一个用于从 Linux 及基于 Linux 的设备（如 Android）获取易失性内存的可加载内核模块 (LKM)。LiME 在获取过程中会尽量减少与用户空间及内核空间进程之间的交互，从而生成比其他专为 Linux 内存获取而设计的工具更具取证可靠性的内存镜像。
有关 LiME 用法及内部原理的详细文档可在项目的“docs”目录中找到。
LiME 使用 insmod 命令加载模块，并传递其执行所需的参数。
insmod ./lime-$(uname -r).ko "path=<outfile | tcp:<port>>
format=<raw|padded|lime>
[digest=<digest>]
[dio=<0|1>]
[compress=<0|1>]
[localhostonly=<0|1>]
[timeout=<ms>]"
path (required):
outfile ~ name of file to write to on local system
tcp:port ~ network port to communicate over
format (required):
padded ~ pads all non-System RAM ranges with 0s,
starting from physical address 0
lime ~ each range prepended with fixed-size header
containing address space info
raw ~ concatenates all System RAM ranges
(warning: original position of dumped memory
is likely to be lost therefore making analysis
in most forensics tools impossible. This format
is not recommended except for advanced users)
digest (optional):
Hash the RAM and provide a sidecar file with the sum.
The sidecar filename is the output path with the
digest algorithm appended (e.g., ram.lime.sha256).
Supports kernel version 2.6.11 and up. See below for
available digest options.
Note: enabling digest increases code complexity during
acquisition and will overwrite additional memory. Only
use when integrity verification is required.
compress (optional):
1 ~ compress output with zlib
0 ~ do not compress (default)
Only available when CONFIG_ZLIB_DEFLATE is enabled
in the kernel.
Note: enabling compression allocates additional kernel
memory (~24 KB) and increases code complexity during
acquisition, disturbing more of the target system's
memory. Only use when the speed or size benefit is
required.
dio (optional):
1 ~ attempt to enable Direct IO
0 ~ do not attempt Direct IO (default)
localhostonly (optional):
1 ~ restricts tcp to only listen on localhost
0 ~ binds on all interfaces (default)
timeout (optional):
1000 ~ max milliseconds tolerated to read/write a
page (default, 1 second). If a page exceeds the timeout,
the rest of that memory range is skipped.
0 ~ disable the timeout so the slow region will
be acquired.
This feature is only available on kernels >= 2.6.35.
将内存获取到文件：
insmod ./lime-$(uname -r).ko "path=/tmp/ram.lime format=lime"
通过网络获取内存：
insmod ./lime-$(uname -r).ko "path=tcp:4444 format=lime"
然后在接收端机器上：
nc <target-ip> 4444 > ram.lime
使用 adb 加载 LiME 并通过网络获取内存：
adb push lime.ko /sdcard/lime.ko
adb forward tcp:4444 tcp:4444
adb shell
su
insmod /sdcard/lime.ko "path=tcp:4444 format=lime"
在主机上使用 netcat 捕获内存转储：
nc localhost 4444 > ram.lime
获取到 SD 卡：
insmod /sdcard/lime.ko "path=/sdcard/ram.lime format=lime"
LiME 支持内核加密库中可用的任何摘要算法。通过 TCP 转储时收集摘要文件需要建立 2 个独立的连接。
nc localhost 4444 > ram.lime
nc localhost 4444 > ram.sha1
为方便快速查阅，以下是所支持的摘要算法列表。
crc32c
md4, md5
sha1, sha224, sha256, sha384, sha512
wp512, wp384, wp256
rmd128, rmd160, rmd256, rmd320
sha3-224, sha3-256, sha3-384, sha3-512
压缩可以显著减少获取内存镜像所需的时间。与未压缩的传输相比，它可实现 4 倍的加速，而内存开销极低（约 24 KB）。
RAM 文件将采用 zlib 格式，这与 gzip 或 zip 格式不同。原因是内核内嵌的 deflate 库不支持这些格式。
你可以使用 pigz 或任何兼容 zlib 的库来解压它。
nc localhost 4444 | unpigz > ram.lime
请注意，只有 RAM 文件会被压缩。摘要文件不会被压缩，其哈希值与未压缩的数据相对应。
LiME 由 Joe Sylve 在 2012 年 Shmoocon 大会上首次发表。