Date: Mon, 22 Jan 2018 07:14:47 -0700 From: Warner Losh <imp@bsdimp.com> To: Office Manager <officem4790@gmail.com> Cc: freebsd-drivers@freebsd.org Subject: Re: Creating a KLD to dump memory Message-ID: <CANCZdfoWrgF0un7OkgYHdA0mCZWPnF0n7h5Ezi2FaWgJwXX0%2BQ@mail.gmail.com> In-Reply-To: <CADjugXSrZBXj29Oo4j33wEROBB-SmJ-xeTUsYcgbwacdOMnZXA@mail.gmail.com>
index | next in thread | previous in thread | raw e-mail
On Mon, Jan 22, 2018 at 6:48 AM, Office Manager <officem4790@gmail.com> wrote: > Hi, > I'm trying to create a kernel module to dump the memory of a machine like > lime <https://github.com/504ensicsLabs/LiME>. > Right now I'm using memrw implementation to read the physical memory, my > problem with this method is the garbage pages that return a page filled > with 0xFF's. > How can I create a dump containing only the physical available memory? > > e.g my machine has 256mb so I want a 256mb memory dump. > Study the code that implements /dev/mem. It's in mem.c in the arch dependent directory in the kernel. Warnerhelp
Want to link to this message? Use this
URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?CANCZdfoWrgF0un7OkgYHdA0mCZWPnF0n7h5Ezi2FaWgJwXX0%2BQ>