copy RAM to disk

imsandy_007 · 11-17-2006, 11:39 AM

i want to copy the RAM as is on the hard disk..
i want to write a simple C program..
i don't know which pointer do i have to use.
please give me some sort of help.

Vincent_Vega · 11-17-2006, 11:54 AM

your RAM can be found at /dev/mem. Using cat /dev/mem > filename works I think. Is that what you want?

imsandy_007 · 11-17-2006, 12:01 PM

Quote:

Originally Posted by Vincent_Vega

your RAM can be found at /dev/mem. Using cat /dev/mem > filename works I think. Is that what you want?

by issuing command cat /dev/mem > RAM.DAT will copy whole RAM to disk...
i would also like to know what to do if i want to copy from an address to another address... i mean copying memory range

matthewg42 · 11-17-2006, 12:16 PM

You can probably use dd to specify an offset and number of bytes, e.g.

Code:

dd if=/dev/mem of=mem.dump bs=1 skip=10000 count=5000

...to dump 5000 bytes starting at offset 10000. I'm not 100% sure what the effect of reading the /dev/mem like this will be. One thing to watch is that dumping the memory will no doubt affect the memory... so you won't get an instantaneous snapshot. You might do better to dump from a virtual machine, or use a hardware debugger.

slantoflight · 11-17-2006, 05:34 PM

Quote:

Originally Posted by Vincent_Vega

your RAM can be found at /dev/mem. Using cat /dev/mem > filename works I think. Is that what you want?

I was under the impression you could'nt arbitrarly access memory from other programs, without use of a debugger.

taylor_venable · 11-18-2006, 08:52 AM

Yes, the ability to copy the entirety of your memory to a file a normal user could read sounds very .. unsafe .. isn't that basically the same as reading from any random memory address, which could be beyond your process' space? I get SIGSEGVs when I try to do that in C.

matthewg42 · 11-18-2006, 09:20 AM

Quote:

Originally Posted by taylor_venable

Yes, the ability to copy the entirety of your memory to a file a normal user could read sounds very .. unsafe .. isn't that basically the same as reading from any random memory address, which could be beyond your process' space? I get SIGSEGVs when I try to do that in C.

It's not possible as a normal user - you have to be root. On Ubuntu (and I'm sure some other distros) there is a group, kmem which is also able to read this, but normal users are not added to this group.