Jump to content

Sky Slate Blueberry Blackcurrant Watermelon Strawberry Orange Banana Apple Emerald Chocolate

MEMDump - Copy linear memory address space [CMD]


  • Please log in to reply
No replies to this topic
BoBo
  • Guests
  • Last active:
  • Joined: --

The MEMDump utility is designed to dump or copy any part of 4GB linear memory address space under MS-DOS and Windows 9x DOS to a console, text or binary file.
You can use MEMDump for dump contents of PCI devices memory located outside of first megabyte, access USB structures, study contents of memory used by memory managers, etc. For proper access to hardware registers, memory can be read with BYTE, WORD or Double WORD granularity. Utility provides transparent access to memory with or without installed memory managers.
Syntax:
MEMDUMP [/H|?]
[/D[B|W|D][:Address[,Length]]]
[/F]
[/B]
where:

/H - Print this text
/D[B|W|D][:Address[,Length]]
- Dump 'Length' number of memory bytes from specified
linear 'Address' as bytes (DB), words (DW) or
double words (DD) correspondingly.
/F:filename - Output file for the dump (Default: console)
Use /F:none to completely suppress dump
/B:filename - Output file for the binary contents of memory

Notes:

Both 'Address' and 'Length' can be expressed in hexadecimal format with '0x' prefix. The 'Length' field can be also expressed in decimal. Examples:
MEMDUMP /DW:0x100000,0x100000 /F:2ndMB.dmp - dump second MB to file 2ndMB.dmp
MEMDUMP /DB:0x100000,128 - dump 128 Bytes to console
MEMDUMP /D:0,0x100 /F:none /B:IntTB.bin - copy INT table to binary file IntTB.bin

If dump or binary file exists, MEMDUMP unconditionally overrides it.
If you are using WORD or DWORD access 'Length' parameter should be multiple of 2 or 4 correspondingly.
Please remember that if the memory manager (such as EMM386.EXE) is loaded, MEMDUMP will read linear address rather as physical address.

[More..]