linux-kernel - snapshot of physical memory

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:	Tue, 18 Jul 2006 12:16:16 -0400
From:	Allison <fireflyblue@...il.com>
To:	linux-kernel@...r.kernel.org
Subject: snapshot of physical memory

Hi,

I am interested in getting a snapshot of the linux physical memory to
perform some offline analysis on it. I read in another post that I can
simply copy /dev/mem and it copies all physical memory contents. It
indeed gave me the same file size as the amount of physical memory
Linux recognizes.

1. Is my understanding correct ? What are the other ways one can dump
physical memory.I am interested in taking a snapshot of memory.

2. How do I make sure that no updates take place in memory from the
time I initiate the snapshot till it is done.

3. What is the best way to find out whether each page in here belongs
to kernel or process memory.. also the type of page (code,data etc)

4. What exactly happens when you copy /dev/mem to a file.

I am not an expert in this area. Detailed answers are greatly
appreciated.

thanks,
Allison
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/