INSTALL

Installing lmg On A Thumb Drive
Hal Pomeranz (hal@deer-run.com), 2020-02-01

Step 1 - Thumb Drive Setup:
===========================

BE VERY CAREFUL HERE.  There is a large potential for data loss!

This example assumes you're using a 64G thumb drive, and you're following
these instructions on a Linux system with a single hard disk.

Plug the thumb drive into a spare USB port.  If you run "fdisk -l"
as root, you should see output like:

   Disk /dev/sda: 160.0 GB, 160041885696 bytes
   255 heads, 63 sectors/track, 19457 cylinders, total 312581808 sectors
   Units = sectors of 1 * 512 = 512 bytes
   Sector size (logical/physical): 512 bytes / 512 bytes
   I/O size (minimum/optimal): 512 bytes / 512 bytes
   Disk identifier: 0x0002a430

      Device Boot      Start         End      Blocks   Id  System
   /dev/sda1   *        2048      499711      248832   83  Linux
   /dev/sda2          501758   312580095   156039169    5  Extended
   /dev/sda5          501760   312580095   156039168   83  Linux

   Disk /dev/sdb: 61.8 GB, 61847109632 bytes
   72 heads, 8 sectors/track, 209713 cylinders, total 120795136 sectors
   Units = sectors of 1 * 512 = 512 bytes
   Sector size (logical/physical): 512 bytes / 512 bytes
   I/O size (minimum/optimal): 512 bytes / 512 bytes
   Disk identifier: 0x396a32a9

      Device Boot      Start         End      Blocks   Id  System
   /dev/sdb1            8064   120795135    60393536    c  W95 FAT32 (LBA)

/dev/sda is your primary hard drive, and /dev/sdb is the thumb drive 
we're going to use.  If you are not able to identify your thumb drive,
DO NOT PROCEED.  You will invariably end up destroying important data
and we will both be sad.  I am going to use /dev/sdb as the thumb drive
in the examples below.  BE CAREFUL AS YOU CUT AND PASTE.

Normally, I format my thumb drives as EXT4 file systems-- they're fast,
but can only be read on Linux systems.  If you want to be able to see
the captured memory images on other platforms, then format your thumb
drive as NTFS.  But the Linux NTFS-3g drivers have much slower performance
than EXT4.  Your call.

For EXT4 format:

   parted /dev/sdb mklabel msdos
   parted /dev/sdb mkpart primary ext4 1 62G
   mkfs -t ext4 /dev/sdb1

For NTFS:

   parted /dev/sdb mklabel msdos
   parted /dev/sdb mkpart primary ntfs 1 62G
   mkntfs -Q /dev/sdb1

Finally, mount the thumb drive so that we can install files on it.
I'm going to use /mnt/usb in all of the examples below, so I recommend
following these steps exactly.

   mkdir -p /mnt/usb
   mount /dev/sdb1 /mnt/usb


Step 2 - Copy lmg Script
========================

Copy the lmg script to the top-level directory of your thumb drive.
lmg uses the directory that it's run from as the starting point to
find all of the other files it needs to operate, so the location of
the script is important.

   cp /some/path/to/lmg /mnt/usb
   chmod +x /mnt/usb/lmg


Step 3 - Install AVML
=====================

Get the AVML source code from https://github.com/microsoft/avml
Follow the instructions to build the binaries.

Once you've built AVML, copy it to the thumb drive. Note that the
binary must be installed using the program name "avml-$(uname -m)"
(e.g., "avml-x86_64") or lmg won't find it. The commands below will do
the right thing:

   mkdir /mnt/usb/avml
   cp target/$(uname -m)-unknown-linux-musl/release/avml /mnt/usb/avml/avml-$(uname -m)
   cp target/$(uname -m)-unknown-linux-musl/release/avml-convert /mnt/usb/avml/avml-convert-$(uname -m)

I'm including avml-convert here. Even though it is not required to
get a memory dump, having a copy of avml-convert on your thumb drive
may be useful.

You'll need to repeat the above steps on both a 32-bit and a 64-bit
system if you want to support both architectures.


Step 4 - Install LiME Source Code
=================================

NOTE: LiME is the kernel module lmg uses to dump memory from target
Linux systems if AVML fails to work. So this step is optional,
assuming you're willing to trust that AVML is always going to do the
right thing.

The lmg script will be compiling the LiME kernel module on the thumb drive 
as part of the acquisition process.  So we need to get the LiME source onto
our thumb drive:

   cd /mnt/usb/
   git clone https://github.com/504ensicsLabs/LiME.git

If you don't have git, you can download the LiME souce code as a ZIP file
from https://github.com/504ensicsLabs/LiME

I've included a file called lime-Makefile.patch with the lmg distribution
that makes a minor tweak to the way LiME is built.  With my patch applied,
the resulting kernel module will include the CPU architecture ("i686" or
"x86_64") as part of the module name.  This makes life better when you're
dealing with both 32-bit and 64-bit systems.  YOU MUST APPLY MY PATCH or
lmg will be unable to find the appropriate kernel module for your system.

To apply the patch:

   cd /mnt/usb/lime/src
   patch < /some/path/to/lime-Makefile.patch


Step 5 - Install (Statically-Linked) dwarfdump
==============================================

NOTE: If you do not want lmg to automatically build Volatility(TM)
profiles for you, then you can stop right here.  lmg + AVML is enough
to capture RAM dumps from Linux systems.

But assuming you want to build Volatility(TM) profiles on the fly,
you're going to need the dwarfdump program.  And if you don't want
to be dependent on shared libraries, you're going to want to build
it statically-linked.  To save everybody some hassle, I'm including
statically-linked 32-bit and 64-bit versions of dwarfdump with lmg.
To install them onto your thumb drive:

   cd /mnt/usb
   tar zxf /some/path/to/static-dwarfdump.tgz

If you want to try to build these yourself, read on...

There's an issue around of which version of dwarfdump you want to use.
Various users have reported problems using newer versions of dwarfdump
to create Volatility(TM) profiles.  For further details see:
http://code.google.com/p/volatility/issues/detail?id=260
Per Andrew Case's comment in the thread, it appears that the v20120410
has been tested, so I recommend going with that.  The code can be found at
http://www.prevanders.net/libdwarf-20120410.tar.gz

To build dwarfdump statically linked, you'll need static versions of
the elfutils libraries for your architecture.  This worked for me on
my CentOS (Red Hat) system:

   yum install elfutils-devel-static elfutils-libelf-devel-static

Now download libdwarf, unpack the tar archive, and cd into the resulting
directory.  To build statically-linked executables:

   export LDFLAGS='-static'
   ./BLDLIBDWARF

Once you've built dwarfdump, copy it to the thumb drive along with the
dwarfdump.conf file.  Note that the binary must be installed using the
program name "dwarfdump-$(uname -m)" (e.g., "dwarfdump-x86_64") or lmg
won't find it.  The commands below will do the right thing:

   mkdir /mnt/usb/dwarfdump
   cp dwarfdump2/dwarfdump /mnt/usb/dwarfdump/dwarfdump-$(uname -m)
   cp dwarfdump2/dwarfdump.conf /mnt/usb/dwarfdump

You'll need to repeat the above steps on both a 32-bit and a 64-bit
system if you want to support both architectures.


Step 6 - Install Volatility(TM)
===============================

Technically, building a Volatility(TM) profile for Linux only requires
the files under .../volatility-*/tools/linux.  But I prefer to install
the entire Volatility(TM) distro on my thumb drive.  That way I know
I'll always have a copy of Volatility(TM) handy when I want to do my
analysis.

Installing Volatility(TM) on your thumb drive with git is easy:

   cd /mnt/usb
   git clone https://github.com/volatilityfoundation/volatility.git

If you don't have git, you can download the latest sources as a
ZIP file from https://github.com/volatilityfoundation/volatility

lmg doesn't really care about the exact name of the directory Volatility(TM)
gets installed in.  It will find the appropriate files automatically.