Saturday, April 9, 2011

Read the content from RAM (Random Access Memory)

On Linux, it is possible to access and analyze RAM contents.
In Linux, everything is a file so the path to the RAM file is /dev/mem. To dump its contents, you can use the following command as root only:

hexdump -c /dev/mem
and you should see something like ...

00fea90   s   t   a   r   t   e   d   ,       b   u   t       t   i   m
00feaa0   e       m   a   y       b   e       i   n   a   c   c   u   r
00feab0   a   t   e   .  \r  \n  \0   A   t   t   e   m   p   t   i   n