How to do a memory dump in Bochs?

Question

How do you do a memory dump in Bochs?

(Either physical or virtual -- but both would be even better!)

Answer 1

I know this question has already been a while, but I had the same problem and I could solve.

GUI Debug

Bochs accompanies a visual debugger that can be activated with the following flags in

./configure \
--enable-x86-debugger \
--enable-debugger \
--enable-debugger-gui

when you will build it, and add this option in your Bochs configuration file:

display_library: x, options = "gui_debug"

With the gui debugger open, you can at any time press the "break" button and in the View menu, you have the "Physical MemDump" and "Linear MemDump" options, just enter the start address and bochs will dump 4kB for you.

Without GUI Debug

If you prefer, you can also use the text mode, the breakpoint can be set with the command "lbreak addr" (for linear) or "pbreak addr" (physical), to list the configured breakpoints just type "info break" and to delete them "d number". Single step (s) and to continue execution (continue).

With the execution paused, you can dump with the "x" (linear) and "xp" (physical) followed by some optional parameters such as the output format, number of bytes, and the address, for example.

Example:

x /30bx 0xC0000000

will make 30 bytes dump in hexadecimal format from the linear address 0xC0000000.

Writing in the file

In some cases, the dump can be large enough to be read on the screen. In these cases you can do it to a file using the command "writemem".

Its syntax is:

writemem "filename" linearAddress lenght_in_bytes

so if you need to dump the first 1024 bytes of the linear address 0xdeadbeef to the "dump" file, something like:

writemem "dump" 0xdeadbeef 1024

should work.

Please refer to http://bochs.sourceforge.net/doc/docbook/user/internal-debugger.html for more information.

Answer 2

Perhaps you're looking for Save and restore simulation:

The state of cpu(s), memory and all devices can be saved now. When running Bochs with there will be a button in the header bar called "Suspend".

(emphasis added)

Answer 3

Try memsave and pmemsave commands in the Bochs console.

‘memsave addr size file’

save to disk virtual memory dump starting at addr of size size.

‘pmemsave addr size file’

save to disk physical memory dump starting at addr of size size.

Answer 4

Apparently there is writemem

    writemem                     dump a number of bytes of virtual memory starting from
                                 the specified linear address into a file

But it doesn't seem to work.