1. modify the actual memory image.
2. Modify a log file.

Option 2 allows you to keep your initial image intact but then ’scroll’ backward/forwards through the modifications related to a particular page, any system accesses whilst running under option 2 , echoes back the content of log file to the system, as if it is actual flash content.

It is far easier with Nand-Flash because it is ‘page’ based.

With normal ram, the space is completely random and has no single defining boarder area, it makes tracking changes in realtime difficult, as you have to run at least 2 to 4 times the bus clock rate to correctly detect all the edges.

But yes….. the log files grow very quickly.

hex editors , there are a couple of ‘public domain’ source code versions available for the mac

for mapping your timeline, sometimes graphing networks are an easier way to go, as it makes spotting patterns a bit easier.

I.E system startup is T+0, then any action after that is based on the system clk rate you are monitoring (to have proper meaning you have to generate your time markers from the clock of the system under investigation.)

> But instead of showing a hex dump of a static file, it would be a two-dimensional hex dump.
> The hex dump shows space, but you can also scrub forward or backward in time, and watch
> the hex dump change

I’ve been imagining something like this for years, not specifically for hex dumps, but for a variety of other data formats. (Basically, it would be neat and often useful to watch the evolution of any document or data file — like realtime source control, and then you could build all sorts of interesting visualizations/analysis on top of that). I look forward to seeing where this goes.