pIat0n GitHub avatar

BareMetal-RAM-Dumper

pIat0n

A bare-metal x86 tool that boots from a USB drive and dumps system RAM directly to disk for cold boot attack experiments.

Stars

101

7-day growth

No data

Forks

6

Open issues

0

License

AGPL-3.0

Last updated

2026-07-16

AI repository intelligence
FR-AI / ANALYSIS

Why it is worth attention

It demonstrates a complete low-level implementation using BIOS interrupts, unreal mode, and direct disk writes without an operating system, enabling physical memory extraction under cold boot conditions.

Who it is for

  • Security researchers exploring cold boot attacks
  • Digital forensics professionals
  • Low-level systems programmers
  • Hobbyists interested in BIOS and x86 assembly

Use cases

  • Recovering encryption keys from frozen RAM
  • Experimenting with cold boot attack techniques
  • Performing physical memory forensics on legacy BIOS systems
  • Learning about unreal mode and BIOS disk I/O

Strengths

  • Custom bootloader works on legacy BIOS without an OS
  • Uses memory map (INT 0x15 E820) to avoid reserved regions
  • Employs unreal mode to access memory above 1MB
  • Displays progress percentage during the dump

Considerations

  • Requires Legacy BIOS / CSM boot (not UEFI)
  • Overwrites disk data starting at LBA 64, so a dedicated blank USB drive is needed
  • Limited to x86 architecture and assumes cold boot conditions for data retention

README quick start

Usage

  1. Build the project to generate boot.bin.

Description

A bare-metal x86 utility to dump physical RAM directly to disk. Built and tested for Cold Boot Attack experiments on frozen memory.

Related repositories

Similar projects matched by category, topics, and programming language.

wallneradam
wallneradam GitHub avatar

dolffydos

Dolffy DOS is a drop-in KERNAL ROM replacement for the Commodore 64 that combines DolphinDOS parallel speed and a clean-room JiffyDOS serial fast loader, with optional Ultimate SoftwareIEC DMA and clock features.

Assembly
26