Linux Memory Acquisition: LiME, AVML and /proc/kcore

What it is

A Linux memory image is a copy of physical RAM taken from a running host. It is the only artifact that holds the complete state of the kernel and every process at one moment: process lists as the kernel sees them (not as a rootkit presents them), network sockets, loaded kernel modules, command history still in shell memory, decrypted data and injected code. It sits at the top of the order of volatility.

Two open-source acquisition tools dominate. LiME (Linux Memory Extractor) is a loadable kernel module that reads physical memory from inside the kernel. AVML (Acquire Volatile Memory for Linux, from Microsoft) is a statically linked userland binary that reads memory through kernel interfaces, so it needs no per-kernel build.

Where it lives

Distribution differences matter for analysis rather than acquisition: debug kernels come from linux-image-*-dbgsym (Debian/Ubuntu debug archives) or kernel-debuginfo (RHEL/Fedora debuginfo repositories).

What it proves

• Every process the kernel tracks, including ones hidden from ps by userland hooks, and processes whose binary was deleted.
• Network sockets and connections at capture time, with owning process.
• Loaded kernel modules, including modules unlinked from the module list, and hooked kernel structures.
• Per-process environment (LD_PRELOAD), command lines, memory maps and injected or anonymous executable regions.
• Shell history held in bash process memory, even when HISTFILE was disabled.
• Not proven: anything that happened before the capture and left no trace in memory. A capture is also a change to the system: LiME loads a module, AVML runs a process, and both write output somewhere; record exactly what you did.

Key fields

Timestamps

The image has no single embedded capture time: record start and end time (UTC) and the host clock offset in your notes. Inside the image, process start times are stored relative to boot, and Volatility converts them using the boot time it recovers. Validate against /proc live data collected at the same time.

Retention

None beyond power. Memory contents change every millisecond; a second capture will differ. Hibernation files and swap may hold older pages, and kernel crash dumps (see crash reports and core dumps) are memory captures taken by the system itself.

Collection

Write the image to external media or over the network, never to the evidence disk if you can avoid it.

# AVML (static binary from trusted media)
sudo /media/ir/avml acquire /media/ir/host01.lime
sudo /media/ir/avml acquire --compress /media/ir/host01.lime.compressed
/media/ir/avml convert host01.lime.compressed host01.lime   # on the analysis machine

# LiME (module built for this exact kernel)
sudo insmod ./lime-$(uname -r).ko "path=/media/ir/host01.lime format=lime"
sudo rmmod lime

• UAC can run AVML as part of a collection (its memory_dump/avml.yaml artifact, only below a configurable RAM size) and also copies /boot/vmlinu* and /boot/System.map* to help build symbols later.
• Kernel lockdown (often enabled in integrity mode with Secure Boot) blocks /dev/mem and unsigned modules such as a self-built LiME; confidentiality mode also blocks /proc/kcore, and the AVML README warns it cannot acquire memory under lockdown. For virtual machines, a hypervisor snapshot or memory export is often the practical alternative.
• Older AVML releases used avml <file> without a subcommand and a separate avml-convert binary; check avml --help for the version you carry.

Parsing

vol -f host01.lime banners.Banners             # identify the kernel build
./dwarf2json linux --elf vmlinux-<ver> --system-map System.map-<ver> | xz > symbols/linux/<ver>.json.xz
vol -f host01.lime linux.pslist
vol -f host01.lime linux.pstree
vol -f host01.lime linux.bash                  # shell history in memory
vol -f host01.lime linux.sockstat
vol -f host01.lime linux.lsmod
vol -f host01.lime linux.malware.check_modules # modules missing from the list
vol -f host01.lime linux.malware.malfind       # suspicious executable mappings

Investigator tips

• Capture memory before containment steps that kill processes or drop connections; collect disk afterwards.
• Carry prebuilt, tested tools: building LiME on the suspect host means installing compilers and headers, which changes the system and may be impossible.
• Keep the exact kernel version string (uname -a) with the image; without matching symbols, Volatility 3 cannot parse it.
• Differences between linux.pslist and live ps output are a classic indicator of a userland rootkit (ld.so.preload); modules found by linux.malware.check_modules but not in lsmod point to a kernel rootkit (kernel modules).
• Hash the image as soon as it is written and store the hash with your notes.
• Fileless payloads in /dev/shm or memfd often exist only in RAM; memory may be the only place to recover them.