Not the author, but this is an extremely simple tool that is not written with any device-specific code... it should work on most any x86-based PC device (plain BIOS or a UEFI system with CSM support enabled).
The code in the repo is trivial, that's not really what I was referring to. Getting DRAM cooled and swapped from one system to another is nontrivial, and I assumed most hardware/firmware zeroed memory on boot (to prevent being used to cold-boot-attack itself, without even needing a ln2-cooled board swap.) Those are the interesting aspects, not the code!
Zeroing memory on boot is pretty slow. Modern CPUs support encrypting the RAM with a key generated at boot and lost when the processor powers off. This would give even better security under most circumstances, without the slow boot.
Ah, I see what you mean! You are totally right, the physical execution is the truly interesting part.
To clarify, I actually didn't swap the RAM modules to another system. Moving cooled RAM is incredibly difficult and leads to rapid data decay. Instead, I left the frozen RAM exactly where it was on the original board. After the hard power-off, I just quickly swapped the system drive for my prepared drive and booted the same machine back up.
Regarding memory zeroing on boot: that is a highly relevant point. Modern systems (especially with TCG MOR enabled) try to scrub memory during POST to prevent exactly this. However, two things help here:
Fast Boot / Board Specifics: Many BIOSes, including the one on the industrial board I tested (DPX-W250), skip full memory checks and zeroing to speed up boot times.
Hard Power-Off: By cutting power abruptly, the OS doesn't get a chance to set any "clean shutdown" flags. Upon reboot, the BIOS just did a quick POST and handed control to my 16-bit bootloader via CSM, leaving the frozen memory completely intact.
P.S. I'm using AI to translate my messages because I don't speak English. Hope this explains the physics of the attack!
Sure! The testing was conducted on a specific industrial x86 board (DPX-W250 Rev. A1). I won't go into details about the exact equipment it came from, but it provided a perfect bare-metal environment for this research))))
The testing procedure was a classic physical Cold Boot Attack:
Froze the RAM modules while the target system was fully operational.
Performed a hard power-off.
Quickly swapped the original system drive with my own prepared drive containing the BareMetal-RAM-Dumper.
Powered the system back on and booted directly into the custom bootloader via Legacy BIOS.
The result: Absolutely successful. The dumper immediately took control, switched to Unreal Mode, and successfully dumped the raw physical memory directly to the disk without any OS interference or data trampling.
P.S. I'm using AI to translate my messages because I don't speak English. Hope everything is clear!