How to see the content of RAM memory?

Question

Is there any way to see the content of the RAM memory? From the first byte until the last one. I'd like to see where the OS and all the processes running on it are located in the RAM. Is this possible?

Solution 1

You could use a kernel debugger, which would allow for "raw" memory access, like SoftICE for Windows. You can also configure GDB to act as a debugger for the Linux kernel. If a virtual machine is an option, some virtualization software supports saving the machine's state (including RAM) to disk, which can then be further analyzed. It should be noted, however, that most "modern" operating systems use address space layout randomization (ASLR). The true physical memory map of the system is purposely fragmented to help mitigate various security issues and exploits (i.e. stack/heap buffer overflows).

For a given program running in a modern operating system, however, you could obtain a logical memory map for a given process/thread - so long as you have the appropriate debugging symbols and debugger. If you want an overall view, if the software/hardware uses virtual memory, the situation becomes drastically more complex. Again though, if you literally want what's just on the RAM, see the first paragraph.

Solution 2

On Windows, the contents of physical memory can be accessed through the \Device\PhysicalMemory object in the Object Manager. This requires kernel-level access to the system, which means you would need to install a program, most likely a kernel-mode driver, to access this object.

On Linux, the contents of physical memory can be directly accessed as binary data by reading /dev/mem as root. See What is /dev/mem? and the mem(4) man page for more details.

I'm not sure why you need to determine where the operating system and processes are located in physical memory, though...

Comments

[user1686]

On Windows, you can, in fact, open \Device\PhysicalMemory (equivalent to /dev/kmem), as RAMMap and PhysMem utilities do.

[Jamie Hanrahan]

Not any more. As of Server 2003 and in all later versions, the \DevicePhysicalMemory object cannot be opened from user mode. RAMmap and most of the other sysinternals tools include a kernel mode driver to do that part of their work.