BareMetal RAM Dumper – Bare-metal x86 tool for Cold Boot Attack experiments

A simple x86 bare-metal tool designed to boot from a disk/USB and dump the system’s RAM directly to the booting medium. It relies on BIOS interrupts to boot and perform disk operations, and enters unreal mode to access memory above the 1MB barrier.

Background: Cold Boot Attacks ❄️

This tool was originally developed and successfully tested for experimenting with Cold Boot Attacks. By freezing a laptop’s RAM (down to -60°C) and quickly rebooting from a USB drive containing this tool, it is possible to dump the frozen memory contents to the disk before the data decays, allowing for the extraction of sensitive information like encryption keys.

Features

• Custom Bootloader: Boots directly from the BIOS (Legacy CSM). No OS required.
• Unreal Mode: Switches temporarily to unreal mode to access and read 32-bit physical memory addresses.
• Memory Map parsing: Uses BIOS INT 0x15 E820 to detect valid RAM regions and avoid dumping reserved memory or memory-mapped I/O.
• Direct Disk Write: Uses BIOS INT 0x13 AH=0x43 (Extended Write) to write the memory contents directly back to the boot drive starting at LBA 64.

How it Works

1. stage1.asm is a 512-byte boot sector. It initializes segment registers, sets up the stack, and uses Extended Read (INT 0x13 AH=0x42) to load stage2 from LBA 1 into memory at 0x8000. Then it jumps to stage2.
2. stage2.asm performs the main logic:
   • Queries the BIOS for EDD (Enhanced Disk Drive) support.
   • Gets the memory map using INT 0x15 E820.
   • Calculates the maximum RAM size.
   • Loops through RAM in 32KB chunks.
   • For each chunk, it switches to unreal mode to copy data from high memory into a low memory buffer (0x90000).
   • Writes the 32KB chunk to disk using Extended Write, starting at LBA 64.
   • Prints a progress percentage on the screen.

Warning ⚠️

Advertisement

This tool writes raw data directly to the boot drive starting at Sector 64!
If you write this to a USB drive containing important data, the RAM dump will overwrite whatever is present at LBA 64 and beyond. Use a dedicated, blank USB flash drive for this purpose.

Advertisement

Building

You will need NASM installed to compile this project.

On Windows, run the provided build script:

Advertisement

On Linux, you can run:

Advertisement

Read More