{"id":13599145,"url":"https://github.com/504ensicsLabs/LiME","last_synced_at":"2025-04-10T12:31:30.771Z","repository":{"id":21079767,"uuid":"24379459","full_name":"504ensicsLabs/LiME","owner":"504ensicsLabs","description":"LiME (formerly DMD) is a Loadable Kernel Module (LKM), which allows the acquisition of volatile memory from Linux and Linux-based devices, such as those powered by Android. The tool supports acquiring memory either to the file system of the device or over the network. LiME is unique in that it is the first tool that allows full memory captures from Android devices. It also minimizes its interaction between user and kernel space processes during acquisition, which allows it to produce memory captures that are more forensically sound than those of other tools designed for Linux memory acquisition.","archived":true,"fork":false,"pushed_at":"2024-05-06T14:07:47.000Z","size":1651,"stargazers_count":1644,"open_issues_count":33,"forks_count":330,"subscribers_count":81,"default_branch":"master","last_synced_at":"2024-05-21T13:48:29.482Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"C","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"gpl-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/504ensicsLabs.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2014-09-23T16:23:46.000Z","updated_at":"2024-06-10T17:43:07.896Z","dependencies_parsed_at":"2023-01-11T21:04:45.186Z","dependency_job_id":"5ee7da85-2d17-4472-8524-f9ab4762f079","html_url":"https://github.com/504ensicsLabs/LiME","commit_stats":{"total_commits":70,"total_committers":23,"mean_commits":"3.0434782608695654","dds":0.7428571428571429,"last_synced_commit":"740b2e7bbfbcb041dc89cda2bf2c10b636015f31"},"previous_names":[],"tags_count":17,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/504ensicsLabs%2FLiME","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/504ensicsLabs%2FLiME/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/504ensicsLabs%2FLiME/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/504ensicsLabs%2FLiME/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/504ensicsLabs","download_url":"https://codeload.github.com/504ensicsLabs/LiME/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":248217130,"owners_count":21066633,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-08-01T17:01:00.211Z","updated_at":"2025-04-10T12:31:30.124Z","avatar_url":"https://github.com/504ensicsLabs.png","language":"C","funding_links":[],"categories":["IR Tools Collection","Tools","Challenges","Other Lists","IR tools Collection","Dynamic Analysis","Tool","Memory Forensics"],"sub_categories":["Memory Analysis Tools","Acquisition","🛡️ DFIR:","Memory Acquisition"],"readme":"# Project Archived\n\nThis project is no longer being actively maintained.  If you are interested in maintaining it, please reach out to joe.sylve@gmail.com.  I would like to thank Daryl Bennett for his years of work in taking over maintenance of this project.\n\n# LiME ~ Linux Memory Extractor\nA Loadable Kernel Module (LKM) which allows for volatile memory acquisition from Linux and Linux-based devices, such as Android. This makes LiME unique as it is the first tool that allows for full memory captures on Android devices. It also minimizes its interaction between user and kernel space processes during acquisition, which allows it to produce memory captures that are more forensically sound than those of other tools designed for Linux memory acquisition.\n\n## Table of Contents\n * [Features](#features)\n * [Usage](#usage)\n  * [Examples](#example)\n * [Presentation](#present)\n \n## Features \u003ca name=\"features\"/\u003e\n* Full Android memory acquisition\n* Acquisition over network interface\n* Minimal process footprint\n* Hash of dumped memory\n\n## Usage \u003ca name=\"usage\"/\u003e\nDetailed documentation on LiME's usage and internals can be found in the \"doc\" directory of the project.\n\nLiME utilizes the insmod command to load the module, passing required arguments for its execution.\n```\ninsmod ./lime.ko \"path=\u003coutfile | tcp:\u003cport\u003e\u003e format=\u003craw|padded|lime\u003e [digest=\u003cdigest\u003e] [dio=\u003c0|1\u003e]\"\n\npath (required):     outfile ~ name of file to write to on local system (SD Card)\n                     tcp:port ~ network port to communicate over\n        \nformat (required):   padded ~ pads all non-System RAM ranges with 0s\n                     lime ~ each range prepended with fixed-size header containing address space info\n                     raw ~ concatenates all System RAM ranges (warning : original position of dumped memory is likely to be lost therefore making analysis in most forensics tools impossible. This format is not recommended except for advanced users)\n\ndigest (optional):   Hash the RAM and provide a .digest file with the sum.\n                     Supports kernel version 2.6.11 and up. See below for\n                     available digest options.\n\ncompress (optional): 1 ~ compress output with zlib\n                     0 ~ do not compress (default)\n\ndio (optional):      1 ~ attempt to enable Direct IO\n                     0 ~ do not attempt Direct IO (default)\n        \nlocalhostonly (optional):  1 ~ restricts the tcp to only listen on localhost,\n                           0 ~ binds on all interfaces (default)\n\ntimeout (optional): 1000 ~ max amount of milliseconds tolerated to read a page (default).\n                           If a page exceeds the timeout all the memory region are skipped.\n                       0 ~ disable the timeout so the slow region will be acquired.\n\n                           This feature is only available on kernel versions \u003e= 2.6.35. \n\n```\n\n## Examples \u003ca name=\"example\"/\u003e\nIn this example we use adb to load LiME and then start it with acquisition performed over the network\n```\n$ adb push lime.ko /sdcard/lime.ko\n$ adb forward tcp:4444 tcp:4444\n$ adb shell\n$ su\n# insmod /sdcard/lime.ko \"path=tcp:4444 format=lime\"\n```\n\nNow on the host machine, we can establish the connection and acquire memory using netcat\n```\n$ nc localhost 4444 \u003e ram.lime\n```\n\nAcquiring to sdcard\n```\n# insmod /sdcard/lime.ko \"path=/sdcard/ram.lime format=lime\"\n```\n\n## Available Digests\nReally LiME will support any digest algorithm that the kernel library can.\nCollecting a digest file when dumping over tcp will require 2 separate connections.\n```\n$ nc localhost 4444 \u003e ram.lime\n$ nc localhost 4444 \u003e ram.sha1\n```\nFor a quick reference here is a list of supported digests.\n### All kernel versions\n```\ncrc32c\nmd4, md5\nsha1, sha224, sha256, sha384, sha512\nwp512, wp384, wp256\n```\n### 4.10 and up\n```\nsha3-224, sha3-256, sha3-384, sha3-512\n```\n### 3.0 and up\n```\nrmd128, rmd160, rmd256, rmd320\n```\n\n## Compression\n\nCompression can reduce significantly the time required to acquire a memory capture. It can achieve the speedup of 4x over uncompressed transfers with a few memory overhead (~ 24 KB).\n\nThe RAM file will be in the zlib format, which is different from the gzip or zip formats. The reason is that the deflate library embedded in the kernel do not support them.\n\nTo decompress it you can use [pigz](https://zlib.net/pigz/) or any zlib-compatible library.\n\n```\n$ nc localhost 4444 | unpigz \u003e ram.lime\n```\n\nNote that only the RAM file is compressed. The digest file is not compressed, and the hash value will match the uncompressed data.\n\n## Presentation \u003ca name=\"present\"/\u003e\nLiME was first presented at Shmoocon 2012 by Joe Sylve.  \nYoutube~ \u003ca href=\"https://www.youtube.com/watch?v=oWkOyphlmM8\"\u003eAndroid Mind Reading: Memory Acquisition and Analysis with DMD and Volatility\u003c/a\u003e\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2F504ensicsLabs%2FLiME","html_url":"https://awesome.ecosyste.ms/projects/github.com%2F504ensicsLabs%2FLiME","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2F504ensicsLabs%2FLiME/lists"}