<br><div><br><div class="gmail_quote">On Tue, May 28, 2013 at 10:17 AM, jack rule <span dir="ltr"><<a href="mailto:jackrule.1985@gmail.com" target="_blank">jackrule.1985@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div dir="ltr">Hi,<div> I have to implement a dump utility which can dump the physical memory just before the crash.</div><div><br></div></div>
<br></blockquote><div>Jack --</div><div><br></div><div>Here you can find some basic of dumping physical memory - do's and dont's.</div><div><a href="http://wiki-errors.com/physical-memory-dump-and-what-to-do-about-it/">http://wiki-errors.com/physical-memory-dump-and-what-to-do-about-it/</a></div>
<div><br></div><div><br></div><div>Linux provides /dev/mem for this purpose. You can look into the fmem kernel module which provides similar information as /dev/mem and then use the internal implementation of DD to dump this information.</div>
<div><br></div><div>Since, these mechanism are used often in the forensics world... Copying Greg who can shed more lights on this. </div><div><br></div><div> </div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
_______________________________________________<br>
Kernelnewbies mailing list<br>
<a href="mailto:Kernelnewbies@kernelnewbies.org">Kernelnewbies@kernelnewbies.org</a><br>
<a href="http://lists.kernelnewbies.org/mailman/listinfo/kernelnewbies" target="_blank">http://lists.kernelnewbies.org/mailman/listinfo/kernelnewbies</a><br>
<br></blockquote></div><br><br clear="all"><div><br></div>-- <br>Regards,<br>Sandeep.<br><br><br><br><br><br> <br>“To learn is to change. Education is a process that changes the learner.”
</div>