Code Monkey home page Code Monkey logo

kd8bny / lime Goto Github PK

View Code? Open in Web Editor NEW

This project forked from 504ensicslabs/lime

4.0 4.0 2.0 1.6 MB

LiME (formerly DMD) is a Loadable Kernel Module (LKM), which allows the acquisition of volatile memory from Linux and Linux-based devices, such as those powered by Android. The tool supports acquiring memory either to the file system of the device or over the network. LiME is unique in that it is the first tool that allows full memory captures from Android devices. It also minimizes its interaction between user and kernel space processes during acquisition, which allows it to produce memory captures that are more forensically sound than those of other tools designed for Linux memory acquisition.

License: GNU General Public License v2.0

Makefile 7.00% C 93.00%

lime's People

Contributors

andrewtappert avatar darx0r avatar edwardbetts avatar explodycat avatar jtsylve avatar kd8bny avatar kost avatar pagabuc avatar themaks avatar toconnor avatar vsnrain avatar

Stargazers

 avatar  avatar

Watchers

 avatar  avatar  avatar

lime's Issues

Unable to compile on RHEL 5 - duplicate of issue in 504endicsLabs/LiME repo in case it's not monitored.

Howdy. I'm hoping this is the correct repo and I shouldn't be posting this in the kd8bny repo. Please let me know if I need to move it.
I'm attempting to compile LiME and generate Volatility profiles for all the legacy systems we have in our inventory and the compile is failing. Output of the make debug is below.
First things first - I'm trying this directly on the RHEL 5.7 box.
Here's it's stats:
uname -a
Linux nmsrheli386 2.6.18-274.el5PAE #1 SMP Fri Jul 8 17:59:09 EDT 2011 i686 i686 i386 GNU/Linux


cat /etc/redhat-release
Red Hat Enterprise Linux Server release 5.7 (Tikanga)


[root@nmsrheli386 /]# cat /proc/cpuinfo
processor : 0
vendor_id : GenuineIntel
cpu family : 6
model : 158
model name : Intel(R) Core(TM) i7-9850H CPU @ 2.60GHz
stepping : 13
cpu MHz : 2592.002
cache size : 12288 KB
physical id : 0
siblings : 2
core id : 0
cpu cores : 2
apicid : 0
fdiv_bug : no
hlt_bug : no
f00f_bug : no
coma_bug : no
fpu : yes
fpu_exception : yes
cpuid level : 22
wp : yes
flags : fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush mmx fxsr sse sse2 ss ht nx pdpe1gb rdtscp lm constant_tsc nonstop_tsc arat pni ssse3 cx16 sse4_1 sse4_2 popcnt lahf_lm abm 3dnowprefetch [8]
bogomips : 5184.00

processor : 1
vendor_id : GenuineIntel
cpu family : 6
model : 158
model name : Intel(R) Core(TM) i7-9850H CPU @ 2.60GHz
stepping : 13
cpu MHz : 2592.002
cache size : 12288 KB
physical id : 0
siblings : 2
core id : 1
cpu cores : 2
apicid : 1
fdiv_bug : no
hlt_bug : no
f00f_bug : no
coma_bug : no
fpu : yes
fpu_exception : yes
cpuid level : 22
wp : yes
flags : fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush mmx fxsr sse sse2 ss ht nx pdpe1gb rdtscp lm constant_tsc nonstop_tsc arat pni ssse3 cx16 sse4_1 sse4_2 popcnt lahf_lm abm 3dnowprefetch [8]
bogomips : 5184.00


I ended up here after trying to use LiMEaide and noticing the compile was failing on the distant end, and so now I'm trying to just compile LiME.

When trying to do a make of LIME on the target directly I receive the below output:
[root@nmsrheli386 src]# make clean
rm -f .o .mod.c Module.symvers Module.markers modules.order ..o.cmd ..ko.cmd .*.o.d
rm -rf .tmp_versions
[root@nmsrheli386 src]# make debug
KCFLAGS="-DLIME_DEBUG" make CONFIG_DEBUG_SG=y -C /lib/modules/2.6.18-274.el5PAE/build M="/root/LiME-master/src" modules
make[1]: Entering directory /usr/src/kernels/2.6.18-274.el5-PAE-i686' CC [M] /root/LiME-master/src/tcp.o CC [M] /root/LiME-master/src/disk.o CC [M] /root/LiME-master/src/main.o CC [M] /root/LiME-master/src/hash.o /root/LiME-master/src/hash.c: In function ‘ldigest_update’: /root/LiME-master/src/hash.c:118: error: implicit declaration of function ‘sg_init_table’ /root/LiME-master/src/hash.c:119: error: implicit declaration of function ‘sg_set_page’ /root/LiME-master/src/hash.c:143: warning: label ‘update_fail’ defined but not used /root/LiME-master/src/hash.c:104: warning: unused variable ‘ret’ /root/LiME-master/src/hash.c: In function ‘ldigest_final’: /root/LiME-master/src/hash.c:179: warning: label ‘final_fail’ defined but not used /root/LiME-master/src/hash.c:151: warning: unused variable ‘ret’ make[2]: *** [/root/LiME-master/src/hash.o] Error 1 make[1]: *** [_module_/root/LiME-master/src] Error 2 make[1]: Leaving directory /usr/src/kernels/2.6.18-274.el5-PAE-i686'
make: *** [debug] Error 2
[root@nmsrheli386 src]#

The interesting thing is that the make error output is the same whether I'm compiling from this repo 504ensicsLabs/LiME or this repo kd8bny/LiME
With my limited google-fu those functions are related to something called scatterlist(?). I think...
So my questions are - can LiME even run on an older kernel and this version of RHEL? If so, based on the make debug output below is there something I can try as far as editing the makefile?
Any help is appreciated. I'd really like to get this working so I can then take advantage of the great LiMEaide tool. Again, I ended up here because I was running into an issue with LiMEaide where I could see the compiles weren't happening on the distant end.

*At the risk of confusing things, here's what I was originally seeing on the LiMEaide side which led me to trying to directly compile LiME

python3 limeaide.py -v -u root 192.168.146.132

.---. _______
| |.--. __ __ ___ ..... .--.\ ___ '. __.....__ | ||__|| |/ .' . .-'' '. |__| ' |--.\ \ .-'' '. | |.--.| .-. .-. ' / .-''"'-. . .--. | | \ ' / .-''"'-. . | || || | | | | |/ /________\ \ __ | | | | | '/ /________\ | | || || | | | | || | .:--.'. | | | | | || | | || || | | | | |\ .-------------'/ | \ || | | | ' .'\ .-------------' | || || | | | | | \ '-.____...---." __ | || | | |.' /' \ '-....---.
| ||||| || || . .' .'.''| ||__|/_______.'/ . .'
'---' ''-...... -' / / | |_ \_______|/ ''-...... -'
\ .
,\ '/
--' "
by kd8bny 2.0.1

LiMEaide is licensed under GPL-3.0
LiME is licensed under GPL-2.0

Establishing secure connection [email protected]
Password:
Would you like to select a pre-generated profile [y/N]
4247056384
5841556
Image will occupy approximately 4050 of 5704 MiB available
Sending LiME src to remote client
redhat-release
Red
Hat
Enterprise
Linux
Server
release
5.7
(Tikanga)
Cannot determine distribution. Please enter distribution name: 2.6.18-274.el5PAE
2.6.18-274.el5PAE
i686
Building loadable kernel module
make:


No
rule
to
make
target
symbols'. Stop. mv: cannot stat ./.limeaide_working/lime-2.6.18-274.el5PAE.ko':
No
such
file
or
directory

Detected 2.6.18-274.el5PAE 2.6.18-274.el5PAE i686
Installing LiME and retrieving RAM

path=./.limeaide_working/dump.lime
format=lime
digest=sha1
insmod:
can't
read
'./.limeaide_working/lime-2.6.18-274.el5PAE-2.6.18-274.el5PAE-i686.ko':
No
such
file
or
directory
Changing permissions
chmod:
cannot
access
`./.limeaide_working/dump.lime':
No
such
file
or
directory
Beam me up Scotty
Computing message digest of image
Traceback (most recent call last):
File "limeaide.py", line 245, in
Limeaide().main()
File "limeaide.py", line 237, in main
lime.deploy()
File "/home/sansforensics/Projects/LiMEaide-master/lib/deploy_lime.py", line 229, in deploy
self.session.check_integrity()
File "/home/sansforensics/Projects/LiMEaide-master/lib/session/session.py", line 71, in check_integrity
with open(self.client.output_dir + self.client.output, 'rb') as f:
FileNotFoundError: [Errno 2] No such file or directory: './output/192.168.146.132_2020_03_24T22_47_20/dump.lime'
root@siftworkstation -> /h/s/P/LiMEaide-master

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.