Skip to content

Hyper-V Save State support (.vmrs files) #1886

@semchapeu

Description

@semchapeu

When you save the state of a Hyper-V VM a VMRS file is created. From what I can gather (!) this file contains, amongst other state information, a full uncompressed memory dump of the VM.

I like that you can use volatility directly on the .vmem files that VMware produces when saving the state, and wish the same could be done with Hyper-V save states.

I found this which may be helpful for reference, but it appears to be using a Microsoft DLL.
https://github.com/ufrisk/LeechCore-plugins/tree/master?tab=readme-ov-file#leechcore_device_hvsavedstate

Metadata

Metadata

Assignees

Labels

No labels
No labels

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions