13

How I can access /dev/mem (or /dev/kmem, /dev/pmap) equivalent device in OSX?

As far as I know it was removed in some point.

Can I create this node manually somehow or any other way of dumping the physical memory?

See:

Improve this question

2 Answers 2

Reset to default
12

According to Accessing Kernel Memory on the x86 Version of Mac OS X, /dev/mem and /dev/kmem were removed when Apple released OS X for Intel processors.

The (excellent) article also explains how to reenable the memory devices, namely using the kmem=1 kernel boot argument.

Note that, as commented below by neal, in macOS 10.15 Catalina (and probably since macOS 10.12 Sierra), NVRAM settings can only be changed when your Mac is booted into recovery mode. To enter Recovery mode, power on your Mac and immediately hold ⌘-R until the logo appears, launch Terminal from the Utilities menu in the menu bar, run:

sudo nvram boot-args="kmem=1"

and reboot. You should see these two devices:

$ ls -l /dev/*mem
crw-r----- 1 root kmem 3, 1 2014-02-28 22:09 /dev/kmem
crw-r----- 1 root kmem 3, 0 2014-02-28 22:09 /dev/mem

(In previous versions of macOS like OS X Mavericks 10.9.2, you can reenable the memory devices within the operating system, so simply launch Terminal, type the command above and reboot.)

If your Mac won't boot or you have any issues, reset the NVRAM by pressing ⌘optionPR and holding the keys down until you hear the startup sound for the second time, as explained in "Resetting NVRAM / PRAM" in KB HT1379 About NVRAM and PRAM.

If you wish to reset the argument, type sudo nvram -d boot-args and check that nvram -p | grep boot-args does not print any results.

Improve this answer
2
  • 1
    I've tried this method in macOS Sierra, but it didn't make the devices show up under /dev .. perhaps do you know if Apple closed this option, and whether there's another alternative to access this memory in 10.12 ?
    – Zohar81
    May 16, 2017 at 6:45
  • 1
    At some point, nvram settings could only be changed when your Mac was booted into recovery mode. So if you power on your Mac, and immediately hold Cmd-R until the logo appears, then drop to a Terminal from the Recovery installation UI and run the command, it should work. This just worked for me on OS X Catalina yesterday.
    – neal
    Dec 10, 2019 at 21:32
4

I think I got it to work on macOS Sierra! I downloaded comex's project: Kmem Project I compiled the kext, fixed the permissions and then loaded it! Using terminal I went into /dev and ls showed both mem and kmem...

Edit: If you download the project you will just need to change the compiler in Xcode to use the latest ( for example... I don't know if other versions work though... ) For quick access to results I have already made a fork of comex's project which compiles on macOS Sierra! Kmem for Sierra Fork

Again, this is comex's work, not mine, I just changed the compiler setting and uploaded it! :)

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .