AMExtractor

AMExtractor is a memory forensic tool that enables physical memory dumping from Android devices even when kernel source code is unavailable. It provides an alternative approach to traditional LKM-based tools, allowing forensic analysis on devices with stock ROMs or restrictive kernel module policies.

Key Features

• Kernel Memory Access — Uses /dev/kmem to execute code in kernel space instead of relying on loadable kernel modules (LKMs)
• Device Compatibility — Tested on multiple Android devices including Galaxy Nexus, Nexus 4, Nexus 5, and Samsung Galaxy S4
• Configuration Flexibility — Supports different memory models (FLAT_MEM, SPARSE_MEM, DISCONTIG_MEM) and trigger methods
• Root-Based Operation — Requires root access for memory extraction and kernel code execution
• Network Dumping — Transfers memory dumps over network connection for analysis on external systems

Philosophy

AMExtractor takes a practical approach to Android memory forensics by working within the constraints of stock device kernels, enabling analysis where traditional LKM-based tools fail.