{"id":20935809,"url":"https://github.com/anfractuosity/ramrecovery","last_synced_at":"2025-05-13T21:30:50.909Z","repository":{"id":204203993,"uuid":"711311857","full_name":"anfractuosity/ramrecovery","owner":"anfractuosity","description":"Simple demo illustrating remanence of data in RAM (see Cold boot attack) using a Raspberry Pi.  Loads many images of the Mona Lisa into RAM and recovers after powering off/on again.","archived":false,"fork":false,"pushed_at":"2024-02-03T16:58:00.000Z","size":7597,"stargazers_count":102,"open_issues_count":0,"forks_count":2,"subscribers_count":4,"default_branch":"main","last_synced_at":"2025-04-02T08:08:33.498Z","etag":null,"topics":["cold-boot","cold-boot-attack","data-remanence","memory","pagedout","ram","raspberry-pi"],"latest_commit_sha":null,"homepage":"","language":"C","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/anfractuosity.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null}},"created_at":"2023-10-28T21:12:58.000Z","updated_at":"2025-02-15T17:44:50.000Z","dependencies_parsed_at":null,"dependency_job_id":"e144c678-0a45-4fd8-a1f6-c132f955f03c","html_url":"https://github.com/anfractuosity/ramrecovery","commit_stats":null,"previous_names":["anfractuosity/ramrecovery"],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/anfractuosity%2Framrecovery","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/anfractuosity%2Framrecovery/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/anfractuosity%2Framrecovery/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/anfractuosity%2Framrecovery/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/anfractuosity","download_url":"https://codeload.github.com/anfractuosity/ramrecovery/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":254030830,"owners_count":22002655,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["cold-boot","cold-boot-attack","data-remanence","memory","pagedout","ram","raspberry-pi"],"created_at":"2024-11-18T22:16:31.017Z","updated_at":"2025-05-13T21:30:45.872Z","avatar_url":"https://github.com/anfractuosity.png","language":"C","funding_links":[],"categories":[],"sub_categories":[],"readme":"# ramrecovery\n\nSimple demo illustrating remanence of data in RAM. See https://en.wikipedia.org/wiki/Cold_boot_attack and associated papers for much more information!  In one of the original cold boot\nattack papers \"Lest We Remember: Cold Boot Attacks on Encryption Keys\" by Halderman et al. they loaded an image of the Mona Lisa and \"cut power for varying lengths of time\".\n\n* src - Program to fill memory with the Mona Lisa\n* src-experiment - Automated experiment, uses Raspberry Pi OS to inject single image into contiguous RAM, then uses bare metal kernel to dump memory.  Makes use of modified USB hub that is controlled by relays,\nto automatically choose which USB disk to boot from. Uses Wifi plug running Tasmota turn on/off Pi.  The experiment script controls the target Pi using SSH.\n* src-memcopy - Bare metal kernel to dump memory over Raspberry Pi UART interface.\n* src-module - Linux kernel module to inject image(s) into contiguous memory\n\nAlso see my little article about this project in https://pagedout.institute/?page=issues.php Issue #3, page 14.\n\nThe following image shows the setup for dumping memory from a Raspberry Pi using the aforementioned bare metal kernel.  A USB hub was modified so that active devices could be chosen via relays (should switch to using MOSFETs sometime!), to choose between a USB disk running the bare metal kernel or Raspberry Pi OS.  The memory could then be dumped, after varying delays from the Pi via UART at 1 MBaud to another Pi.\n\n![Setup](images/setup.jpg)\n\nThe program in src, loads many images of the Mona Lisa into RAM on the Pi, running Raspberry Pi OS Lite.\n\n```\ncd src\nmake run\n```\n\nThen quickly turn off/on the power on the raspberry pi.\n\nUsing the memory forensics kernel module LiME, we can see there is still some remanence of the Mona Lisa in memory:\n\n```\ngit clone https://github.com/504ensicsLabs/LiME.git\ncd LiME/src/\nmake\n```\n\n```\nsudo insmod ./lime-$(uname -r).ko \"path=out.dump format=padded\"\n```\n\nExtract Mona Lisa images from memory dump:\n\n```\nLANG=C grep --text --byte-offset --only-matching --perl-regexp '\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x58\\x02\\x93\\x01\\x58\\x02\\x18\\x20' out.dump | LANG=C sed \"s/:.*//g\" | xargs -I {} dd if=out.dump bs=1 skip={} count=725444 of={}.tga\nmontage -border 0 -mode concatenate *.tga tiled.jpg\nconvert -resize \"3000\u003e\" tiled.jpg tiled_small.jpg\n```\n\n## Kernel module for filling contiguous RAM with Mona Lisa\n\nThe kernel module obtains contiguous RAM and fills with Mona Lisa.\n\nIn /boot/cmdline.txt, added the following to allocate 700MB of contiguous kernel RAM:\n```\ncma=700M@36M\n```\n\nAnd the following (from https://forums.raspberrypi.com/viewtopic.php?p=2132596#p2132596) to /boot/config.txt (to maximise CMA):\n\n```\n[all]\ndevice_tree_address=0x2000000\ndevice_tree_end=0x20FFFFF\n```\n\n```\ncd src-module\nmake\n```\n\nUse the following to fill contiguous RAM, with Mona.\n\n```\nsudo insmod ramrec.ko writetoram=true filename=\"mona.tga\" singleimage=false\n```\n\n## Image recovered after 0.75s delay\n\nThe following image was extracted after a 0.75s delay, without cooling through the automated experiment (see src-experiment).  I noticed the images decayed very quickly with no cooling, for example they appeared almost completely decayed around 1s.\n\n![Recovered Image](images/image_0.75.png)\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fanfractuosity%2Framrecovery","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fanfractuosity%2Framrecovery","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fanfractuosity%2Framrecovery/lists"}