memdump - memory dumper

       Wietse Venema
       IBM T.J. Watson Research
       P.O. Box 704
       USA

                                                                                                      MEMDUMP(8)

       On  many  hardware platforms the firmware (boot PROM, BIOS, etc.)  takes away some memory. This memory is
       not accessible through /dev/mem.

       This program should produce output in a format that supports structure information such as ELF.

       This  program  dumps system memory to the standard output stream, skipping over holes in memory maps.  By
       default, the program dumps the contents of physical memory (/dev/mem).

       Output is in the form of a  raw  dump;  if  necessary,  use  the  -m  option  to  capture  memory  layout
       information.

       Output  should  be  sent  off-host  over the network, to avoid changing all the memory in the file system
       cache. Use netcat, stunnel, or openssl, depending on your requirements.

       The size arguments below understand the k (kilo) m (mega)  and  g  (giga)  suffixes.  Suffixes  are  case
       insensitive.

       Options

       -k     Attempt to dump kernel memory (/dev/kmem) rather than physical memory.

              Warning:  this  can  lock  up  the  system to the point that you have to use the power switch (for
              example, Solaris 8 on 64-bit SPARC).

              Warning: this produces bogus results on Linux 2.2 kernels.

              Warning: this is very slow on 64-bit machines because the entire memory address range  has  to  be
              searched.

              Warning:  kernel  virtual  memory  mappings  change frequently. Depending on the operating system,
              mappings smaller than page_size or buffer_size may be missed or may be reported incorrectly.

       -bbuffer_size (default: 0)
              Number of bytes per memory read operation. By default, the program uses the page_size value.

              Warning: a too large read buffer size causes memory to be missed on FreeBSD or Solaris.

       -sdump-size (default: 0)
              Number of memory bytes to dump. By default, the program runs until the memory  device  reports  an
              end-of-file  (Linux),  or  until it has dumped from /dev/mem as much memory as reported present by
              the kernel (FreeBSD, Solaris), or until pointer wrap-around happens.

              Warning: a too large value causes the program to spend a lot of time  skipping  over  non-existent
              memory on Solaris systems.

              Warning: a too large value causes the program to copy non-existent data on FreeBSD systems.

       -mmap_file
              Write  the memory map to map_file, one entry per line.  Specify -m- to write to the standard error
              stream.  Each map entry consists of a region start address  and  the  first  address  beyond  that
              region. Addresses are separated by space, and are printed as hexadecimal numbers (0xhhhh).

       -ppage_size (default: 0)
              Use page_size as the memory page size. By default the program uses the system page size.

              Warning: a too large page size causes memory to be missed while skipping over holes in memory.

       -v     Enable verbose logging for debugging purposes. Multiple -v options make the program more verbose.

       This software is distributed under the IBM Public License.

       memdump - memory dumper

memdump [-kv] [-bbuffer_size] [-ddump_size] [-mmap_file] [-ppage_size]