Read Me

This is an alpha release done for toorcon 9 (toorcon.org)

This software lets you collect live RAM data for later analysis from
potentially compromised machines.

It is a LKM - mod

to build:
   make

to install
   insmod 99lb.ko

It is a shell script - collect.sh

to collect the data (as root):
   ./collect.sh <path-to-where-you-want-it>

and it is an analysis tool:

to run:
    ./99lb.py <path-to-where-you-collected-it>

Lots more to be done.

This couldn't have been done without the work of these people:
   halflife
   Silvio Cesare
   Samhain folks
   Mariusz Burdach
   Jorge Mario Urrea

Gabriel Lawrence
2007