up vote 1 down vote favorite
share [g+] share [fb]

After the BIOS boots, I'd like to dump the memory of the system. I have read about how it is possible using FireWire to do this, but have found no hard instructions or tutorials about it.

link|improve this question
53% accept rate
1  
Could you do it in a virtual machine, or do you need to see the memory of a specific bare-metal machine? – coneslayer Jul 14 '10 at 19:00
feedback

migrated from serverfault.com Jul 14 '10 at 21:09

This question came from our site for system administrators and desktop support professionals.

1 Answer

up vote 0 down vote

There wont be anything in memory except the BIOS, the constructs it has created, and any option rom data.

It would be possible to write a custom boot sector, that copies everything in RAM to a disk, but I'm struggling to see the usefulness.

link|improve this answer
Wouldn't writing a custom boot sector change what is in memory? – user1596 Jul 14 '10 at 18:15
Something has to get loaded into memory in order to run on the computer... Most normal computers don't have a JTAG port to read memory contents externally. (Most JTAG ports are also somewhat slow) – Chris S Jul 14 '10 at 18:19
Firewire method works with the Windows Firewire drive being loaded (The driver improperly grants unfiltered DMA access to the firewire HBA). I wouldn't be surprised if it has been fixed in more recent versions of Windows. Here's a bit of how to get it working: storm.net.nz/projects/16 – Chris S Jul 14 '10 at 18:25
So the firewire trick only works post-Windows load? I'm trying to see what's in memory right after boot up from the BIOS, before a bootloader or OS. – user1596 Jul 14 '10 at 18:56
Correct, the Firewire exploits a security vulnerability in the Windows Firewire driver (at the same time technically altering the RAM/configuration of the machine). The only way to get an absolutely clean copy of the memory would be through a JTAG port; and those are very rare. A boot sector program that dumps memory would only "comprimise" 512 bytes of RAM and at a known location (segment 7C0). What specifically are you after? – Chris S Jul 14 '10 at 19:10
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.