How to read ram data
About RAM →
RAM stands for random access memory its a volatile memory wherein the data persists till the power supply , and when power supply go it erase everything.
Its very first and hence all the important things such as :
- Cryptographic keys
- the keystrokes
- process info
- network information
and much more…..
Reading RAM data : >
there are many methods to reading the ram some are convenient and some are cumbersome, some just mount the live ram unto a folder .
The method here is extracts the ram data and dumps into file , to read.
LiME or Linux Memory extractor :
LiME (or Linux Memory Extractor) is a tool that allows the capture of volatile memory (RAM) from a running Linux device.
its most suitable for forensics ,because of its lossless nature.
so starting with installing the kernel headers for installing LiME
yum install kernel-devel kernel-headers -y
Now we have to clone and build the official LiME repo using
Now to compile the source code we’ll goto LiME/src
Assuming the make-utils is already installed
In the same folder type :
and it start building
to verify that our data is actually store in the ram
x=5 #in python interpreter
Now we have to define a kernel object so to the format and the path where the RAM content has to be dumped
insmod ./lime-4.14.198-152.320.amzn2.x86_64.ko "path=./ramdata.mem format=raw"
it will take time to dump the entire data, by default LiME append the kernel version onto the dump , we have to rename it to lime.ko.
So we have renamed th lime- .ko to lime.ko
Above we created a file called “remdata.mem” and it contains all ram data
to check the contents of the dumped ram data we type :
cat ramdata.mem | strings | grep "x=5"
where it displays
Now we can seee clearly the python data variable is stored in the ram , It proved that it existed on the ram.
Thank you for reading