LiME ~ Linux Memory Extractor
A Loadable Kernel Module (LKM) which allows for volatile memory acquisition from Linux and Linux-based devices, such as Android. This makes LiME unique as it is the first tool that allows for full memory captures on Android devices. It also minimizes its interaction between user and kernel space processes during acquisition, which allows it to produce memory captures that are more forensically sound than those of other tools designed for Linux memory acquisition.
Features
- Full Android memory acquisition
- Acquisition of a network interface
- Minimal process footprint
- Hash of dumped memory
Usage
LiME utilizes the insmod command to load the module, passing required arguments for its execution.
insmod ./lime.ko "path=<outfile | tcp:<port>> format=<raw|padded|lime> [digest=<digest>] [dio=<0|1>]"
path (required): outfile ~ name of file to write to on local system (SD Card)
tcp:port ~ network port to communicate over
format (required): padded ~ pads all non-System RAM ranges with 0s
lime ~ each range prepended with fixed-size header containing address space info
raw ~ concatenates all System RAM ranges (warning : original position of dumped memory is likely to be lost)
digest (optional): Hash the RAM and provide a .digest file with the sum.
Supports kernel version 2.6.11 and up. See below for
available digest options.
dio (optional): 1 ~ attempt to enable Direct IO
0 ~ default, do not attempt Direct IO
localhostonly (optional): 1 ~ restricts the tcp to only listen on localhost,
0 ~ binds on all interfaces (default)
timeout (optional): 1000 ~ max amount of milliseconds tolerated to read a page (default).
If a page exceeds the timeout all the memory region are skipped.
0 ~ disable the timeout so the slow region will be acquired.
This feature is only available on kernel versions >= 2.6.35.
Installation && Tutorial
Copyright (C) jtsylve
