Messages in this thread | | | Date | Tue, 18 Jul 2006 12:16:16 -0400 | From | Allison <> | Subject | snapshot of physical memory |
| |
Hi,
I am interested in getting a snapshot of the linux physical memory to perform some offline analysis on it. I read in another post that I can simply copy /dev/mem and it copies all physical memory contents. It indeed gave me the same file size as the amount of physical memory Linux recognizes.
1. Is my understanding correct ? What are the other ways one can dump physical memory.I am interested in taking a snapshot of memory.
2. How do I make sure that no updates take place in memory from the time I initiate the snapshot till it is done.
3. What is the best way to find out whether each page in here belongs to kernel or process memory.. also the type of page (code,data etc)
4. What exactly happens when you copy /dev/mem to a file.
I am not an expert in this area. Detailed answers are greatly appreciated.
thanks, Allison - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
| |