The LeechCore library supports reading live VMWare Workstation Guest VM memory from the host at very high speeds.

Facts in short:

• Tested on VMWare workstation 15.5 and above.
• VMs with TPM/SecureBoot enabled are not supported.
• Must be started in elevated admin command prompt.
• Supported only on Windows. Both VMWare and LeechCore must be 64-bit.
• Acquires memory in read/write mode.
• Acquired memory is assumed to be volatile.

LeechCore API:

Please specify the acquisition device type in LC_CONFIG.szDevice when calling LcCreate. The acquisition device type is vmware.

PCILeech / MemProcFS:

Please specify the device type in the -device option to PCIleech/MemProcFS.

Options:

ro=1 Read-Only / Disallow Writes.

id= The ID is the PID of the VMWare process for the Guest VM.

Examples:

-device vmware

-device vmware://ro=1,id=6244

Process must be running as elevated administrator (alternatively have the privilege SeDebugPrivilege).

No additional requirements exist.