I am using the latest Ubuntu Linux with a custom kernel (4.2.0-36-generic), in which I have disabled the CONFIG_STRICT_DEVNEM, because I need to dump and search some terms in memory during a project.However, when using:dd if=/dev/mem to print it on screen,dd if=/dev/mem of=/home/user/Documents/file.dump to save it as a file, ordd if=/dev/mem | hexdump -C | grep 'term' to directly find what I'm looking for,the system freezes and reboots while in the process.I have checked with df -h and my disc has plenty of free space. Also, the process always stops after writing a 2.1Gb to 2.5Gb, out of a 8Gb RAM and before reaching addresses that start with 4 (if these make any difference). In addition, checking /var/log/syslog and /var/log/kern.log shows nothing relevant before the freezing.Also, using parameters bs=1G count=2 successfully copies the first 2GB of the memory but then trying bs=1G count=2 skip=2 to get then next 2GB again freezes the system.Would you suggest any solution so it is possible to dump the full memory or some other way to directly search terms in memory?
Accessing /dev/mem freezes Ubuntu
linux;memory;freeze;forensics
I think you may run into some memory area used by PCI/ACPI or some such hardware. There might be a memory mapped device that doesn't like being accessed. I can't tell what address exactly causes the problem, but it's usual for some special areas to be located just under the 4 GB limit.On one machine with 4 GB memory, the kernel prints the following on boot:BIOS-e820: 0000000000000000 - 000000000009e400 (usable)BIOS-e820: 000000000009e400 - 00000000000a0000 (reserved)BIOS-e820: 00000000000f0000 - 0000000000100000 (reserved)BIOS-e820: 0000000000100000 - 00000000cf690000 (usable)BIOS-e820: 00000000cf690000 - 00000000cf6e0000 (reserved)BIOS-e820: 00000000cf6e0000 - 00000000cf6e3000 (ACPI NVS)BIOS-e820: 00000000cf6e3000 - 00000000cf6f0000 (ACPI data)BIOS-e820: 00000000cf6f0000 - 00000000cf700000 (reserved)BIOS-e820: 00000000e0000000 - 00000000f0000000 (reserved)BIOS-e820: 00000000fec00000 - 0000000100000000 (reserved)BIOS-e820: 0000000100000000 - 0000000130000000 (usable)Part of the usable memory is above the 4 GB limit at 0x100000000 and there seems to be holes between 0xcf700000 and 0xfec00000.The areas corresponding to usable memory are also shown in /proc/iomem, marked as System RAM. (the file also contains information about the other memory areas.) You might be safer just reading from those areas. $ grep System RAM /proc/iomem 00001000-0009e3ff : System RAM00100000-cf68ffff : System RAM100000000-12fffffff : System RAM