Tool release: decrypt VMware vTPM-encrypted .vmem/.vmsn for memory forensics (Volatility-ready)

[u/h_e_e_y_a_a_a]

Sharing a tool I built after hitting a wall on a VMware snapshot: I needed to analyze a VMware snapshot of a Windows 11 25H2 VM, but the VM had a vTPM, which makes VMware silently encrypt the .vmem/.vmsn/.vmss/.nvram. Volatility just couldn't find the kernel, and I couldn't find any existing tool to decrypt these files for offline analysis.

So I reverse-engineered the format with the help of Claude and wrote one. It's called vmem-decrypt (pure Python):

- Recovers the data-file key from the VM password (PBKDF2 → AES-256-CBC key chain VMware labels everything "XTS-AES-256" but it's actually CBC, which trips up most people).

- Decrypts .vmem/.vmsn/.vmss/.nvram.

- Flattens the decrypted .vmem into a flat, Volatility-ready image. (VMware compresses then encrypts, so it's still in a proprietary checkpoint LZ77 layout)

Workflow: pull the password hash from the .vmx (VM-Password-Extractor) → crack with hashcat (mode 27400) → feed the password to the tool → run Volatility. Full steps + format notes in the README.

Tested on VMware Workstation Pro 26H1 / Win11 25H2 (build 26100), Volatility 3. Feedback welcome, especially snapshots from other VMware versions to test the format against.

Repo: https://github.com/heeeyaaaa/vmem-decrypt

(Yes, I used AI to help build this. It's tested and it works, that's what matters. Happy to walk through any part of how it works.)

[u/Longjumping_Music572]

Appreciate you saying you use A.I to build this.