header magic, a value, the group count12 bytes
  2. 12Group table one 80-byte record for each groupcount × 80
  3. …Tags of each group, ending with a (0, 0) tagvaries
The main parts of a .vmsn file.
OffsetSizeTypeNameDescription
04uint32Magic0xBED2BED0, 0xBAD1BAD1, 0xBED2BED2 or 0xBED3BED3; the low nibble is the storage format version (0 to 3).
44uint32UnknownNot named by Volatility; the meaning is not known.
84uint32Group countThe number of group records.

Group record (80 bytes)

OffsetSizeTypeNameDescription
064textNameThe group name, UTF-8, null-padded.
648uint64Tags offsetThe file offset of the group's first tag.
728uint64UnknownPart of the 80 bytes; not named.

Tag

PartSizeDescription
Flags1Bits 0 to 5: the data length; 62 and 63 mean a long tag. Bits 6 and 7: the number of 32-bit indices (0 to 3).
Name length, name1, then that manyThe tag name, UTF-8.
Indices4 eachSeparate tags of the same name (a CPU number, a register number).
Datadata lengthAfter the indices; 1, 2, 4 and 8 bytes are numbers.
Long tag2 × size, 2, padding, dataThe size on disk and in memory (32-bit in version 0, 64-bit later), a 16-bit padding length, the padding, then the data.
End2A tag with flags 0 and name length 0 ends the group.

Tags that sources print

Volatility's wiki dumps a real file (a .vmss from ESX 4.1; the .vmsn has the same structure). Its tags: Checkpoint/fileversion, ProductName, VersionNumber, Platform, usageMode, memSize, maxFBSize; cpu/cpu:numVCPUs and per-CPU registers; the memory group (see the suspended-state page for how memory runs are located); and Snapshot/cfgFile, the machine's configuration text. Their meanings beyond those words are not stated. The wiki says the files also hold PNG thumbnails of the screen.

Not described

Unknown

  • Reference: bytes 4 to 7 of the header, bytes 72 to 79 of each group record, and the meaning of every tag the sources do not print. VMware has not published the format.
  • Viewer: such tags are shown by name, indices and raw value, labelled unknown; memory runs open as files, and an embedded configuration text or PNG opens in its own viewer.

Links

Software

  • VMware Workstation Pro – VMware's desktop virtual machine software (Windows, Linux)
  • VMware Fusion – VMware's virtual machine software for the Mac (macOS)
  • Volatility 3 – memory forensics framework that reads .vmsn and .vmem files (Python)

Reference