/dev/mem

Giriş
Açıklaması şöyle

/dev/mem is a character device file that is an image of the main memory of the computer. It may be used, for example, to examine (and even patch) the system.

Yeni sistemlerde /dev/mem tüm belleğe erişim vemiyor. Açıklaması şöyle.

On older Linux systems, the program dd can be used to read the contents of physical memory from the device file /dev/mem. On recent Linux systems, however, /dev/mem provides access only to a restricted range of addresses, rather than the full physical memory of a system. On other systems it may not be available at all. Throughout the 2.6 series of the Linux kernel, the trend was to reduce direct access to memory via pseudo-device files. 

CONFIG_STRICT_DEVMEM 
Bu seçenek ile belli yerlere erişim verilebilir. Açıklaması şöyle.

Since Linux 2.6.26, and depending on the architecture, the CONFIG_STRICT_DEVMEM kernel configuration option limits the areas which can be accessed through this file.

Açıklaması şöyle.

/dev/mem protection Some applications (Xorg) need direct access to the physical memory from user-space. The special file /dev/mem exists to provide this access. In the past, it was possible to view and change kernel memory from this file if an attacker had root access. The CONFIG_STRICT_DEVMEM kernel option was introduced to block non-device memory access (originally named CONFIG_NONPROMISC_DEVMEM).

CONFIG_DEVMEM
Bu seçenek ile /dev/mem hiç kullanılmayabilir. Açıklaması şöyle.

/dev/mem is protected by the usual filesystem access permissions, and the CAP_SYS_RAWIO capability. iopl() and ioperm() are also restricted through the same capability.

/dev/mem can also be compiled out of the kernel altogether (CONFIG_DEVMEM).

Örnek
Şöyle yaparız.

$ head /dev/mem | hexdump -C