5

I want to inspect memory. In Linux I can probably just browse through /dev/mem, but how to view system memory at a specific location on the Mac though?

  • 4
    What problem are you really trying to solve? – lhf Feb 10 at 23:46
10

Contrary to your assumption you cannot actually just browse through /dev/mem on a default Linux. A few years ago, the device was made restricted by default on Linux so that only very limited areas of memory are available this way. You can remove the restriction only by recompiling the kernel.

On macOS the device is completely restricted by default for similar security reasons. You can however enable it using a boot time parameter.

Explicitly enable this by rebooting your Mac, holding the Command and R keys to start up in Recovery Mode. Then open the Utilities menu and select Terminal. From the Terminal you need to run the following command:

sudo nvram boot-args="kmem=1"

After rebooting you'll find that you have new /dev/mem and /dev/kmem (kernel memory) device files.

You'll need to use sudo or be root to access the devices. The /dev/mem device is addressed by physical memory address, and /dev/kmem by virtual memory address.

| improve this answer | |

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .