Lime is a Loadable Kernel Module (LKM) which allows for volatile memory acquisition from Linux and Linux-based devices, such as Android. This makes LiME unique as it is the first tool that allows for full memory captures on Android devices. It also minimises its interaction between user and kernel space processes during acquisition, which allows it to produce memory captures that are more forensically sound than those of other tools designed for Linux memory acquisition. – Lime. Volatility framework was released at Black Hat DC for analysis of memory during forensic investigations.
Analysing memory in Linux can be carried out using Lime which is a forensic tool to dump the memory. I am actually using CentOS 6 distribution installed on a Virtual Box to acquire memory. Normally before capturing the memory, the suspicious system’s architecture should be well known. May be you would need to compile Lime on the the suspicious machine itself if you do not know the architecture. Once you compile Lime, you would have a kernel loadable object which can be injected in the Linux Kernel itself.
Linux memory dump with Lime
1. You will first need to download Lime on the suspicious machine.
git clone https://github.com/504ensicsLabs/LiME
2. Do the compilation of Lime. Once it has been compiled, you will noticed the creation of the Lime loadable kernel object.
make
3. Now the kernel object have to be loaded into the kernel. Insert the kernel module. Then, define the location and format to save the memory image.
insmod lime-2.6.32-696.23.1.el6.x86_64.ko "path=/Linux64.mem format=lime"
4. You can view if the module have been successfully loaded.
lsmod | grep -i lime
Analysis with Volatility
5. We will now analyze the memory dump using Volatility. Download it from Github.
git clone https://github.com/volatilityfoundation/volatility
6. Now, we will create a Linux profile. We will also need to download the DwarfDump package. Once it is downloaded go to Tools -> Linux directory, then create the module.dwarf file.
yum install epel-release libdwarf-tools -y && make
7. To proceed further, the System.map file is important to build the profile. The System.map file contains the locations of all the functions active in the compiled kernel. You will notice it inside the /boot directory. It is also important to corroborate the version appended with the System.map file together the version and architecture of the kernel. In the example below, the version is 2.6.32-696.23.1.el6.x86_64.
8. Now, go to the root of the Volatility directory using cd ../../ since I assumed that you are in the linux directory. Then, create a zip file as follows:
zip volatility/plugins/overlays/linux/Centos6-2632.zip tools/linux/module.dwarf /boot/System.map-2.6.32-696.23.1.el6.x86_64
9. The volatility module has now been successfully created as indicated in part 8 for the particular version of the Linux and kernel version. Time to have fun with some Python script. You can view the profile created with the following command:
python vol.py --info | grep Linux
As you can see the profile LinuxCentos6-2632 profile has been created.
10. Volatile contains plugins to view details about the memory dump performed. To view the plugins or parsers, use the following command:
python vol.py --info | grep -i linux_
11. Now imagine that you want to see the processes running at the time of the memory dump. You will have to execute the vol.py script, specify the location of the memory dump, define the profile created and call the parser concerned.
python vol.py --file=/Linux64.mem --profile=LinuxCentos6-2632x64 linux_psscan
12. Another example to recover the routing cache memory:
python vol.py --file=/Linux64.mem --profile=LinuxCentos6-2632x64 linux_route_cache
Automating Lime using LiMEaid
I find the LiMEaid tools really interesting to remote executing of Lime. “LiMEaide is a python application designed to remotely dump RAM of a Linux client and create a volatility profile for later analysis on your local host. I hope that this will simplify Linux digital forensics in a remote environment. In order to use LiMEaide all you need to do is feed a remote Linux client IP address, sit back, and consume your favorite caffeinated beverage.” – LiMEaid
Tips:
- Linux architecture is very important when dealing with Lime. This is probably the first question that one would ask.
- The kernel-headers package is a must to create the kernel loadable object.
- Once a memory dump have been created, its important to take a hash value. It can be done using the command md5sum Linux64.mem
- I would also consider to download the devel tools using yum groupinstall “Development Tools” -y
- As good practice as indicated in part 8 when creating the zip file, use the proper convention when naming the file. In my case I used the OS version and the kernel version for future references.
- Not all Parsers/Plugins will work with Volatile as same might not be compatible with the Linux system.
- You can check out the Volatile wiki for more info about the Parsers.
