Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

After the BIOS boots, I'd like to dump the memory of the system. I have read about how it is possible using FireWire to do this, but have found no hard instructions or tutorials about it.

share|improve this question

migrated from serverfault.com Jul 14 '10 at 21:09

This question came from our site for professional system and network administrators.

1  
Could you do it in a virtual machine, or do you need to see the memory of a specific bare-metal machine? –  coneslayer Jul 14 '10 at 19:00
add comment

1 Answer

There wont be anything in memory except the BIOS, the constructs it has created, and any option rom data.

It would be possible to write a custom boot sector, that copies everything in RAM to a disk, but I'm struggling to see the usefulness.

share|improve this answer
    
Wouldn't writing a custom boot sector change what is in memory? –  user1596 Jul 14 '10 at 18:15
    
Something has to get loaded into memory in order to run on the computer... Most normal computers don't have a JTAG port to read memory contents externally. (Most JTAG ports are also somewhat slow) –  Chris S Jul 14 '10 at 18:19
    
Firewire method works with the Windows Firewire drive being loaded (The driver improperly grants unfiltered DMA access to the firewire HBA). I wouldn't be surprised if it has been fixed in more recent versions of Windows. Here's a bit of how to get it working: storm.net.nz/projects/16 –  Chris S Jul 14 '10 at 18:25
    
So the firewire trick only works post-Windows load? I'm trying to see what's in memory right after boot up from the BIOS, before a bootloader or OS. –  user1596 Jul 14 '10 at 18:56
    
Correct, the Firewire exploits a security vulnerability in the Windows Firewire driver (at the same time technically altering the RAM/configuration of the machine). The only way to get an absolutely clean copy of the memory would be through a JTAG port; and those are very rare. A boot sector program that dumps memory would only "comprimise" 512 bytes of RAM and at a known location (segment 7C0). What specifically are you after? –  Chris S Jul 14 '10 at 19:10
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.