What is the difference between /dev/mem, /dev/kmem and /proc/kcore?

Question

What is the difference between /dev/mem, /dev/kmem and /proc/kcore?

Can I disassemble its contents using tools like objdump and gdb?

Answer 1

/dev/kmem gives access to the kernel's virtual memory space, and /dev/mem gives access to physical memory.

/proc/kcore is a pseudofile in ELF core format, of the kernel's virtual memory space. You should be able to examine it with standard ELF utilities, like objdump and gdb - although you will likely better off to make a regular file copy of it and work on that.