VM Saved State Dump Provider API
Note: These APIs are not yet publicly available and will be available in the latest release of the Windows SDK.
The saved state format of a VM can be accessed via VmSavedStateDumpProvider DLL, which abstracts away the format to provide an API to extract dump-related content. The DLL exports a set of C-style Windows API functions.
The VM Saved State Dump Provider DLL offers APIs that fall into two categories:
- I/O of the saved state files
- Operations on the resulting handle generated by I/O on the saved state files.
|ApplyPendingSavedStateFileReplay||Opens the saved state file in read-write exclusive mode so that it applies any pending replay logs to the contents|
|GetArchitecture||Queries the saved state for the current achitecture the virtual processor was running|
|GetGuestPhysicalMemoryChunks||Returns the layout of the physical memory of the guest|
|GetGuestRawSavedMemorySize||Queries for the current paging mode in use by the virtual processor|
|GetPagingMode||Queries for the current paging mode in use by the virtual processor|
|GetRegisterValue||Queries for a specific vergister value for a given virtual processor|
|GetVpCount||Queries for the virtual processor count from the dump file|
|GuestPhysicalAddressToRawSavedMemoryOffset||Translates the given guest physical address to a raw saved memory offset|
|GuestVirtualAddressToPhysicalAddress||Translates a virtual address to the associated physical address|
|LoadSavedStateFile||Loads the saved state file and creates an instance of VmSavedStateDump|
|LoadSavedStateFiles||Loads the saved state files and creates an instance of VmSavedStateDump|
|LocateSavedStateFiles||Locate the saved state files for a given VM or snapshot|
|ReadGuestPhysicalAddress||Reads from the saved state file the given guest physical address range|
|ReadGuestRawSavedMemory||Read raw memory from the saved state file|
|ReleaseSavedStateFiles||Releases the given VmSavedStateDump provider that matches the supplied ID|