MEMDUMP(8)

💖 MEMDUMP(8) — bestie edition 💖

okay so real talk, this is a page from the System Manager's Manual, section 8 (that's the admin-tools girlies 💅), and it's called memdump. Let's get into it.

---

✨ NAME ✨

memdump — the memory dumper. that's it, that's the whole name, she's simple and she knows it 🎀

---

🌸 SYNOPSIS 🌸

memdump   [-kv]  [-b  buffer_size]  [-d  dump_size]  [-m  map_file]  [-p
page_size]

heads up bestie: the synopsis up there says -d for the dump size, but the option list down below calls it -s. not me noticing that 💀 anyway, both are printed exactly as they appear, no cap.

---

🦋 DESCRIPTION 🦋

okay so this program dumps system memory to the standard output stream, and it skips over the holes in the memory maps. by default it dumps the contents of physical memory (/dev/mem). iconic behavior, honestly.

the output is a raw dump ✨ — and if you need the memory layout info too, you gotta use the -m option to capture that. like, she'll give you the raw goods, but the map? that's a separate request, periodt.

💡 big vibe tip: send the output off-host over the network, because otherwise you're changing all the memory in the file system cache and that's lowkey ruining the thing you're trying to look at 😭. use netcat, stunnel, or openssl, depending on your requirements. pick your fighter 🫶

also the size arguments down below understand the k (kilo), m (mega), and g (giga) suffixes, and suffixes are case insensitive. so 1K and 1k are the same girl, no drama 🌈

💜 Options 💜

• -k — attempt to dump kernel memory (/dev/kmem) instead of physical memory. very "I'm different" of her.

⚠️ Warning: this can lock up the system to the point that you have to use the power switch (for example, Solaris 8 on 64-bit SPARC). like, actual yank-the-plug energy 💀

⚠️ Warning: this produces bogus results on Linux 2.2 kernels. not fake news, just fake bytes 🙈

⚠️ Warning: this is very slow on 64-bit machines because the entire memory address range has to be searched. she's thorough, she's just not fast, okay?

⚠️ Warning: kernel virtual memory mappings change frequently. depending on the operating system, mappings smaller than page_size or buffer_size may be missed or may be reported incorrectly. so like... she tried 💅

• -b buffer_size (default: 0) — number of bytes per memory read operation. by default, the program uses the page_size value.

⚠️ Warning: a too large read buffer size causes memory to be missed on FreeBSD or Solaris. big buffer ≠ better, bestie 😭

• -s dump-size (default: 0) — number of memory bytes to dump. by default, the program runs until the memory device reports an end-of-file (Linux), or until it has dumped from /dev/mem as much memory as reported present by the kernel (FreeBSD, Solaris), or until pointer wrap-around happens. three whole exit strategies, main character energy 👑

⚠️ Warning: a too large value causes the program to spend a lot of time skipping over non-existent memory on Solaris systems. she's just out here scrolling, respectfully.

⚠️ Warning: a too large value causes the program to copy non-existent data on FreeBSD systems. making up data? in this economy? 🍓

• -m map_file — write the memory map to map_file, one entry per line. specify -m- to write to the standard error stream. each map entry consists of a region start address and the first address beyond that region. addresses are separated by space, and are printed as hexadecimal numbers (0xhhhh). cute little coordinates for your memory 🗺️✨
• -p page_size (default: 0) — use page_size as the memory page size. by default the program uses the system page size.

⚠️ Warning: a too large page size causes memory to be missed while skipping over holes in memory. the holes win, sorry 🕳️

• -v — enable verbose logging for debugging purposes. multiple -v options make the program more verbose. stack 'em like bracelets, she'll keep talking 💬✨

---

💀 BUGS 💀

• on many hardware platforms the firmware (boot PROM, BIOS, etc.) takes away some memory. this memory is not accessible through /dev/mem. it's gone, it's giving mysterious, we don't know her 🙈
• this program should produce output in a format that supports structure information such as ELF. (should! aspirational queen 🌟)

---

📜 LICENSE 📜

this software is distributed under the IBM Public License. read it, respect it, it's the law bestie 🫶

---

👑 AUTHOR 👑

Wietse Venema IBM T.J. Watson Research P.O. Box 704 USA

---

okay that's the whole page!! thanks for coming to my ted talk 💖✨ this was MEMDUMP(8) from the System Manager's Manual — no date on this one so I can't give you a timestamp, she's timeless like that 🎀 slay, stay safe, and pls send your dumps over the network 🦋🌈⭐