It is easy to get MTRR (Memory Type Range Register)1 information on Linux through procfs, aka the /proc pseudo file system. But there is no tool to get similar information on Windows (or at least I could not find any). So I have written a command line tool called mtrr to dump MTRR information. Here is what I got when I ran it on my Vista machine –
mtrr is currently in beta and is not supported on 64-bit windows. This is partly because of driver signing requirements on 64-bit. You can download latest version of mtrr from downloads section here.
1MTRRs describe and define CPU cache behavior of memory ranges. They are typically setup by BIOS or OS
Great post. This is some really interesting stuff. On a related note, on occasion I’ve come across a similar discrepancy between Linux and Windows involving device access. Specifically, it’s happened that I start writing an email and before I’ve had a chance to hit the send button the browser crashes. If I’m using Linux I can recover all the text I’ve written directly from RAM via /dev/mem, as long as I have super user privileges. If I’m using Windows however, there’s no easy way to access memory that I know of. I’d be interested to hear if you know of an analogous method for accessing Windows memory.
There is a \Device\PhysicalMemory in Windows that gives access to physical memory. You are probably dumping all memory and searching for some text ? That is an interesting way of email recovery I must say ^_^