Too slow

[oliveskur]

Why it's so slow? Copying 4 GB of RAM from 1% to 10% took 2 hours. This is too much!

[baselsayeh]

Why it's so slow? Copying 4 GB of RAM from 1% to 10% took 2 hours. This is too much!

What is the usb flash drive you are using? Is it plugged on an usb2 or newer port? (Not usb 1.1 on older laptops)?

Copying speed depend on several factors, mainly the bios & the usb flash drive used, try to use the same flash on a different laptop, see if it is also slow or not

[oliveskur]

Passware Memory Imager (based on EFI) and MSRAMDUMP (Based on SYSLINUX) did the same job in 10 minutes - I don't think the reason is USB speed. I used Lenovo V130 for testing. Lenovo X240 and X270 got write errors and never halt after dump.

[baselsayeh]

Passware Memory Imager (based on EFI) and MSRAMDUMP (Based on SYSLINUX) did the same job in 10 minutes - I don't think the reason is USB speed. I used Lenovo V130 for testing. Lenovo X240 and X270 got write errors and never halt after dump.

Are MSRAMDUMP and SYSLINUX done on the same laptop? Whats the laptop model & bios version?
Some BIOSes on some laptops do not support full bios usb Read/Write, thats why you are seeing the write error, though as far as i know, syslinux should also see the slow speeds

Unless you tinker a bit with grub4dos and get writing to work correctly, there is unfortunately nothing that you can do, but i believe you could get it to work with some grub4dos tinkering

There is also another project that does the same thing, it relies on syslinux to compress chunks of memory, then it boots a custom linux image and copies the memory to whatever you want, i made an image a while ago, see here
#1 (comment)
The project is also made to be booted on non-uefi pcs, can be used on laptops that does not support usb write and/or have broken bioses

[oliveskur]

I discovered that I was using a Lenovo Ideapad 320-14IAP instead of a Lenovo V130. The BIOS version is 5RCN36WW. Another laptop that didn't allow memory copying at all is the Lenovo X270. The BIOS package is R0IUJ44W. Alternatively I can boot with Minimal Linux Live and use AVML if BIOS doesn't support memory acquisition via BIOS and need to acquire more than 4 GB, because MSRAMDUMP is only 32-bit. I think that MSRAMDUMP is actually enough to test a coldboot attack, because it only works with old machines. DDR3 is already scrambled, but theoretically the encoding can be broken if 64 bytes of plain text are known - https://www.sciencedirect.com/science/article/pii/S1742287616300032