I’ve followed the LiME documentation to cross compile the kernel and create a loadable kernel module to dump the volatile memory off a Google Glass XE12 running Linux version 3.0.31-23935-g01ccedd (android-build@vpba28.mtv.corp.google.com) (gcc version 4.4.3 (GCC)).

Initial attempts to install the loadable kernel module for LiME would error with:

dmesg output:

…

lime: disagrees about version of symbol sock_create_kern

lime: Unkonwn symbol sock_create_kern (err –22)

…

Likely due to the version of symbols in the functions implemented in tcp.h in the LiME package.  After modifying LiME source code (main.c) to ignore all tcp construct and to write directly to the /sdcard, we were able to get a ~1 GB (raw, padded, and lime formatted) memory dumps.

Here is the command we issued to get the memory dump:

Next we followed the documentation on Volatility AndroidMemoryForensics Wiki to create a profile using the Google Glass source code (omap) and dwarfdump.  

Here is the Makefile we used:

Here are the results from running the make file:

As documented, we copied over the created module.dwarf file and the System.map file to the Volatility plugins directory and confirmed the profile exists.

Here is the debug output:

Appreciate any guidance and help in this matter.

Thanks