Skip to content
LiME (formerly DMD) is a Loadable Kernel Module (LKM), which allows the acquisition of volatile memory from Linux and Linux-based devices, such as those powered by Android. The tool supports acquiring memory either to the file system of the device or over the network. LiME is unique in that it is the first tool that allows full memory captures f…
C Makefile
Branch: master
Clone or download
kd8bny Add symbol option to Makefile
This option allows one to build LiME without stripping symbols.
When using Volatility you can use dwarf on LiME to build the needed
Latest commit 9bd146a Jan 15, 2019
Type Name Latest commit message Commit time
Failed to load latest commit information.
doc Add symbol option to Makefile Jan 16, 2019
src Add symbol option to Makefile Jan 16, 2019
.gitignore Add .gitignore to keep build objects out of repository. (#18) Aug 17, 2016
LICENSE Initial commit Sep 23, 2014 Update to clarify how to obtain digest file when using tcp Oct 17, 2018

LiME ~ Linux Memory Extractor

A Loadable Kernel Module (LKM) which allows for volatile memory acquisition from Linux and Linux-based devices, such as Android. This makes LiME unique as it is the first tool that allows for full memory captures on Android devices. It also minimizes its interaction between user and kernel space processes during acquisition, which allows it to produce memory captures that are more forensically sound than those of other tools designed for Linux memory acquisition.

Table of Contents


  • Full Android memory acquisition
  • Acquisition over network interface
  • Minimal process footprint
  • Hash of dumped memory


Detailed documentation on LiME's usage and internals can be found in the "doc" directory of the project.

LiME utilizes the insmod command to load the module, passing required arguments for its execution.

insmod ./lime.ko "path=<outfile | tcp:<port>> format=<raw|padded|lime> [digest=<digest>] [dio=<0|1>]"

path (required):   outfile ~ name of file to write to on local system (SD Card)
                   tcp:port ~ network port to communicate over
format (required): padded ~ pads all non-System RAM ranges with 0s
                   lime ~ each range prepended with fixed-size header containing address space info
                   raw ~ concatenates all System RAM ranges (warning : original position of dumped memory is likely to be lost)

digest (optional): Hash the RAM and provide a .digest file with the sum.
                   Supports kernel version 2.6.11 and up. See below for
                   available digest options.

dio (optional):    1 ~ attempt to enable Direct IO
                   0 ~ default, do not attempt Direct IO
localhostonly (optional):  1 ~ restricts the tcp to only listen on localhost,
                           0 ~ binds on all interfaces (default)

timeout (optional): 1000 ~ max amount of milliseconds tolerated to read a page (default).
                           If a page exceeds the timeout all the memory region are skipped.
                       0 ~ disable the timeout so the slow region will be acquired.

                           This feature is only available on kernel versions >= 2.6.35. 


In this example we use adb to load LiME and then start it with acquisition performed over the network

$ adb push lime.ko /sdcard/lime.ko
$ adb forward tcp:4444 tcp:4444
$ adb shell
$ su
# insmod /sdcard/lime.ko "path=tcp:4444 format=lime"

Now on the host machine, we can establish the connection and acquire memory using netcat

$ nc localhost 4444 > ram.lime

Acquiring to sdcard

# insmod /sdcard/lime.ko "path=/sdcard/ram.lime format=lime"

Available Digests

Really LiME will support any digest algorithm that the kernel library can. Collecting a digest file when dumping over tcp will require 2 separate connections.

$ nc localhost 4444 > ram.lime
$ nc localhost 4444 > ram.sha1

For a quick reference here is a list of supported digests.

All kernel versions

md4, md5
sha1, sha224, sha256, sha384, sha512
wp512, wp384, wp256

4.10 and up

sha3-224, sha3-256, sha3-384, sha3-512

3.0 and up

rmd128, rmd160, rmd256, rmd320


LiME was first presented at Shmoocon 2012 by Joe Sylve.
Android Mind Reading: Memory Acquisition and Analysis with DMD and Volatility

You can’t perform that action at this time.