Snapshot window layout, hierarchcal view?

[agreulich]

Hi all,

This is an old GUI thing which annoys me already for a long time in Fusion, and I had some hope it would be solved in Fusion 10, but it is not... I'm working in malware analysis, and there it happens often to have quite a lot of snapshots, often in longer chains (these are very useful in debugging sessions). Unfortunately, when your hierarchy becomes complex, 2 annoying things happen in the snapshot overview window:

• Snapshot icons suddenly appear one above the other (actually more than one chain is shown at the same horizontal position, instead of adding proper horizontal space in between). It is then impossible to select the snapshots below others. In Fusion 10, at least two of the vertical  blue connectors are shown (before, it was only one vertical connector, even with overlying icons), and I hoped this would allow manual re-arrangement, but this was not possible, so the improvement is minor. changing the icon size does not solve the issue by the way.
• The whole tree is always arranged in a way that the current snapshot is leftmost. The snapshot used just before (which might be from another vertical chain, typically belonging to another malware) can then move so some very remote location to the right, and is then hard to find. There's no rule you can rely on where to find it (like chronological right to left or so). I would prefer, as an option at least, to use a fix arrangement of the tree. optimally one I can define myself, but I understand this is a lot of work.

Best and probably easiest would be a simple text display in a hierarchy (the same way files in a file hierarchy are shown),sorted chronologically, without showing icons. In other words, the same way it is solved under Windows hosts. I understand the "nice" Mac GUI might be prettier to look at and easier for simple cases and standard users; but for professional work in reverse engineering, it is quite useless. At least the Pro version should allow this display optionally. Or maybe there is a way I'm not aware of?

The only workaround I found using vmrun directly, which can display such a hierarchy, and also allows to revert snapshots - but it means I always need to turn to a command line tool in order to revert snapshots and call Pyhon scripts. It would be nice to have this in the GUI itself. It would be on my wishlist for a future release 😉

br Andy

[parmarr]

Question for you is why are running on snapshots to begin with. The feature is there for sure, but VMware recommends to not run your virtual machine in snapshots.

Please review KB Consolidating snapshots in VMware Fusion (1020000) as this may clarify and shed more light on the topic. Also, if you wish to put in a feature request for a product, see Making a VMware feature request (1002123).

[agreulich]

As I wrote, I'm not using vmware for a productive environment, but for reverse engineering malware under debugger control. It is very common for this task to have many snapshots - this allows you to freeze a certain stage of the malware in a debugger, and if things then go wrong, you can just step back to the last snapshot taken before, without needing to repeat the potentially very complex steps before. It is also common to keep certain critical snapshots of a malware for a longer period, a bit like a library. You can now argue that this is not the intended use of vmware, which might even be the case, but virtual machines are an extremely common tool among reversers. All I'm asking for is a simpler, non graphic display of snapshots. Something that makes it easier to keep the overview. It is kind of painful to see this is available in the windows version, but not in the mac version.