$ show jtsylve/LiME
LiME is a Linux kernel module (LKM) for volatile memory acquisition from Linux and Android systems, widely used in digital forensics and incident response. It dumps physical memory ranges marked as "System RAM" by walking the kernel's iomem resource tree, writing output to a local file or streaming over a TCP connection. The module supports three output formats (raw, padded, and lime with metadata headers), optional zlib compression, optional cryptographic digest sidecar files (leveraging the kernel's crypto API), and direct I/O. It minimizes interaction with user space during capture to produce more forensically sound images. The architecture is a classic kernel module with clearly separated concerns: main.c drives the iomem traversal and orchestrates output via vtable-like structures; tcp.c and disk.c provide network and file-system transport; hash.c wraps three generations of kernel crypto APIs (ahash, hash, tfm) for portable digest support; and deflate.c wraps zlib with balanced memory settings. The codebase is aggressively version-aware, supporting kernels from 2.6.11 through 6.19 with conditionally compiled code paths for API breakpoints (e.g., set_fs removal, kmap_local_page, sock_set_reuseaddr). The project ships an exceptionally thorough CI/CD pipeline (GitHub Actions) that compiles against eight pinned kernel series and a canary latest-kernel build, runs sparse static analysis and custom grep-based source checks, and boots real kernels in QEMU to perform runtime smoke tests of all output formats, digest, and compression. A self-contained local testing harness (Docker) enables developers to reproduce the full CI matrix offline. Configuration management, kernel tree caching, and version pinning are handled by well-documented scripts that are themselves reusable for other kernel module projects.
The LLM identified 5 files worth highlighting for reuse:
Implements depth-first traversal of the kernel's iomem_resource tree using a subtree-skip helper. This correctly handles nested System RAM entries introduced in kernel 5.8 by drivers like virtio-mem and dax/kmem, while avoiding double-dumping of child resources (e.g., Kernel code/data ranges). The walker logic is self-contained and could be extracted for any kernel module that needs to enumerate physical memory regions with awareness of nested subtrees.
Provides a unified interface for computing cryptographic digests across three major kernel crypto API generations (ahash ≥4.6, hash 2.6.19–4.5, tfm 2.6.11–2.6.18). Handles memory validation and scatter-gather updates for vmalloc'd regions. The version-conditional code is cleanly isolated and could be reused in any kernel module requiring portable hash support.
Thin, self-contained wrapper around the kernel's zlib-deflate API with tunable window bits and memory level. Allocates workspace, manages stream state, and exposes begin/end/deflate functions. Conditionally compiled only when CONFIG_ZLIB_DEFLATE is enabled. Easily extractable for any kernel module needing inline compression.
Downloads, configures, builds (modules_prepare or full bzImage), and aggressively strips the kernel source tree for out-of-tree module compilation testing. Supports defconfig, no-zlib, preempt-rt, and qemu config variants. Uses version pinning via kernel-versions.conf and outputs a minimal cached tree (~100 MB). The script is fully reusable for any kernel module project's CI pipeline.
Six portable grep-based checks targeting common kernel module mistakes: missing extern declarations in header, resource_size_t format string safety, SPDX license headers, void pointer arithmetic, version guard direction, and ERR_PTR cleanup in error paths. Runs on both macOS and Linux with zero dependencies beyond coreutils. Easily adaptable to any C codebase.