: I was wondering how to read and analyse the memory files /dev/kmem and
: /dev/mem... I have read several articles that suggest writing programs to
: analyse these files, but it gives no indication as to how... any
: assistance would be greatly appreciated and i apologise in advance if
: this question is too basic or otherwise inappropriate for this newsgroup..
% man mem
mem(7D) -------------------- Devices --------------------- mem(7D)
mem, kmem - physical or virtual memory
The file /dev/mem is a special file that is an image of the
physical memory of the computer. The file /dev/kmem is a
special file that is an image of the kernel virtual memory
of the computer. Either may be used, for example, to exam-
ine, and even patch the system.
Byte addresses in /dev/mem are interpreted as physical
memory addresses. Byte addresses in /dev/kmem are inter-
preted as kernel virtual memory addresses. References to
non-existent locations cause errors to be returned (see
The file /dev/kmem accesses up to 4GB of kernel virtual
memory. The file /dev/mem accesses physical memory; the
size of the file is equal to the amount of physical memory
in the computer. This can be larger than 4GB; in which
case, memory beyond 4GB can be accessed using a series of
read(2) and write(2) commands or a combination of llseek(2)
and read(2) and write(2).
EFAULT Bad address. This error can occur when try-
ing to: write(2) a read-only location,
read(2) a write-only location, or read(2) or
write(2) a non-existent or unimplemented
ENXIO This error results from attempting to mmap(2)
a non-existent physical (mem) or virtual
(kmem) memory address.
/dev/mem File containing image of physical memory of
/dev/kmem File containing image of kernel virtual
memory of computer.
llseek(2), mmap(2), read(2), write(2)
Some of /dev/kmem cannot be read because of write-only
addresses or unequipped memory addresses.
-- SunOS 5.5.1 ----------------------- Last change: 18 Mar 1994 --
It's not a bug. It's a feature!