The MEMDump utility is designed to dump or copy any part of 4GB linear memory address space under MS-DOS and Windows 9x DOS to a console, text or binary file.
You can use MEMDump for dump contents of PCI devices memory located outside of first megabyte, access USB structures, study contents of memory used by memory managers, etc. For proper access to hardware registers, memory can be read with BYTE, WORD or Double WORD granularity. Utility provides transparent access to memory with or without installed memory managers.
/H - Print this text
- Dump 'Length' number of memory bytes from specified
linear 'Address' as bytes (DB), words (DW) or
double words (DD) correspondingly.
/F:filename - Output file for the dump (Default: console)
Use /F:none to completely suppress dump
/B:filename - Output file for the binary contents of memory
Both 'Address' and 'Length' can be expressed in hexadecimal format with '0x' prefix. The 'Length' field can be also expressed in decimal. Examples:
MEMDUMP /DW:0x100000,0x100000 /F:2ndMB.dmp - dump second MB to file 2ndMB.dmp
MEMDUMP /DB:0x100000,128 - dump 128 Bytes to console
MEMDUMP /D:0,0x100 /F:none /B:IntTB.bin - copy INT table to binary file IntTB.bin
If dump or binary file exists, MEMDUMP unconditionally overrides it.
If you are using WORD or DWORD access 'Length' parameter should be multiple of 2 or 4 correspondingly.
Please remember that if the memory manager (such as EMM386.EXE) is loaded, MEMDUMP will read linear address rather as physical address.
MEMDump - Copy linear memory address space [CMD]
No replies to this topic
#1 - Posted 20 January 2007 - 10:35 PM