How to get a specific memory address using C

One issue you have is that you are getting back a virtual address, not the physical address where the memory resides. Next time you boot, the mapping probably won't be the same.

This can definitly be done within a kernel module in Linux, but I don't think there is any sort of API in userspace you can use.

If you have permission ( and I assume you could be root on this machine if you are rebooting it ), then you can peek at /dev/mem to see the actual phyiscal layout. Maybe you should try sampling values, reboot, and see how many of those values persisted.


There is a similar project where a cold boot attack is demonstrated. The source code is available, maybe you can get some inspiration there.

However, AFAIR they read out the memory without loading an OS first and therefore do not have to mess with the OSs memory protection. Maybe you should try this too to avoid memory being overwritten or cleared by the OS after boot.

(Also check the video on the site, it's pretty impressive ;)