Home / Unlabelled / LiME - Linux Memory Extractor

LiME - Linux Memory Extractor

LiME - Linux Memory Extractor

LiME (formerly DMD) is a Loadable Kernel Module (LKM), which allows the acquisition of volatile memory from Linux and Linux-based devices, such as those powered by Android. This makes LiME unique as it is the first tool that allows for full memory captures on Android devices. 

It also minimizes its interaction between user and kernel space processes during acquisition, which allows it to produce memory captures that are more forensically sound than those of other tools designed for Linux memory acquisition.

Features:

  • Full Android memory acquisition
  • Acquisition over network interface
  • Minimal process footprint

Usage:

LiME utilizes the insmod command to load the module, passing required arguments for its execution.
insmod ./lime.ko "path=<outfile | tcp:<port>> format=<raw|padded|lime> [dio=<0|1>]"
 
 path (required):   outfile ~ name of file to write to on local system (SD Card)
                    tcp:port ~ network port to communicate over
         
 format (required): padded ~ pads all non-System RAM ranges with 0s
                    lime ~ each range prepended with fixed-size header containing 
                           address space info
                    raw ~ concatenates all System RAM ranges 
                          (warning: original position of dumped memory is 
                          likely to be lost)
         
 dio (optional):    1 ~ attempt to enable Direct IO
                    0 ~ default, do not attempt Direct IO
         
 localhostonly (optional):  1 ~ restricts the tcp to only listen on localhost,
                            0 ~ binds on all interfaces (default)
 
 timeout (optional): 1000 ~ max amount of milliseconds tolerated to read a page (default).
                            If a page exceeds the timeout all the memory region 
                            are skipped.
                        0 ~ disable the timeout so the slow region will be acquired.
 
                            This feature is only available on kernel versions >= 2.6.35.

Examples:

In this example we use adb to load LiME and then start it with acquisition performed over the network
$ adb push lime.ko /sdcard/lime.ko
 $ adb forward tcp:4444 tcp:4444
 $ adb shell
 $ su
 # insmod /sdcard/lime.ko "path=tcp:4444 format=lime"

Now on the host machine, we can establish the connection and acquire memory using netcat
$ nc localhost 4444 > ram.lime

Acquiring to sdcard
# insmod /sdcard/lime.ko "path=/sdcard/ram.lime format=lime"



Download LiME


Source: www.effecthacking.com
LiME - Linux Memory Extractor LiME - Linux Memory Extractor Reviewed by Anonymous on 6:48 AM Rating: 5

Tags