How to see the content of RAM memory? [closed]

You could use a kernel debugger, which would allow for "raw" memory access, like SoftICE for Windows. You can also configure GDB to act as a debugger for the Linux kernel. If a virtual machine is an option, some virtualization software supports saving the machine's state (including RAM) to disk, which can then be further analyzed. It should be noted, however, that most "modern" operating systems use address space layout randomization (ASLR). The true physical memory map of the system is purposely fragmented to help mitigate various security issues and exploits (i.e. stack/heap buffer overflows).

For a given program running in a modern operating system, however, you could obtain a logical memory map for a given process/thread - so long as you have the appropriate debugging symbols and debugger. If you want an overall view, if the software/hardware uses virtual memory, the situation becomes drastically more complex. Again though, if you literally want what's just on the RAM, see the first paragraph.


On Windows, the contents of physical memory can be accessed through the \Device\PhysicalMemory object in the Object Manager. This requires kernel-level access to the system, which means you would need to install a program, most likely a kernel-mode driver, to access this object.

On Linux, the contents of physical memory can be directly accessed as binary data by reading /dev/mem as root. See What is /dev/mem? and the mem(4) man page for more details.

I'm not sure why you need to determine where the operating system and processes are located in physical memory, though...