🧊 BareMetal RAM Dumper

An x86 Bare-Metal Utility for Cold Boot Attack Research

The BareMetal RAM Dumper is a specialized x86 tool designed to boot independently from a disk or USB drive to extract the entire contents of a system's physical memory directly onto the storage medium.

---

❄️ Background: The Cold Boot Attack

This utility was engineered specifically for experiments involving Cold Boot Attacks. The core theory relies on the fact that DRAM does not lose its data immediately upon power loss, especially if the modules are cooled.

By chilling the RAM to extreme temperatures—approximately $T \approx -60^\circ\text{C}$—the rate of data decay is significantly slowed. This allows a researcher to:

1. Freeze the memory.
2. Rapidly reboot the machine using this USB tool.
3. Dump the residual memory contents to disk before the bits flip, potentially recovering encryption keys or other sensitive secrets.

---

⚙️ Technical Specifications

The tool bypasses the operating system entirely, interacting directly with the hardware via the BIOS.

Core Features

• Custom Bootloader: Operates via UEFI Legacy BIOS (CSM).
• Unreal Mode: Temporarily enters this mode to break the 1MB memory barrier, enabling access to 32-bit physical addresses.
• Memory Mapping: Utilizes INT 0x15 E820 to identify valid RAM segments, ensuring it doesn't attempt to dump reserved regions or memory-mapped I/O (MMIO).
• Direct Disk I/O: Employs INT 0x13 AH=0x43 (Extended Write) to save data starting at LBA 64.

Execution Flow

The process is split into two distinct stages:

---

⚠️ Critical Warning

[!CAUTION] DATA LOSS RISK: This tool performs raw writes to the boot medium starting at Sector 64. If you use a USB drive containing important files, the RAM dump will overwrite everything from LBA 64 onwards.

---

🛠️ Building the Project

To compile the source code, you must have NASM (Netwide Assembler) installed on your system.

Compilation Steps

• Install NASM
• Navigate to project directory
• Execute build commands

Windows Users: Simply run the provided batch file: build.bat

Linux Users: Run the following sequence in your terminal:

nasm -f bin stage1.asm -o stage1.bin
nasm -f bin stage2.asm -o stage2.bin
cat stage1.bin stage2.bin > boot.bin

---

🚀 Usage Instructions

1. Generate the Binary: Build the project to create the boot.bin file.
2. Flash to USB: Use a tool like Rufus, Win32DiskImager, or the dd command.
   • Example for Linux: sudo dd if=boot.bin of=/dev/sdX bs=512
3. Boot the Target: Insert the USB into the target PC and ensure Legacy BIOS / CSM is enabled in the boot settings.
4. Capacity Check: Ensure the USB drive's total capacity is $\ge$ the total system RAM.

---

📊 Repository Summary

• Primary Language: Assembly (94.2%)
• Secondary Language: Batchfile (5.8%)
• Purpose: Physical RAM dumping for security research.