MacOS – Command line program to show contents of memory location

command linemacosmemory

I want to inspect memory. In Linux I can probably just browse through /dev/mem, but how to view system memory at a specific location on the Mac though?

Best Answer

Contrary to your assumption you cannot actually just browse through /dev/mem on a default Linux. A few years ago, the device was made restricted by default on Linux so that only very limited areas of memory are available this way. You can remove the restriction only by recompiling the kernel.

On macOS the device is completely restricted by default for similar security reasons. You can however enable it using a boot time parameter.

Explicitly enable this by rebooting your Mac, holding the Command and R keys to start up in Recovery Mode. Then open the Utilities menu and select Terminal. From the Terminal you need to run the following command:

sudo nvram boot-args="kmem=1"

After rebooting you'll find that you have new /dev/mem and /dev/kmem (kernel memory) device files.

You'll need to use sudo or be root to access the devices. The /dev/mem device is addressed by physical memory address, and /dev/kmem by virtual memory address.

Related Solutions

Play .ogg on command line

You can still use ogg123 through the The Ogg Vorbis CODEC tools, installed through the MacPorts Project.

MacOS – How to access /dev/mem in OSX

According to Accessing Kernel Memory on the x86 Version of Mac OS X, /dev/mem and /dev/kmem were removed when Apple released OS X for Intel processors.

The (excellent) article also explains how to reenable the memory devices, namely using the kmem=1 kernel boot argument.

Note that, as commented below by neal, in macOS 10.15 Catalina (and probably since macOS 10.12 Sierra), NVRAM settings can only be changed when your Mac is booted into recovery mode. To enter Recovery mode, power on your Mac and immediately hold ⌘-R until the logo appears, launch Terminal from the Utilities menu in the menu bar, run:

sudo nvram boot-args="kmem=1"

and reboot. You should see these two devices:

$ ls -l /dev/*mem
crw-r----- 1 root kmem 3, 1 2014-02-28 22:09 /dev/kmem
crw-r----- 1 root kmem 3, 0 2014-02-28 22:09 /dev/mem

(In previous versions of macOS like OS X Mavericks 10.9.2, you can reenable the memory devices within the operating system, so simply launch Terminal, type the command above and reboot.)

If your Mac won't boot or you have any issues, reset the NVRAM by pressing ⌘optionPR and holding the keys down until you hear the startup sound for the second time, as explained in "Resetting NVRAM / PRAM" in KB HT1379 About NVRAM and PRAM.

If you wish to reset the argument, type sudo nvram -d boot-args and check that nvram -p | grep boot-args does not print any results.

Best Answer

Related Solutions

Play .ogg on command line

MacOS – How to access /dev/mem in OSX

Related Question