admin/nikaiw-VMkatz
1
0
Fork 0
mirror of https://github.com/nikaiw/VMkatz synced 2026-09-25 07:51:06 +00:00
Code Issues Packages Projects Releases Wiki Activity
136 Commits 3 Branches 20 Tags
main
Commit Graph
4 Commits
Author SHA1 Message Date
NK 06397923d2 Flip EPT scanning to opt-in and remove dev examples from repo 
EPT scanning (for VBS/Credential Guard VMs) is now disabled by default
and enabled with --ept, since the vast majority of VMs don't use VBS.
Previously it was enabled by default and disabled with --no-ept.

Also remove examples/ (dev-only test utilities) from tracking.
 2026-03-17 23:24:03 +01:00
NK 6c35d9f242 Add VMFS feature flag, device enumeration, and fix all clippy warnings 
VMFS module:
- Gate behind `vmfs` Cargo feature (included in defaults, depends on sam)
- Add --vmfs-list to discover VMFS-6 devices and flat VMDKs on ESXi
- Add --vmfs-device/--vmdk auto-scan with NTFS partition pre-check
- Fix label reading: use data_offset at LVM header 0x7A (not 0xC8)
- Filter out duplicate vml. symlink devices

Clippy fixes across all feature combinations:
- Remove unused fields, methods, constants in vmfs.rs
- Remove redundant `as u64` casts, use div_ceil()
- Gate MSSK_TAG and fmt_lm_pwdump behind their feature flags
- Simplify boolean expressions in ntfs_fallback.rs
- Suppress unit-type warnings for PagefileRef/DiskPathRef cfg stubs

Zero warnings on: --features vmware, all-except-vmfs, --all-features.
 2026-03-10 03:01:13 +01:00
NK 5e941b3ce3 Update gitignore and README 2026-02-19 21:11:30 +01:00
NK 2011826ed1 vmkatz: VM memory forensics tool with LSASS, SAM, and folder modes 
Three extraction modes:
- LSASS: credentials from .vmem/.vmsn/.sav snapshots (9 SSP providers)
- SAM: NT/LM hashes + LSA secrets from .vdi/.vmdk/.qcow2 disk images
- Folder: auto-discover and process all VM files in a directory

Key features:
- VMware twoGbMaxExtentSparse VMDK with snapshot chain support
- VMDK descriptorless mode for orphan extent files with gap handling
- VirtualBox .sav SSM format with LZF decompression
- VDI dynamic/differencing images with parent chain
- QCOW2 L1/L2 address translation with backing file chain
- MBR/GPT partition tables, NTFS navigation via ntfs crate
- Raw regf + hbin scan fallbacks for incomplete disk images
- Hive size validation to reject false matches
- All 9 mimikatz SSP providers with physical scan fallbacks
 2026-02-08 22:02:50 +01:00