11

How I can access /dev/mem (or /dev/kmem, /dev/pmap) equivalent device in OSX?

As far as I know it was removed in some point.

Can I create this node manually somehow or any other way of dumping the physical memory?

See:

10

According to Accessing Kernel Memory on the x86 Version of Mac OS X, /dev/mem and /dev/kmem were removed when Apple released OS X for Intel processors.

The (excellent) article also explains how to reenable the memory devices, namely using the kmem=1 kernel boot argument.

To set it, open Terminal, type:

sudo nvram boot-args="kmem=1"

and reboot.

The article was written in May 2006, but the Mavericks 10.9.2 kernel still supports the option. After a reboot I saw these two devices:

$ ls -l /dev/*mem
crw-r----- 1 root kmem 3, 1 2014-02-28 22:09 /dev/kmem
crw-r----- 1 root kmem 3, 0 2014-02-28 22:09 /dev/mem

If your Mac won't boot or you have any issues, reset the NVRAM by pressing optionPR and holding the keys down until you hear the startup sound for the second time, as explained in "Resetting NVRAM / PRAM" in KB HT1379 About NVRAM and PRAM.

If you wish to reset the argument, type sudo nvram -d boot-args and check that nvram -p | grep boot-args does not print any results.

  • I've tried this method in macOS Sierra, but it didn't make the devices show up under /dev .. perhaps do you know if Apple closed this option, and whether there's another alternative to access this memory in 10.12 ? – Zohar81 May 16 '17 at 6:45
4

I think I got it to work on macOS Sierra! I downloaded comex's project: Kmem Project I compiled the kext, fixed the permissions and then loaded it! Using terminal I went into /dev and ls showed both mem and kmem...

Edit: If you download the project you will just need to change the compiler in Xcode to use the latest ( for example... I don't know if other versions work though... ) For quick access to results I have already made a fork of comex's project which compiles on macOS Sierra! Kmem for Sierra Fork

Again, this is comex's work, not mine, I just changed the compiler setting and uploaded it! :)

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .