Date: Mon, 22 Jan 2018 17:13:26 +0200 From: Office Manager <officem4790@gmail.com> To: freebsd-drivers@freebsd.org Subject: Fwd: Creating a KLD to dump memory Message-ID: <CADjugXTmc0z7EXzTzzbkrGjnoZu7v1JP-aXn_7E_pw1i510dFA@mail.gmail.com> In-Reply-To: <CADjugXRXkBa5vEgUwMfrrxNArWtf9uH1XnJo6Fqn6BhyM02fKA@mail.gmail.com> References: <CADjugXSrZBXj29Oo4j33wEROBB-SmJ-xeTUsYcgbwacdOMnZXA@mail.gmail.com> <CANCZdfoWrgF0un7OkgYHdA0mCZWPnF0n7h5Ezi2FaWgJwXX0%2BQ@mail.gmail.com> <CADjugXRXkBa5vEgUwMfrrxNArWtf9uH1XnJo6Fqn6BhyM02fKA@mail.gmail.com>
index | next in thread | previous in thread | raw e-mail
---------- Forwarded message ---------- From: Office Manager <officem4790@gmail.com> Date: Mon, Jan 22, 2018 at 4:52 PM Subject: Re: Creating a KLD to dump memory To: Warner Losh <imp@bsdimp.com> Hi, As I said I'm using memrw which is /dev/mem code to read and write memory. My problem is in 32bit the dump outputs to about 4gb(size of all possible mappings of physical address) /dev/mem as well gives 0xFF to unmapped physical pages, I want to dump only mapped physical pages. On Mon, Jan 22, 2018 at 4:14 PM, Warner Losh <imp@bsdimp.com> wrote: > > > On Mon, Jan 22, 2018 at 6:48 AM, Office Manager <officem4790@gmail.com> > wrote: > >> Hi, >> I'm trying to create a kernel module to dump the memory of a machine like >> lime <https://github.com/504ensicsLabs/LiME>. >> Right now I'm using memrw implementation to read the physical memory, my >> problem with this method is the garbage pages that return a page filled >> with 0xFF's. >> How can I create a dump containing only the physical available memory? >> >> e.g my machine has 256mb so I want a 256mb memory dump. >> > > Study the code that implements /dev/mem. It's in mem.c in the arch > dependent directory in the kernel. > > Warner >home | help
Want to link to this message? Use this
URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?CADjugXTmc0z7EXzTzzbkrGjnoZu7v1JP-aXn_7E_pw1i510dFA>