piat0n/baremetal-ram-dumper

BareMetal RAM Dumper is a small tool that boots directly from a USB drive, without any operating system, and copies the contents of a computer's memory straight to disk. It works at a very low level, talking directly to the computer's BIOS rather than relying on Windows, Linux, or macOS to do anything for it. The project was built for a specific kind of security research called a Cold Boot Attack. The idea is that if you physically cool a laptop's memory chips down to a very low temperature, the data stored in memory decays much more slowly after the power is cut. By quickly rebooting the frozen laptop from a USB drive running this tool, it becomes possible to capture the memory's contents to disk before that data fades away, which can include sensitive information like encryption keys. Under the hood, the tool is written in two stages using assembly language. The first stage is a tiny boot sector that loads a second, larger program into memory. That second stage figures out how much RAM the machine has, then copies it in small chunks from high memory into a temporary buffer, and writes each chunk out to the USB drive. The README includes a clear warning: running this tool will overwrite data on the boot drive starting partway through it, so it should only be used with a blank, dedicated USB drive set aside for this purpose. Building it requires the NASM assembler, and build scripts are provided for both Windows and Linux.