reddit hackernews mail facebook facebook linkedin
Linpmem

Linpmem

The Linux memory acquisition tool.

Linpmem offers an API for reading from any physical address, including reserved memory and memory holes, but it can also be used for normal memory dumping. Furthermore, the driver offers a variety of access modes to read physical memory, such as byte, word, dword, qword, and buffer access mode, where buffer access mode is appropriate in most standard cases. If reading requires an aligned byte/word/dword/qword read, Linpmem will do precisely that.

Features:
- Read from physical address (access mode byte, word, dword, qword, or buffer)
- CR3 info service (specify target process by pid)
- Virtual to physical address translation service