{"id":3980,"date":"2015-10-06T01:26:00","date_gmt":"2015-10-05T17:26:00","guid":{"rendered":"https:\/\/www.darknet.org.uk\/?p=3980"},"modified":"2015-10-06T01:26:07","modified_gmt":"2015-10-05T17:26:07","slug":"lime-linux-memory-extractor","status":"publish","type":"post","link":"https:\/\/www.darknet.org.uk\/2015\/10\/lime-linux-memory-extractor\/","title":{"rendered":"LiME &#8211; Linux Memory Extractor"},"content":{"rendered":"<p>LiMe is a Loadable Kernel Module (LKM) Linux memory extractor which allows for volatile memory acquisition from Linux and Linux-based devices, such as Android. This makes LiME unique as it is the first tool that allows for full memory captures on Android devices. It also minimizes its interaction between user and kernel space processes during acquisition, which allows it to produce memory captures that are more forensically sound than those of other tools designed for Linux memory acquisition.<\/p>\n<p align=\"center\"><img decoding=\"async\" src=\"https:\/\/c2.staticflickr.com\/6\/5763\/21784348138_0e259994ce.jpg\" alt=\"LiME - Linux Memory Extractor\" \/><\/p>\n<h3>Features<\/h3>\n<ul>\n<li>Full Android memory acquisition<\/li>\n<li>Acquisition over network interface<\/li>\n<li>Minimal process footprint<\/li>\n<\/ul>\n<h3>Usage<\/h3>\n<p>Detailed documentation on LiME&#8217;s usage and internals can be found in the &#8220;doc&#8221; directory of the project. LiME utilizes the insmod command to load the module, passing required arguments for its execution.<\/p>\n<script async src=\"https:\/\/pagead2.googlesyndication.com\/pagead\/js\/adsbygoogle.js?client=ca-pub-3033787195489589\"\r\n     crossorigin=\"anonymous\"><\/script>\r\n<!-- Darknet Responsive Post Ad Links [previously link ad unit] -->\r\n<ins class=\"adsbygoogle\"\r\n     style=\"display:block\"\r\n     data-ad-client=\"ca-pub-3033787195489589\"\r\n     data-ad-slot=\"5456620019\"\r\n     data-ad-format=\"auto\"><\/ins>\r\n<script>\r\n     (adsbygoogle = window.adsbygoogle || []).push({});\r\n<\/script>\n<pre>insmod .\/lime.ko \"path=<outfile | tcp:<port>> format=<raw|padded|lime> [dio=<0|1>]\"\r\n\r\npath (required):   outfile ~ name of file to write to on local system (SD Card)\r\n        tcp:port ~ network port to communicate over\r\n\r\nformat (required): raw ~ concatenates all System RAM ranges\r\n        padded ~ pads all non-System RAM ranges with 0s\r\n        lime ~ each range prepended with fixed-size header containing address space info\r\n\r\ndio (optional):    1 ~ attempt to enable Direct IO\r\n        0 ~ default, do not attempt Direct IO\r\n\r\nlocalhostonly (optional):  1 restricts the tcp to only listen on localhost, 0 binds on all interfaces (default)<\/pre>\n<h3>Examples<\/h3>\n<p>In this example we use adb to load LiME and then start it with acquisition performed over the network:<\/p>\n<pre>$ adb push lime.ko \/sdcard\/lime.ko\r\n$ adb forward tcp:4444 tcp:4444\r\n$ adb shell\r\n$ su\r\n# insmod \/sdcard\/lime.ko \"path=tcp:4444 format=lime\"<\/pre>\n<p>Now on the host machine, we can establish the connection and acquire memory using netcat<\/p>\n<pre>$ nc localhost 4444 > ram.lime<\/pre>\n<p>Acquiring to sdcard<\/p>\n<pre># insmod \/sdcard\/lime.ko \"path=\/sdcard\/ram.lime format=lime\"<\/pre>\n<p>You can download LiMe v1.7.2 here:<\/p>\n<p><a href=\"https:\/\/github.com\/504ensicsLabs\/LiME\/archive\/v1.7.2.zip\">LiMe-v1.7.2.zip<\/a><\/p>\n<p>Or read more <a href=\"https:\/\/github.com\/504ensicslabs\/lime\">here<\/a>.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>LiMe is a Loadable Kernel Module (LKM) Linux memory extractor which allows for volatile memory acquisition from Linux and Linux-based devices, such as Android. This makes LiME unique as it is the first tool that allows for full memory captures on Android devices. It also minimizes its interaction between user and kernel space processes during [&hellip;]<\/p>\n","protected":false},"author":25,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_seopress_robots_primary_cat":"","_seopress_titles_title":"","_seopress_titles_desc":"LiMe is a Loadable Kernel Module (LKM) Linux memory extractor which allows for volatile memory acquisition from Linux & Linux based devices, like Android.","_seopress_robots_index":"","_genesis_hide_title":false,"_genesis_hide_breadcrumbs":false,"_genesis_hide_singular_image":false,"_genesis_hide_footer_widgets":false,"_genesis_custom_body_class":"","_genesis_custom_post_class":"","_genesis_layout":"","footnotes":""},"categories":[28,9],"tags":[8565,6068,5630],"featured_image_src":null,"featured_image_src_square":null,"author_info":{"display_name":"Darknet","author_link":"https:\/\/www.darknet.org.uk\/author\/darknet\/"},"_links":{"self":[{"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/posts\/3980"}],"collection":[{"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/users\/25"}],"replies":[{"embeddable":true,"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/comments?post=3980"}],"version-history":[{"count":0,"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/posts\/3980\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/media?parent=3980"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/categories?post=3980"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/tags?post=3980"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}