Linux and UNIX Man Pages

Linux & Unix Commands - Search Man Pages

memdump(1) [debian man page]

MEMDUMP(1)						      General Commands Manual							MEMDUMP(1)

NAME
memdump - memory dumper SYNOPSIS
memdump [-kv] [-b buffer_size] [-d dump_size] [-m map_file] [-p page_size] DESCRIPTION
This program dumps system memory to the standard output stream, skipping over holes in memory maps. By default, the program dumps the con- tents of physical memory (/dev/mem). Output is in the form of a raw dump; if necessary, use the -m option to capture memory layout information. Output should be sent off-host over the network, to avoid changing all the memory in the file system cache. Use netcat, stunnel, or openssl, depending on your requirements. The size arguments below understand the k (kilo) m (mega) and g (giga) suffixes. Suffixes are case insensitive. Options -k Attempt to dump kernel memory (/dev/kmem) rather than physical memory. Warning: this can lock up the system to the point that you have to use the power switch (for example, Solaris 8 on 64-bit SPARC). Warning: this produces bogus results on Linux 2.2 kernels. Warning: this is very slow on 64-bit machines because the entire memory address range has to be searched. Warning: kernel virtual memory mappings change frequently. Depending on the operating system, mappings smaller than page_size or buffer_size may be missed or may be reported incorrectly. -b buffer_size (default: 0) Number of bytes per memory read operation. By default, the program uses the page_size value. Warning: a too large read buffer size causes memory to be missed on FreeBSD or Solaris. -d dump-size (default: 0) Number of memory bytes to dump. By default, the program runs until the memory device reports an end-of-file (Linux), or until it has dumped from /dev/mem as much memory as reported present by the kernel (FreeBSD, Solaris), or until pointer wrap-around happens. Warning: a too large value causes the program to spend a lot of time skipping over non-existent memory on Solaris systems. Warning: a too large value causes the program to copy non-existent data on FreeBSD systems. -m map_file Write the memory map to map_file, one entry per line. Specify -m- to write to the standard error stream. Each map entry consists of a region start address and the first address beyond that region. Addresses are separated by space, and are printed as hexadecimal numbers (0xhhhh). -p page_size (default: 0) Use page_size as the memory page size. By default the program uses the system page size. Warning: a too large page size causes memory to be missed while skipping over holes in memory. -v Enable verbose logging for debugging purposes. Multiple -v options make the program more verbose. BUGS
On many hardware platforms the firmware (boot PROM, BIOS, etc.) takes away some memory. This memory is not accessible through /dev/mem. This program should produce output in a format that supports structure information such as ELF. LICENSE
This software is distributed under the IBM Public License. AUTHOR
Wietse Venema IBM T.J. Watson Research P.O. Box 704 USA MEMDUMP(1)

Check Out this Related Man Page

MEM(4)                                                       Linux Programmer's Manual                                                      MEM(4)

NAME
mem, kmem, port - system memory, kernel memory and system ports DESCRIPTION
/dev/mem is a character device file that is an image of the main memory of the computer. It may be used, for example, to examine (and even patch) the system. Byte addresses in /dev/mem are interpreted as physical memory addresses. References to nonexistent locations cause errors to be returned. Examining and patching is likely to lead to unexpected results when read-only or write-only bits are present. Since Linux 2.6.26, and depending on the architecture, the CONFIG_STRICT_DEVMEM kernel configuration option limits the areas which can be accessed through this file. For example: on x86, RAM access is not allowed but accessing memory-mapped PCI regions is. It is typically created by: mknod -m 660 /dev/mem c 1 1 chown root:kmem /dev/mem The file /dev/kmem is the same as /dev/mem, except that the kernel virtual memory rather than physical memory is accessed. Since Linux 2.6.26, this file is available only if the CONFIG_DEVKMEM kernel configuration option is enabled. It is typically created by: mknod -m 640 /dev/kmem c 1 2 chown root:kmem /dev/kmem /dev/port is similar to /dev/mem, but the I/O ports are accessed. It is typically created by: mknod -m 660 /dev/port c 1 4 chown root:kmem /dev/port FILES
/dev/mem /dev/kmem /dev/port SEE ALSO
chown(1), mknod(1), ioperm(2) COLOPHON
This page is part of release 4.15 of the Linux man-pages project. A description of the project, information about reporting bugs, and the latest version of this page, can be found at https://www.kernel.org/doc/man-pages/. Linux 2015-01-02 MEM(4)
Man Page

Featured Tech Videos