504ensicslabs / lime Goto Github PK

lime-'uname -a'.ko failed to insert as a kernel module for bad address.
The machine on which I compile lime is ubuntu 1204 with xen installed.
I've succeeded on ubuntu 1204 with kvm installed, so if it is a problem of Xen?
My purpose is to obtain the hypervisor memory of Xen.
Thanks in advance.

hello,

I try to use your tool on arm64. the board I use is dragon board, with msm8916.
To compile I use:
make ARCH=arm64 CROSS_COMPILE=~/Android/android-ndk-r14b/toolchains/aarch64-linux-android-4.9/prebuilt/linux-x86_64/bin/aarch64-linux-android- modules_prepare

It works fine. No error.

Then, i compile the src using Makefile.sample as:
obj-m := lime.o
lime-objs := tcp.o disk.o main.o
KDIR_GOLD := ~/dragonboard/androidbuild/msm-3.10/
KVER := $(shell uname -r)
PWD := $(shell pwd)
CCPATH := ~/Android/android-ndk-r14b/toolchains/aarch64-linux-android-4.9/prebuilt/linux-x86_64/bin/aarch64-linux-android-
default:
# cross-compile for Android emulator
$(MAKE) ARCH=arm64 CROSS_COMPILE=$(CCPATH) -C $(KDIR_GOLD) M="$(PWD)" modules
$(CCPATH)strip --strip-unneeded lime.ko
mv lime.ko lime-goldfish.ko

The compilation is fine. No error.
The module is created and I can load into the platform.
But when I try to install it after (adb root command) :
insmod /sdcard/lime.ko "path=/sdcard/dump.lime format=raw" <
insmod: failed to load /sdcard/lime.ko: Required key not available

Maybe I did something wrong....Is is supposed to work on arm64 ?
Any answer would be really nice. Thanks by advance

Due to KASLR modern frameworks such as volatility and rekall now require a kernel_slide value. This is not present in LiME format, padded, raw. Please add support for AFF4 to keep things easy.

https://forensicswiki.org/wiki/AFF4

[cfernandez@rek2dekstop src]$ make
make -C /lib/modules/4.3.3-3-MANJARO/build M=/home/cfernandez/SpiderOak Hive/Forensics/LiME/src modules
make[1]: se entra en el directorio '/usr/lib/modules/4.3.3-3-MANJARO/build'
Makefile:659: Cannot use CONFIG_CC_STACKPROTECTOR_STRONG: -fstack-protector-strong not supported by compiler
make[1]: *** No hay ninguna regla para construir el objetivo 'Hive/Forensics/LiME/src'. Alto.
make[1]: se sale del directorio '/usr/lib/modules/4.3.3-3-MANJARO/build'
Makefile:33: fallo en las instrucciones para el objetivo 'default'

gcc --version
gcc (GCC) 5.3.0
Copyright (C) 2015 Free Software Foundation, Inc.
Esto es software libre; vea el código para las condiciones de copia. NO hay
garantía; ni siquiera para MERCANTIBILIDAD o IDONEIDAD PARA UN PROPÓSITO EN
PARTICULAR

uname -a
Linux rek2dekstop 4.3.3-3-MANJARO #1 SMP PREEMPT Thu Dec 24 09:35:07 UTC 2015 x86_64 GNU/Linux

In some cases it seems that dumping over a tcp socket and calculating a digest can cause a kernel panic. I believe this may be because the digest finalize is receiving a null pointer. The question is why is the kernel digest functions receiving null pointers.

Digging into it...

Hi guys, I have trouble analyzing a memory dump, using LiME to retrieve the memory dump on a physical phone.

System Architecture:
Host Operating System: Ubuntu 16.04
Phone Operating System: Android 8.1.0
Platform: arm64 (armv8-A)

I have followed the lime documentation, everything is fine, able to insert modules and retrieve the corresponding memory dump. However, I notice that when i perform xxd lime.dump | head -n 20, I realize that after the file header, the output is zero.

When i retrieve memory dump from an ARM architecture, there were some non-zero values. However, in this case when performing on an ARM64 architecture, this happens. This issues affects my analysis using Volatility.

I was wondering, does LiME support extraction of memory from an ARM64 architecture? Volatility seems like it does not support ARM64 architecture.... but I might be wrong. Hope someone can clarify on this issue.

Any help will be appreciated. Thanks in advance.

recently upgrade my kaly system and since that day every time i try to insert the auto-compiled module i get this error and i don't know why. i upgrade the system, reboot it, installed linux headers compatible to the system (with apt install linux-headers-$(uname -r))., reinstalled dkgp dependencies but anything seems to fix this.
if i run dmseg | tail i get this
[ 184.410219] IPv6: ADDRCONF(NETDEV_UP): wlan0: link is not ready
[ 186.038525] IPv6: ADDRCONF(NETDEV_UP): wlan0: link is not ready
[ 187.410651] wlan0: authenticate with bc:15:ac:94:79:c9
[ 187.670128] wlan0: send auth to bc:15:ac:94:79:c9 (try 1/3)
[ 187.671862] wlan0: authenticated
[ 187.673186] wlan0: associate with bc:15:ac:94:79:c9 (try 1/3)
[ 187.676554] wlan0: RX AssocResp from bc:15:ac:94:79:c9 (capab=0x411 status=0 aid=7)
[ 187.684968] wlan0: associated
[ 188.708934] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready
[ 456.569195] lime: loading out-of-tree module taints kernel.

someone can help me?

I'm able to load the lime.ko module without any issues, but for some reason every dump ends up only being 0 bytes.

[ 17.350903] [LiME] Parameters
[ 17.350908] [LiME] PATH: /mnt/ext/memory.dump.lime.bin
[ 17.350923] [LiME] DIO: 0
[ 17.350937] [LiME] FORMAT: lime
[ 17.350941] [LiME] LOCALHOSTONLY: 0
[ 17.353451] [LiME] Initializing Dump...
[ 17.357482] [LiME] Direct IO Disabled
[ 17.373639] [LiME] Memory Dump Complete...

Doesn't look like any of the memory regions are being used. Any ideas on how I should troubleshoot this?

Is there any way to support multiple lime processes on the same machine for different ranges? I'd like to be able to specify a range of memory across 4 lime processes in parallel.

Example would be a box with tons of memory let's say 128GB and I want the first process to handle
25% the second to handle 25% and so on. That way I could hook each socket in parallel and then cat all the dumps together at the end.

Hello, when compiling the file on Fedora25 (4.11.3-202.fc25.i686+PAE #1 SMP Mon Jun 5 17:03:26 UTC 2017 i686 i686 i386 GNU/Linux) I got the following error:

~/LiME/LiME-master/src/tcp.c:116:9: error: too few arguments to function ‘accept->ops->accept’ r = accept->ops->accept(control,accept,0); ^~~~~~ scripts/Makefile.build:294: recipe for target '~/LiME/LiME-master/src/tcp.o' failed make[2]: *** [~/LiME/LiME-master/src/tcp.o] Error 1 Makefile:1496: recipe for target '_module_/~/LiME/LiME-master/src' failed make[1]: *** [_module_/~/LiME/LiME-master/src] Error 2 make[1]: Leaving directory '/usr/src/kernels/4.11.3-202.fc25.i686+PAE' Makefile:33: recipe for target 'default' failed make: *** [default] Error 2

I tried on CentOs 6.5 and works without issues.

Is there some known limitation on working with VMs ? I tried it on ec2 ubuntu instances, and it would just hang indefinitely with 100% cpu usage. The memory image file would reach close to the size of the memory fast, but increase only very slowly after that while module is in the hung state. dmesg or syslog didn't have any information.

Edit: I had better luck with a rhel 7 image on ec2. It would appear that the problem is local to the ubuntu 14.04 image. If you are interested in reproducing it, the smallest t2.micro instances which come with the free tier would suffice.

Unfortunately lime doesn't work over IPv6. Any chances to have this implemented?

Workaround is to pipe it over an SSH tunnel, but this is somewhat unsatisfactory.

sudo insmod ./lime-foo.ko "path=tcp:4000 format=lime"

Getting this while doing make:

cc1: error: code model kernel does not support PIC mode

So here is my setup:
Nexus6p magisk root and custom kernel compiled to have loadable modules turned on:
Used https://android.googlesource.com/platform/prebuilts/gcc/linux-x86/aarch64/aarch64-linux-android-4.8 for my toolchain to compile the kernel as well as to compile the LiME module.
I get no errors during all of that process. Generates lime.ko no issues. When I try to insmode the module on the device i get the following:
insmod: failed to load lime.ko: Exec format error

When I dump dmesg on the device this is the following error:
module lime: unsupported RELA relocation: 311

Not sure where I'm going wrong, any suggestions would be greatly appreciated. Thanks!

Make fails with the following errors (within AWS on RHEL 7.2 VM):

make
make -C /lib/modules/3.10.0-327.el7.x86_64/build M=/home/ec2-user/LiME/src modules
make: *** /lib/modules/3.10.0-327.el7.x86_64/build: No such file or directory. Stop.
make: *** [default] Error 2

Tried on AWS Fedora 23 VM as well:

make debug
KCFLAGS="-DLIME_DEBUG" make -C /lib/modules/4.2.0-300.fc23.x86_64/build M=/home/fedora/LiME/src modules
make[1]: *** /lib/modules/4.2.0-300.fc23.x86_64/build: No such file or directory. Stop.
Makefile:38: recipe for target 'debug' failed
make: *** [debug] Error 2

The build directories do exist, with symlinks to the appropriate /usr/src/kernels/*.

ls -l /lib/modules/3.10.0-327.el7.x86_64/build
lrwxrwxrwx. 1 root root 38 Nov 9 20:27 /lib/modules/3.10.0-327.el7.x86_64/build -> /usr/src/kernels/3.10.0-327.el7.x86_64
&&
ls -l /lib/modules/4.2.0-300.fc23.x86_64/build
lrwxrwxrwx. 1 root root 38 Sep 4 13:39 /lib/modules/4.2.0-300.fc23.x86_64/build -> /usr/src/kernels/4.2.0-300.fc23.x86_64

Nothing useful in dmesg.

Hi

I have cloned and switched to tags/v1.7.6. I am trying to make lime on a redhat 5 box but with no success.

[root@RHEL-TEST-VM-FOR-GIS-TEMP src]# make -C /lib/modules/uname -r/build M=$PWD
make: Entering directory /usr/src/kernels/2.6.18-238.el5-x86_64' LD /tmp/LiME/src/built-in.o CC [M] /tmp/LiME/src/tcp.o CC [M] /tmp/LiME/src/disk.o CC [M] /tmp/LiME/src/main.o /tmp/LiME/src/main.c: In function ‘write_range’: /tmp/LiME/src/main.c:236: error: implicit declaration of function ‘ktime_to_ms’ make[1]: *** [/tmp/LiME/src/main.o] Error 1 make: *** [_module_/tmp/LiME/src] Error 2 make: Leaving directory /usr/src/kernels/2.6.18-238.el5-x86_64'
[root@RHEL-TEST-VM-FOR-GIS-TEMP src]#

Any idea whats up..

steps:
make ; make clean

expected:
all generated files removed

actual:
There are file lime-*.ko

Some linux tools do, some don't. I'm having trouble with this one and am wondering if anyone's done it successfully and I should keep fiddling with it or just let this one go.

Would you be able to add an option for entire, raw, physical RAM dump?

It would be useful for cold boot application without the dependency on original kernel's /proc/iomem definitions.
http://stackoverflow.com/questions/18580469/content-of-proc-iomem

Practically, I have a 32-bit ARM device which when turned off for less than a few seconds still preserves RAM's contents. When captured with LiME paired to a different kernel booted by alternative means, the RAM seems to be inconsistent probably because of different /proc/iomem definitions between original kernel and the alternative one with LiME. As it is a 32-bit device, the entire address space of RAM is only 4GB and saving it is easy.

The default timeout (1000) doesn't work when dumping the memory from within a virtual machine. I tested KVM and VirtualBox and both are "affected". I think the parameter itself and this behaviour should be at least mentioned in the README.
If you want i can write down a couple of lines and do a pull request..

Hello, i'm trying to precompile LiMe to use it without compiling on a target computer. The problem is that i can't find in yum install or apt-get install the linux/kernel-headers and devel for a different kernel. Where and how can i get em? plz i need that help and thank you everyone.

I am using LiME 1.9 to memory dump a fresh CentOS 7 test machine. While running the "make' command to create a lime.ko file, I am getting the error below;

make: *** /lib/modules/3.10.0-1062..4.1.el7.x86_64/build : No such file or directly. Stop.
make: *** [default] Error 2

I am pretty new to Cent OS linux and using Lime to capture image in order to analyze it through Volatility.

Any help would be appreciated in this regard! Thanks in advance

make -C /lib/modules/3.14.48-33.39.amzn1.x86_64/build M=/home/user /LiME-1.7.2/src modules
make: *** /lib/modules/3.14.48-33.39.amzn1.x86_64/build: No such file or directory.  Stop.
make: *** [default] Error 2

/lib/modules/3.14.48-33.39.amzn1.x86_64:
lrwxrwxrwx 1 root root 51 Aug 18 17:54 build -> ../../../usr/src/kernels/3.14.48-33.39.amzn1.x86_64

/usr/src/kernels:
drwxr-xr-x 22 root root 4096 Oct 15 22:30 4.1.7-15.23.amzn1.x86_64

The directory "/usr/src/kernels/3.14.48-33.39.amzn1.x86_64" doesn't even exist.
Any idea how to make it work on such a host?

just use like "nc localhost 4444" to print the date to stdout , it would never stop.

Any way to add a compression library at source of the transfer something like zlib ? That way on the other side of the exchange we could use nc | zcat or the like? Just optimizing the stream at source would really reduce stress on the wire.

I've compiled LiME in debug mode and verified that functionality in a ubuntu 16.04 vagrant instance. However, on 16.04 in ec2, with apparmor disabled seems to hang.

I ran LiME with the following:

insmod ./lime-4.4.0-34-generic.ko "path=/tmp/ram.lime format=lime"

This is the output of dmesg:

[  194.329700] lime: module verification failed: signature and/or required key missing - tainting kernel
[  194.329897] [LiME] Parameters
[  194.329899] [LiME]   PATH: /tmp/ram.lime
[  194.329900] [LiME]   DIO: 0
[  194.329901] [LiME]   FORMAT: lime
[  194.329901] [LiME]   LOCALHOSTONLY: 0
[  194.329902] [LiME] Initializing Dump...
[  194.329903] [LiME] Direct IO Disabled
[  194.329940] [LiME] Writing range 1000 - 9dfff.
[  194.330501] [LiME] Writing range 100000 - efffffff.
[  247.104859] [LiME] Writing range 100000000 - 10fffffff.
[  251.316417] [LiME] Writing range 110000000 - 117ffffff.

insmod is still taking up cpu, but as far as I can tell no additional writes are getting written to the lime file. FWIW, the lime file at this point is about 4G, roughly the size of the ec2 test box's ram.

Let me know how I can provide more information

Thanks!

I have compiled a module for my device, but when i try to load it i get the following error in dmesg:

<7> 4283.527903[4410:insmod][exec] /system/bin/insmod(3)
<4> 4283.530951[4410:insmod]Kernel Taint Module!!
<4> 4283.531083[4410:insmod]lime: Unknown symbol __stack_chk_guard (err 0)
<4> 4283.531105[4410:insmod]lime: Unknown symbol __stack_chk_fail (err 0)
<7> 4283.531619[4410:insmod][4410:insmod] exit
<7> 4283.532079[4410:insmod][4410:insmod] sig 17 to [4403:sh]

I guess stack_chk_guard error is because of default stack-protector? I tried to compile it with different versions of ndk tools and linaro. I tried to add --fno-stack-protector to Makefile but it somehow get overridden.

Any ideas?

Hi,

I am getting this error on Ubuntu 16.04

/LiME/src# insmod ./lime-4.4.0-116-generic.ko "path=/home/LiMe/mem.raw format=padded"
insmod: ERROR: could not insert module ./lime-4.4.0-116-generic.ko: Unknown symbol in module

Any idea what might be the issue ?

Hi,

Please, add a tag to generate a version and allow the packaging in Debian (and others) easier. If you use a tag, I will track new versions. Thanks!

Regards,

Eriberto

Getting an error:-
insmod: error inserting '/mnt/usb/lime-mater/src/lime.ko': -1 File exists

i search by google, and try to add #include <linux/dma-mapping.h> #include <linux/scatterlist.h>... but it also do not work.

im not good at english, so ill try to describ the steps i've done as i can to let u understand the problem.

i compile LiME with my android source code (already build full system once before)

build enviroment

ubuntu 12.04
JDK 7
kernel version: Linux 3.8.0-43-generic #64~precise1-Ubuntu SMP Mon Jun 30 19:55:02 UTC 2014 x86_64 GNU/Linux
Target Device: Qualcomm APQ8026 Android Device

compile LiME is OK

----- modified LiME Makefile -----
KDIR := ~/android_source_code/out/target/product/<project name>/obj/KERNEL_OBJ
CCPATH := ~/android_source_code/prebuilts/gcc/linux-x86/arm/arm-eabi-4.8/bin
default:
    $(MAKE) ARCH=arm CROSS_COMPILE=$(CCPATH)/arm-eabi- -C $(KDIR) EXTRA_CFLAGS=-fno-pic M=$(PWD) modules
------------------------------------------

.config do has this 3 line on build Guide
(~/android_source_code/out/target/product//obj/KERNEL_OBJ/.config)

CONFIG_MODULES=y
CONFIG_MODULE_UNLOAD=y
CONFIG_MODULE_FORCE_UNLOAD=y

deivce image is userdebug version right now, so adb has root permission

> adb push lime.ko /sdcard/lime.ko
> adb sehll
root@ / # cd sdcard
root@ /sdcard # insomd lime.ko "path=/sdcard/ram.dump format=lime"
insmod: init_module 'lime.ko' failed (Bad address)

here is kernel log

[LiME] Parameters
[LiME]   PATH: /sdcard/ram.dump
[LiME]   DIO: 0
[LiME]   FORMAT: lime
[LiME] Initilizing Dump...
[LiME] Direct IO Disabled
[LiME] Error writing page: vaddr dd440000 ret: -14
[LiME] Error writing range 0x12101000 - 0x1fffffff

here is result of /proc/iomem

root@ /sdcard # cat /proc/iomem
00000000-02efffff : System RAM
  00008000-00dfd21f : Kernel code
  00f60000-011b4193 : Kernel data
06800000-07efffff : System RAM
08000000-11efffff : System RAM
12101000-1fffffff : System RAM
f9017000-f9017fff : msm-watchdog
f9824900-f9824a1b : mmc0

so what can i do or try ? need to provide more info?

The latest version (1.9) on RHEL 6.4 kernel 2.6.32-358.el6.x86_64 doesn't work properly.
RAM dump takes a lot longer to end:
With 1.8.1:
2GB -> 1 minute
With 1.9:
2GB -> 6 hours

No error encountered in both and the ram dump seems to be correct

When I execute insmod /sdcard/lime.ko "path=tcp:4444 format=lime, It says error failed to load /sdcard/lime.ko: Bad address, I can't find a solution.

The timeout value for detecting slow reads in AWS (as reported in issue #9) is also impacting acquisition in non-AWS cases.
Using a debug build of LiME, performing an acquisition in a VirtualBox VM, I see the "Reading is too slow." message in the log:

[  294.511223] [LiME] Initializing Dump...
[  294.511224] [LiME] Direct IO Disabled
[  294.511265] [LiME] Writing range 1000 - 9fbff.
[  294.511999] [LiME] Padding partial page: vaddr 000000000009f000 size: 3072
[  294.512004] [LiME] Writing range 100000 - dffeffff.
[  303.014778] [LiME] Reading is too slow.  Skipping Range...
[  303.024020] [LiME] Writing range 100000000 - 11fffffff.
[  304.310325] [LiME] Memory Dump Complete...

The resulting memory image is missing parts required for successful analysis, since at the time the slow read was detected, zeros are written for the remainder of the range.

An acquisition with lime passing timeout=0 on the same system results in a complete memory dump.

I think this stems from the fact that the timeout calculation covers both reading and writing, rather then just the timing of the reading.

Hi,
I'm having problem with LiME and recent android sdk (19 and above).
The main problems are two;

• the config.gz does not exist anymore
• the goldfish kernel does not include modules, so the "insmod" command proposes in the guide does not work

In other words, do you know a working configuration of android emulator+kernel?
Thanks
M

sorry for my english.

when i capture the memory in PAE kernel, the capture file is blocked to 4 gb .

i try do it with several kernel (2.6, 3.2...) and the finality is the same again and again: block and crash the system occasionally.

please help.
thanks in advance

PS: i prefer speak in french to explain technically the subject.

In #48 it was suggested that the lime format could be extended to allow for frameworks like volatility and rekall to parse dumps from systems created with LiME without having to know the slide value.

It would be great to know where this could sit in the LiME roadmap as far as a potential delivery date.

I know, it's not important, but it could be nice to have a progress bar, speed and percentage.

1. I think that the name of the module should be created on random basis.
2. there should be some default argument so that I can "insmod" the module without any arguments.
   For example:
   # insmod ./r4nd0m.ko
   with default argument "path=./random_string format=lime" and output should be a random string name for the dump file.

Compiled debug version of lime on standard ubuntu aws ec2 image. The process hangs and does not capture memory.

Virtualization: hvm
uname -a: Linux ip-172-31-61-35 3.13.0-91-generic #138-Ubuntu SMP Fri Jun 24 17:00:34 UTC 2016 x86_64 x86_64 x86_64 GNU/Linux

dmesg output:

ul 26 12:13:26 ip-172-31-61-35 kernel: [745074.507387] lime: module verification failed: signature and/or required key missing - tainting k
ernel
Jul 26 12:13:26 ip-172-31-61-35 kernel: [745074.508615] [LiME] Parameters
Jul 26 12:13:26 ip-172-31-61-35 kernel: [745074.508617] [LiME] PATH: /home/ubuntu/mem.lime
Jul 26 12:13:26 ip-172-31-61-35 kernel: [745074.508618] [LiME] DIO: 0
Jul 26 12:13:26 ip-172-31-61-35 kernel: [745074.508619] [LiME] FORMAT: lime
Jul 26 12:13:26 ip-172-31-61-35 kernel: [745074.508620] [LiME] LOCALHOSTONLY: 0
Jul 26 12:13:26 ip-172-31-61-35 kernel: [745074.508621] [LiME] Initilizing Dump...
Jul 26 12:13:26 ip-172-31-61-35 kernel: [745074.508621] [LiME] Direct IO Disabled
Jul 26 12:21:11 ip-172-31-61-35 kernel: [745539.503471] [LiME] Short Read 4000 instead of 4096. Null padding.
Jul 26 12:21:11 ip-172-31-61-35 kernel: [745539.503525] [LiME] Error sending zero page: -4
Jul 26 12:21:11 ip-172-31-61-35 kernel: [745539.504636] [LiME] Error writing page: vaddr ffff8800400b1000 ret: -4. Null padding.
Jul 26 12:21:11 ip-172-31-61-35 kernel: [745539.504674] [LiME] Error sending zero page: -4

in hash.c, function digest_write(void) we have the following code:

strcpy(path, path);
strcat(path, ".");
strcat(path, digest);

The first strcpy is copying path onto itself, this is technically an overlapping memory copy and I believe is undefined behavior. I suspect that strcpy(path, path) should be removed.

static int write_lime_header(struct resource * res) {
...
        DBG("Error sending header %ld", s);
...
}

change to

static int write_lime_header(struct resource * res) {
...
        DBG("Error sending header %zd", s);
...
}

done

You have forgot to evaluate the return value of sock_setsockopt in tcp.c
should be: r = sock_setsockopt(...

Hi,
I am cross compiling on MIPS, it built ok, but insmod says 'invalid parameter' (busybox insmod)

/tmp # insmod /tmp/lime-3.16.0-29-generic.ko "path=/tmp format=raw"
insmod: can't insert '/tmp/lime-3.16.0-29-generic.ko': invalid parameter

This was build (I didn't remove my current kernel var bit in Makefile hence odd name)

rich@PORTEGER830:/tmp/LiME-master/src$ make ARCH=mips CROSS_COMPILE=mips-linux- CC=mips-linux-gcc
make -C /media/rich/WD320/DGND3700_V1.0.0.17_1.0.17_src_full/DGND3700/kernel/linux M=/tmp/LiME-master/src modules
make[1]: Entering directory `/media/rich/WD320/DGND3700_V1.0.0.17_1.0.17_src_full/DGND3700/kernel/linux'
  CC [M]  /tmp/LiME-master/src/tcp.o
  CC [M]  /tmp/LiME-master/src/disk.o
  CC [M]  /tmp/LiME-master/src/main.o
  LD [M]  /tmp/LiME-master/src/lime.o
  Building modules, stage 2.
  MODPOST 1 modules
  CC      /tmp/LiME-master/src/lime.mod.o
  LD [M]  /tmp/LiME-master/src/lime.ko
make[1]: Leaving directory `/media/rich/WD320/DGND3700_V1.0.0.17_1.0.17_src_full/DGND3700/kernel/linux'
mips-linux-strip --strip-unneeded lime.ko
mv lime.ko lime-3.16.0-29-generic.ko

$ file lime-3.16.0-29-generic.ko 
lime-3.16.0-29-generic.ko: ELF 32-bit MSB relocatable, MIPS, MIPS32 version 1 (SYSV), not stripped

Please, see more details here[1]. I confirmed this issue in some tests.

[1] https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=788273

Thanks in advance.

Regards,

Eriberto

Hi,

I want to use LiME to AWS EC2 AMI instances, however, I could not perform insmod.
The command that I used is described below:

$ insmod lime-4.9.76-3.78.amzn1.x86_64.ko "path=/var/tmp/images/myram.lime format=lime"
insmod: ERROR: could not insert module lime-4.9.76-3.78.amzn1.x86_64.ko: Unknown symbol in module

Did I do something wrong?

• S.

I'm trying to make an image of the ram by:
sudo insmod lime-4.4.0-47-generic.ko "path=/media/kate/UI format=img"
And it show's me this:
insmod: ERROR: could not insert module lime-4.4.0-47-generic.ko: Required key not available

Could you be so kind and add a note to the usage section that dumping memory on a virtual (linux) system needs the parameter timeout=0. Otherwise the dump is most likely not usable. Or set the default value for timeout to 0. That could prevent some trouble, extra work and frustation.