Forensicsmemorydumpforensicssecuritykernel

memdump

Utility to dump memory contents to standard output, skipping over holes in memory maps. By default, dumps physical memory contents.

Description

memdump is a program which dumps system memory to the standard output stream. It skips over holes in memory maps and is useful in security tests and forensics investigations.

This tool will not work if CONFIG_STRICT_DEVMEM is enabled in the kernel, which several kernels enable by default since version 2.6. It provides options to control buffer size, target kernel or physical memory, memory mapping, page size, dump size, and verbose output for debugging.

memdump supports dumping either physical memory (default) or kernel memory, with customizable parameters for size and buffering.

How It Works

memdump reads system memory contents, skipping holes in memory maps, and outputs to standard output. It uses system page size by default for reading and dumping but allows specification of read buffer size, memory page size, and total dump size. The -k option switches from physical memory to kernel memory. The -m option prints the memory map without dumping contents. Verbose mode aids debugging.

Installation

bash
sudo apt install memdump

Flags

-b read_buffer_size(default 0, use the system page size)
-k(dump kernel memory instead of physical memory)
-m map_file(print memory map)
-p memory_page_size(default 0, use the system page size)
-s memory_dump-size(default 0, dump all memory)
-v(verbose mode for debugging)

Examples

Dumps all physical memory contents to standard output using default system page size
memdump
Dumps kernel memory instead of physical memory
memdump -k
Prints the memory map to map_file without dumping contents
memdump -m map_file
Runs in verbose mode for debugging while dumping memory
memdump -v
Dumps first 1MB (1048576 bytes) of physical memory
memdump -s 1048576
Dumps memory using 4KB read buffer size and 4KB memory page size
memdump -b 4096 -p 4096
Dumps kernel memory in verbose debugging mode
memdump -k -v
Updated 2026-04-16kali.org ↗