Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is there any way to see the content of the RAM memory? From the first byte until the last one. I'd like to see where the OS and all the processes running on it are located in the RAM. Is this possible?

share|improve this question

closed as not constructive by Heptite, Canadian Luke, Indrek, Simon Sheehan, Randolph West Sep 9 '12 at 16:59

As it currently stands, this question is not a good fit for our Q&A format. We expect answers to be supported by facts, references, or expertise, but this question will likely solicit debate, arguments, polling, or extended discussion. If you feel that this question can be improved and possibly reopened, visit the help center for guidance.If this question can be reworded to fit the rules in the help center, please edit the question.

As a user process in a protected memory environment, you only have access to the user's copy of its virtual memory space. Kernel memory space, other users' virtual memory space, and unused physical memory are all protected from your prying eyes. On the other hand, a random in time snapshot of physical SDRAM will not mean much unless you know the virtual memory mappings. – sawdust Sep 9 '12 at 0:47
Random access memory memory? So the page allocation table? – Sep 9 '12 at 0:48
What exactly are you trying to accomplish? – bwDraco Sep 9 '12 at 0:57
You'd probably be much happier with some tool that shows how memory is allocated, vs actually looking at the 1s and 0s. – Daniel R Hicks Sep 9 '12 at 1:31
it was just out of curiosity – osta Sep 9 '12 at 3:24
up vote 6 down vote accepted

You could use a kernel debugger, which would allow for "raw" memory access, like SoftICE for Windows. You can also configure GDB to act as a debugger for the Linux kernel. If a virtual machine is an option, some virtualization software supports saving the machine's state (including RAM) to disk, which can then be further analyzed. It should be noted, however, that most "modern" operating systems use address space layout randomization (ASLR). The true physical memory map of the system is purposely fragmented to help mitigate various security issues and exploits (i.e. stack/heap buffer overflows).

For a given program running in a modern operating system, however, you could obtain a logical memory map for a given process/thread - so long as you have the appropriate debugging symbols and debugger. If you want an overall view, if the software/hardware uses virtual memory, the situation becomes drastically more complex. Again though, if you literally want what's just on the RAM, see the first paragraph.

share|improve this answer

On Windows, the contents of physical memory can be accessed through the \Device\PhysicalMemory object in the Object Manager. This requires kernel-level access to the system, which means you would need to install a program, most likely a kernel-mode driver, to access this object.

On Linux, the contents of physical memory can be directly accessed as binary data by reading /dev/mem as root. See What is /dev/mem? and the mem(4) man page for more details.

I'm not sure why you need to determine where the operating system and processes are located in physical memory, though...

share|improve this answer
On Windows, you can, in fact, open \Device\PhysicalMemory (equivalent to /dev/kmem), as RAMMap and PhysMem utilities do. – grawity Sep 9 '12 at 9:01
Not any more. As of Server 2003 and in all later versions, the \DevicePhysicalMemory object cannot be opened from user mode. RAMmap and most of the other sysinternals tools include a kernel mode driver to do that part of their work. – Jamie Hanrahan Mar 2 '15 at 5:21

Not the answer you're looking for? Browse other questions tagged .