https://github.com/NateBrune/fmem

Linux Kernel Module designed to help analyze volatile memory in the linux kernel
https://github.com/NateBrune/fmem

Last synced: 2 months ago
JSON representation

Linux Kernel Module designed to help analyze volatile memory in the linux kernel

• Host: GitHub
• URL: https://github.com/NateBrune/fmem
• Owner: NateBrune
• License: gpl-2.0
• Created: 2015-06-10T13:40:20.000Z (over 9 years ago)
• Default Branch: master
• Last Pushed: 2024-02-23T18:37:28.000Z (11 months ago)
• Last Synced: 2024-08-04T04:04:28.913Z (6 months ago)
• Language: C
• Homepage:
• Size: 30.3 KB
• Stars: 112
• Watchers: 7
• Forks: 37
• Open Issues: 3
• Metadata Files:
  • Readme: README
  • Changelog: ChangeLog
  • License: COPYING
  • Authors: AUTHORS

Awesome Lists containing this project

• awesome-memory-forensics - fmem - This module creates /dev/fmem device, that can be used for dumping physical memory, without limits of /dev/mem (1MB/1GB, depending on distribution). (Tool / Memory Acquisition)

README

        
fmem 1.6.0

This repo is was originally a github mirror of the original fmem module.

Later this repo became a maintained version of fmem to account for a changing Linux kernel.

Bug reports and patches welcome.

This module creates /dev/fmem device,

that can be used for dumping physical memory,

without limits of /dev/mem (1MB/1GB, depending on distribution)

  

Tested on i386 and x64, feel free to test it on 

different architectures. (and send report please)

 

Cloned from linux/drivers/char/mem.c 

(so GPL license apply)

Original name of this tool was fdump, 

which was conflict with already existing tool,

so name was changed to fmem  

2009,2010 [email protected]

-----

Usage:

$ make

# ./run.sh

# dd if=/dev/fmem of=... bs=1MB count=... 

-----

BUGS: if you do something like # dd if=/dev/fmem of=dump 

      dd will never stop, even if there is no more physical RAM

      on the system. This is more a feature, because Linux kernel

      don't have stable API, and detection of mapped areas can be 

      tricky on older kernels. Because primary usage for fmem is 

      memory forensic, I think it is safer to specify 

      amount of RAM by hand.

-----