Kernel/Physical Memory Dumper

read_kmem.c

#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <fcntl.h>

/**
Author: 
	Robert Metzger [email protected]
build: 
	clang -m32 read_kmem.c -o read
*/

int main( int argc, char **argv ) {
	if(argc < 3) {
		printf("Usage: read (/dev/kmem|/dev/mem) <hex address>\n");
		return 1;
	}
	int fd= open(argv[1], O_RDONLY);
	int address;
	sscanf(argv[2], "%x", &address);
	printf("Reading from address %p (input was %s)\n",(void*)address, argv[2]);
	printf("absolute  |relative:content\n");
	lseek(fd, address, O_RDONLY);
	char buf[256];
	read(fd, buf, 256);
	int i;
	for(i = 0; i < 64; ++i) {
		printf("%8p|%8p:0x%x\n",address+(i*4),i*4, *(buf+i));
	}
}