A new bare-metal x86 tool enables users to perform cold boot attacks by dumping system RAM directly to a USB drive via legacy BIOS interrupts and unreal mode.

Key Points

• The tool operates without an operating system by booting directly from a USB drive using a custom 512-byte boot sector.
• It utilizes BIOS INT 0x15 E820 to map physical memory and INT 0x13 to write 32KB chunks of RAM to the boot medium.
• Users must enable Legacy BIOS or Compatibility Support Module (CSM) settings on the target machine to execute the memory dump.
• The software requires NASM for compilation and overwrites data on the target USB drive starting at Logical Block Address (LBA) 64.
• This utility is designed for security research, specifically for extracting sensitive information like encryption keys from frozen memory modules.

Why it Matters

This tool demonstrates the persistent security risks associated with physical memory access and the vulnerability of data stored in RAM during cold boot scenarios. It serves as a practical resource for security researchers to test system defenses against hardware-level memory extraction techniques.