snapshot of physical memory

[Allison <fireflyblue@gmail.com>]

Hi,

I am interested in getting a snapshot of the linux physical memory to
perform some offline analysis on it. I read in another post that I can
simply copy /dev/mem and it copies all physical memory contents. It
indeed gave me the same file size as the amount of physical memory
Linux recognizes.

1. Is my understanding correct ? What are the other ways one can dump
physical memory.I am interested in taking a snapshot of memory.

2. How do I make sure that no updates take place in memory from the
time I initiate the snapshot till it is done.

3. What is the best way to find out whether each page in here belongs
to kernel or process memory.. also the type of page (code,data etc)

4. What exactly happens when you copy /dev/mem to a file.

I am not an expert in this area. Detailed answers are greatly
appreciated.

thanks,
Allison
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/