MEMDump utillity

MEMDump utility is designed to dump or copy any part of 4GB linear memory address space under MS-DOS and Windows 9x DOS to a console, text or binary file. You can use MEMDump for dump contents of PCI devices memory located outside of first megabyte, access USB structures, study contents of memory used by memory managers, etc. For proper access to hardware registers, memory can be read with BYTE, WORD or Double WORD granularity. Utility provides transparent access to memory with or without installed memory managers. Syntax: MEMDUMP [/H|?] [/D[B|W|D][:Address[,Length]]] [/F:filename|none] [/B:filename] where: /H - Print this text /D[B|W|D][:Address[,Length]] - Dump 'Length' number of memory bytes from specified linear 'Address' as bytes (DB), words (DW) or double words (DD) correspondingly. /F:filename - Output file for the dump (Default: console) Use /F:none to completely suppress dump /B:filename - Output file for the binary contents of memory Notes: Both 'Address' and 'Length' can be expressed in hexadecimal format with '0x' prefix. The 'Length' field can be also expressed in decimal. Examples: MEMDUMP /DW:0x100000,0x100000 /F:2ndMB.dmp - dump second MB to file 2ndMB.dmp MEMDUMP /DB:0x100000,128 - dump 128 Bytes to console MEMDUMP /D:0,0x100 /F:none /B:IntTB.bin - copy INT table to binary file IntTB.bin If dump or binary file exists, MEMDUMP unconditionally overrides it. If you are using WORD or DWORD access 'Length' parameter should be multiple of 2 or 4 correspondingly. Please remember that if the memory manager (such as EMM386.EXE) is loaded, MEMDUMP will read linear address rather as physical address.