VMMZ—Compression of Virtual-Machine Memory Dumps James E. Fowler About VMMZ VMMZ provides the lossless compression of a memory dump from a virtual machine tailored to such situations in which there exists a known baseline virtual machine. Rather than compress the memory dump directly, VMMZ compresses with respect to the baseline memory via delta encoding. Additionally, to further improve compression efficiency, VMMZ exploits the fact that many of the differences between the baseline memory and that of the currently running machine may be the result of the loading of known executable programs and shared libraries. Consequently, VMMZ uses delta coding to compress the current virtual-machine memory dump by coding its differences with respect to a predicted memory image, with the latter formed by duplicating the loading of the executables and libraries into the baseline memory, resulting in a significant improvement in compression performance over straightforward delta coding alone. Publications J. E. Fowler, “Compression of Virtual-Machine Memory in Dynamic Malware Analysis,” Journal of Digital Forensics, Security and Law, vol. 12, no. 1, pp. 41-46, March 2017. J. E. Fowler, “Compression of Virtual-Machine Memory in Dynamic Malware Analysis,” in Proceedings of the International Conference on Systematic Approaches to Digital Forensic Engineering, Kyoto, Japan, September, 2016, pp. 31-38. J. E. Fowler, “Delta Encoding of Virtual-Machine Memory in the Dynamic Analysis of Malware,” in Proceedings of the Data Compression Conference, J. A. Storer and M. W. Marcellin, Eds., Snowbird, UT, March 2016, p. 592. Software vmmz-1.0-1.tar.gz – Source code for VMMZ Last update: 7-sep-2024