---
name: "memdump"
section: "8"
platform: "linux"
package: "memdump"
version: "1.01-9"
release: "Debian 13 (Trixie)"
platforms: ["linux"]
url: "https://new.carta.tech/memdump/8"
---

# memdump(8)

memory dumper

## NAME

memdump - memory dumper

## SYNOPSIS

```

```

**memdump** \[**-kv**\] \[**-b** *buffer\_size*\] \[**-d** *dump\_size*\] \[**-m** *map\_file*\] \[**-p** *page\_size*\]

## DESCRIPTION

This program dumps system memory to the standard output stream, skipping over holes in memory maps. By default, the program dumps the contents of physical memory (**/dev/mem**).

Output is in the form of a raw dump; if necessary, use the **-m** option to capture memory layout information.

Output should be sent off-host over the network, to avoid changing all the memory in the file system cache. Use netcat, stunnel, or openssl, depending on your requirements.

The size arguments below understand the **k** (kilo) **m** (mega) and **g** (giga) suffixes. Suffixes are case insensitive.

Options

- **-k**

  Attempt to dump kernel memory (**/dev/kmem**) rather than physical memory.

  Warning: this can lock up the system to the point that you have to use the power switch (for example, Solaris 8 on 64-bit SPARC).

  Warning: this produces bogus results on Linux 2.2 kernels.

  Warning: this is very slow on 64-bit machines because the entire memory address range has to be searched.

  Warning: kernel virtual memory mappings change frequently. Depending on the operating system, mappings smaller than *page\_size* or *buffer\_size* may be missed or may be reported incorrectly.

- **-b** *buffer\_size* (default: 0)

  Number of bytes per memory read operation. By default, the program uses the *page\_size* value.

  Warning: a too large read buffer size causes memory to be missed on FreeBSD or Solaris.

- **-s** *dump-size* (default: 0)

  Number of memory bytes to dump. By default, the program runs until the memory device reports an end-of-file (Linux), or until it has dumped from **/dev/mem** as much memory as reported present by the kernel (FreeBSD, Solaris), or until pointer wrap-around happens.

  Warning: a too large value causes the program to spend a lot of time skipping over non-existent memory on Solaris systems.

  Warning: a too large value causes the program to copy non-existent data on FreeBSD systems.

- **-m** *map\_file*

  Write the memory map to *map\_file*, one entry per line. Specify **-m-** to write to the standard error stream. Each map entry consists of a region start address and the first address beyond that region. Addresses are separated by space, and are printed as hexadecimal numbers (0xhhhh).

- **-p** *page\_size* (default: 0)

  Use *page\_size* as the memory page size. By default the program uses the system page size.

  Warning: a too large page size causes memory to be missed while skipping over holes in memory.

- **-v**

  Enable verbose logging for debugging purposes. Multiple **-v** options make the program more verbose.

## BUGS

On many hardware platforms the firmware (boot PROM, BIOS, etc.) takes away some memory. This memory is not accessible through **/dev/mem**.

This program should produce output in a format that supports structure information such as ELF.

## LICENSE

```
This software is distributed under the IBM Public License.
```

## AUTHOR

```
Wietse Venema
IBM T.J. Watson Research
P.O. Box 704
USA
```