Skip to content

LiME

Forensics & Incident Response

A Loadable Kernel Module for volatile memory acquisition on Linux and Android systems

C Latest v1.12.0 · 2mo ago Security brief →

Features

  • Full memory capture from Linux and Android devices
  • Supports local file output or network streaming via TCP
  • Multiple output formats: raw, padded, and LiME‑specific headered format
  • Optional SHA digests for integrity verification
  • Optional zlib compression to reduce transfer time

Recent releases

View all 4 releases →
v1.12.0 Mixed
Notable features
  • SPDX license headers and REUSE compliance
  • GitHub Actions multi-kernel test suite
Full changelog

LiME v1.12.0

16 commits since v1.11.0 (March 23–24, 2026)

Bug Fixes (kernel module)

Hash / digest subsystem (hash.c)

  • Fix multi-page vmalloc digest corruption — only the last page was being hashed
  • Fix crypto_digest_update passing byte length instead of nsg count
  • Fix memory leak: digest_value was never freed in ldigest_clean
  • Fix uninitialized digestsize on kernels 2.6.11–2.6.18
  • Fix NULL dereference in ldigest_clean when crypto_alloc fails
  • Add NULL checks on output and digest_value allocations

TCP subsystem (tcp.c)

  • Fix sizeof(struct iovec) used on a struct kvec variable
  • Fix socket leak: pre-allocated socket was overwritten by kernel_accept

Core module (main.c)

  • Fix ldigest_clean extern return type mismatch (int vs void)
  • Fix wrong format specifier %zu for signed ssize_t
  • Fix missing __get_free_page and kmalloc NULL checks
  • Fix resource leaks in init() error paths
  • Fix no_overlap set even when digest init fails

Code Quality

  • Centralize all extern declarations in lime.h
  • Remove redundant includes and duplicate externs across files
  • Extract create_tcp_sock() helper to deduplicate socket creation in tcp.c
  • Replace strcpy/strcat chain with snprintf in hash.c
  • Refactor init() error paths to goto-based cleanup pattern
  • Fix () vs (void) inconsistencies, declaration-after-statement issues, mixed indentation

REUSE / SPDX Compliance

  • Add SPDX license headers to all source and script files
  • Add REUSE.toml for machine-readable license metadata
  • Replace monolithic LICENSE file with LICENSES/GPL-2.0-only.txt

Documentation

  • Rename doc/docs/
  • Rewrite and clarify README.md (updated usage examples, parameter descriptions, sidecar digest naming)
  • Add docs/test-architecture.md describing the CI and test framework design
  • Fix missing "padded" label in docs/README.md parameter description

CI / Testing

  • Add GitHub Actions multi-kernel compile-test workflow (build-test.yml) covering multiple kernel versions
  • Add sparse static analysis and QEMU smoke tests
  • Add pre-commit hooks (trailing whitespace, markdown lint, flawfinder, codespell, REUSE)
  • Add test/ directory with Dockerfile, kernel prep scripts, initramfs builder, and smoke-test harness
  • Update actions/cache to v5; fix objtool preservation during kernel tree stripping
  • Remove kernel 4.15 from CI matrix after extensive attempts to fix its toolchain incompatibilities

Full Changelog: https://github.com/jtsylve/LiME/compare/v1.11.0...v1.12.0

v1.11.0 Bug fix

Fixes for Oracle Linux 9 and kernel compatibility.

Full changelog

What's Changed

  • fix errors that prevent building on OL9 by @fabianfrz in https://github.com/jtsylve/LiME/pull/135
  • Prevent build error after changes in kernel_bind() prototype by @efzulian in https://github.com/jtsylve/LiME/pull/136

New Contributors

  • @fabianfrz made their first contribution in https://github.com/jtsylve/LiME/pull/135
  • @efzulian made their first contribution in https://github.com/jtsylve/LiME/pull/136

Full Changelog: https://github.com/jtsylve/LiME/compare/v1.10.1...v1.11.0

v1.10.1 Bug fix

Bug fixes and stability improvements in LiME.

Full changelog

What's Changed

  • Fix main.c build by @gmwiz in https://github.com/504ensicsLabs/LiME/pull/129

New Contributors

  • @gmwiz made their first contribution in https://github.com/504ensicsLabs/LiME/pull/129

Full Changelog: https://github.com/504ensicsLabs/LiME/compare/v1.10.0...v1.10.1

v1.10.0 Bug fix

Kernel memory mapping and compatibility fixes.

Full changelog

What's Changed

  • use kmap atomic for kernels past 2.6.37 by @tsahee in https://github.com/504ensicsLabs/LiME/pull/80
  • Fix endless loop on PAE kernels with ranges > 4GiB by @fabianfreyer in https://github.com/504ensicsLabs/LiME/pull/88
  • [x86] Fix kmap_atomic raises scheduling while atomic bug by @qodroi in https://github.com/504ensicsLabs/LiME/pull/110
  • Rename raw mode expert and provide more warnings around use of this format. Closes #111 by @eve-mem in https://github.com/504ensicsLabs/LiME/pull/121
  • Changed main.c to be compliant with new kernel versions by @ITRaab in https://github.com/504ensicsLabs/LiME/pull/127
  • Fix the build process on ARMs by @eribertomota in https://github.com/504ensicsLabs/LiME/pull/125

New Contributors

  • @tsahee made their first contribution in https://github.com/504ensicsLabs/LiME/pull/80
  • @fabianfreyer made their first contribution in https://github.com/504ensicsLabs/LiME/pull/88
  • @qodroi made their first contribution in https://github.com/504ensicsLabs/LiME/pull/110
  • @eve-mem made their first contribution in https://github.com/504ensicsLabs/LiME/pull/121
  • @ITRaab made their first contribution in https://github.com/504ensicsLabs/LiME/pull/127
  • @eribertomota made their first contribution in https://github.com/504ensicsLabs/LiME/pull/125

Full Changelog: https://github.com/504ensicsLabs/LiME/compare/v1.9.1...v1.10.0

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

About

Stars
1,985
Forks
369
Languages
C Shell Makefile

Install & Platforms

Platforms
linux arm64

Beta — feedback welcome: [email protected]