- Add QEMU/Proxmox savevm and VMware embedded .vmsn to supported inputs
- Add ESXi 6.7 and Proxmox savevm test results to tested targets table
- Document BitLocker detection and QEMU savevm limitations
- Update target OS range to include Windows Server 2003
- Add Proxmox example to quick start
- Update module architecture and feature descriptions
Two bugs fixed:
1. LSA key derivation: MD5 input was salt+bootkey×1000 instead of
bootkey+salt×1000 (wrong order per impacket/MS-LSAD spec)
2. Secret decryption: used RC4 instead of DES-ECB with rotating
7-byte key segments (SystemFunction005 / [MS-LSAD] Section 5.1.2)
Implemented:
- DES-ECB decrypt with rotating key (des_ecb_decrypt_rotating)
- transformKey: 7-byte to 8-byte DES key expansion ([MS-LSAD] 5.1.3)
- LSA_SECRET_XP parsing: Length(4) + Version(4) + Secret(Length)
Tested on Windows Server 2003 R2 SP2 VHDX: DPAPI_SYSTEM keys and all
LSA secrets now decrypt correctly.
Windows Server 2003 R2 SP2 reports PolRevision 0x10007 (modern) but uses
the legacy PolSecretEncryptionKey scheme. Try PolEKList first; if not found,
fall back to PolSecretEncryptionKey instead of failing.
Check for the -FVE-FS- OEM ID in partition boot records before
attempting NTFS parsing. When BitLocker is detected, skip the
partition and display a clear error message instead of failing
silently with "No registry hives found".
Applied to SAM extraction, LSA secrets, and NTDS.dit extraction paths.
VMware layer:
- Fix base_offset not set when .vmsn has region tags but no separate
.vmem file (embedded memory). Reads were at wrong file offset.
- Tested on ESXi 6.7 with Win Server 2016 embedded .vmsn snapshot.
Display:
- Don't display Kerberos/WDigest passwords for machine accounts (username
ending with $) — they are binary blobs, not useful plaintext. The
Kerberos keys (AES256, RC4=NT hash) are the exploitable forms.
- Don't count machine passwords in the summary line.
- Truncate long hex passwords to "(hex, N bytes) first32bytes..." when
displayed for other non-printable passwords.
New parser (src/qemu/savevm.rs):
- Parse QEVM magic, RAM block list, and page entries (PAGE/ZERO)
- MMIO gap remapping for q35+UEFI (below_4g=0x80000000)
- Skip non-RAM device sections (dirty-bitmap, etc.) via forward scanning
- HashMap-based deduplication for dirty page iterations (last-write-wins)
- Auto-detection via QEVM magic in format dispatcher
System process discovery improvements:
- Validate candidates by translating Flink VA to physical and checking the
linked EPROCESS has a printable ImageFileName and valid kernel-mode Flink
- Rejects stale EPROCESS remnants with corrupted page tables
Tested on Proxmox VMs: DC25 (Win Server 2025, 4GB) and WKS11 (Win11, 8GB)
- Merge 8 duplicated _x86 functions into single arch-aware implementations:
walk_avl_tree, read_kerb_external_name, extract_kerb_password,
extract_tickets_from_list, extract_single_ticket, detect_kerb_offsets,
extract_kerb_keys, extract_kerberos_credentials
- All structure offsets computed from arch.ptr_size() and arch.ustr_size()
- Delete extract_kerberos_credentials_arch wrapper and all _x86 variants
- Net reduction: -580 lines
- Merge extract_msv_sessions_arch and extract_msv_credentials_arch into the
main functions, selecting offset variants by arch at runtime
- Make all walkers arch-aware: walk_session_buckets, walk_session_list,
walk_msv_list, walk_hash_table, find_inline_hash_table,
find_credentials_ptr_in_entry
- Delete 258 lines of duplicated x86 code (extract_msv_sessions_arch,
extract_msv_credentials_arch, try_extract_primary_cred_x86)
- x86 now gets scoring, enrichment, multi-pass credential scanning, and
SHA1 validation — previously x64-only features
- Add variant_order_for_build_arch for x86 build-aware variant ordering
- Add read_ptr_from_buf, walk_list, read_data_section, scan_data_for_list_head
to types.rs, eliminating ~200 lines of duplicated boilerplate across providers
- Unify kerberos.rs: merge 8 duplicated _x86 functions into arch-aware versions
(walk_avl_tree, extract_single_ticket, read_kerb_external_name, etc.), -440 lines
- Fix CloudAP: read account name from toName_ptr (+0x58) instead of hashName (+0x68)
which is a SHA hash, not the readable UPN. Add 3 offset variants (1507-1607,
1703-1709, 1803+) with auto-detection. Remove useless hashName fallback.
- Fix walk_session_buckets using x64-only read_win_unicode_string and read_virt_u64
for pointers — now uses arch-aware read_ustring and read_ptr
Kerberos:
- Detect Credential Guard ISO-encrypted passwords (type==1 at cred+0x28)
on Win10 1607+. Report as "(Credential Guard ISO)" instead of silently
failing to decrypt.
- Extract SmartCard PINs from SmartcardInfos pointer (CSP_INFOS.PinCode)
when regular password is empty. Stored as "[PIN] <pin>".
- Add smartcard_infos offset to KerbOffsets for Win10 1607+ variants.
MSV:
- Walk the KIWI_MSV1_0_PRIMARY_CREDENTIALS linked list via next pointer
to find the "Primary" entry, instead of assuming the first entry is it.
- Recognize "CredentialKeys" (ANSI_STRING len=14) entries alongside
"Primary" (len=7) during structure scanning and inline byte matching.
- Skip CredentialKeys entries (DPAPI key material already extracted by
DPAPI provider) with a log message.
- Add EPROCESS offset tables for Vista SP2 x86, Win7 SP1 x86, Win8/8.1 x86
- Fix is_prevista_x86 threshold: Vista x86 (PID=0x9C) uses AES/3DES like
Win7+, not DES-X/RC4. Tighten cutoff from 0xA0 to 0x98.
- Update README: 18 offset tables, correct x86 support status
EPT scanning (for VBS/Credential Guard VMs) is now disabled by default
and enabled with --ept, since the vast majority of VMs don't use VBS.
Previously it was enabled by default and disabled with --no-ept.
Also remove examples/ (dev-only test utilities) from tracking.
The PGM struct fields size varies by VirtualBox version:
- v14 (VBox 7.x): 78 bytes — existing behavior
- v12-13 (VBox 5.x-6.x): 74 bytes — no cBalloonedPages field
- v11 (VBox 4.1+): 70 bytes — pre-balloon support
Previously hardcoded to skip(78), which corrupted RAM extraction
for any .sav file not from VBox 7.x. Now reads the PGM unit
version from the unit header and adapts accordingly.
- VDI: search for location= attribute AFTER the UUID match, not in a
window that extends 200 bytes before it. Prevents picking a location
from a different HardDisk entry in multi-disk .vbox files.
- dump: use saturating_add/sub in coalesce_pages to prevent u64
overflow on kernel addresses near 0xFFFFFFFFFFFFF000.
The function is used by both SAM and NTDS output paths. Gating it on
ntds.dit broke compilation when sam was enabled without ntds.dit
(e.g. --features sam or --features vmfs).
- QCOW2: cap l1_table pre-allocation to 1M entries to prevent OOM
from forged l1_size in header (actual entries read from file)
- VMware tags: validate all index bytes are available before parsing,
break out of tag loop instead of producing truncated indices
- Bounds-check tag_start before slicing vmsn_data (prevents panic on
forged memory_group.offset beyond file size)
- Cap Vec::with_capacity for group_count based on actual data size
(prevents OOM from forged u32 in header)
- Cap regions Vec::with_capacity to 4096 (prevents OOM from forged
regionsCount tag value)
- SAM hashes: use saturating_add + checked_add for V-value offset
calculations to prevent overflow on crafted hive data
- ESE: check tag_idx overflow in read_tag before subtraction from
page_size (prevents wrap-around on large tag indices)
- ESE: explicit guard last_var_id < 128 in variable column parsing
to prevent underflow in offset table size calculation
- VMFS flat VMDK: guard block_size == 0 in resolve_position and Read
impl to prevent division by zero on corrupt superblock
- Truncate decrypted password to UNICODE_STRING.Length bytes (was using
MaximumLength, including garbage padding after the actual data)
- Add decode_password_bytes: hex-encode raw bytes directly for binary
passwords instead of round-tripping through lossy UTF-16LE decode
(char::REPLACEMENT_CHARACTER destroyed original bytes)
- Apply to all providers via decrypt_unicode_string_password_arch and
the SSP-specific CFB-8 variant
- Update CSV/text output to use raw hex for binary passwords
Detail the --vmfs-list device discovery with example output, single-VM
vs auto-scan extraction modes, NTFS partition filtering for batch mode,
and the on-disk resolution chain diagram.
Add documentation for two major new features:
- VMFS-6 raw SCSI device parser that bypasses ESXi file locks on running VMs
- Native Hyper-V .vmrs saved state parser (reverse-engineered, no Microsoft DLL)
On Proxmox (and ESXi with VMFS), reading disk images of running VMs
can hit transient I/O errors on individual sectors/clusters that are
temporarily locked by the hypervisor.
Instead of aborting on the first read error, all NTFS and registry
hive reading paths now use block-level resilient I/O:
- read_from_data_runs: reads 4KB blocks individually, zero-fills
blocks that fail, and continues to the next block
- resilient_read_blocks: MFT batch reads zero-fill failing records
instead of skipping entire batches
- read_file_data (ntfs_reader): falls back to chunked 4KB reads
when exact read fails
- Partition table parsing: skips unreadable GPT entries gracefully
- Hive scanning: skips unreadable chunks instead of aborting scan
- MFTMirr: accepts records without FILE signature check on first
extent (live VMs may have transient I/O on header sectors)
- $ATTRIBUTE_LIST parsing for extension MFT records (large hives)
Tested on Proxmox with running Win11 and DC VMs — extracts SAM/SYSTEM
hives and NTDS.dit successfully despite scattered I/O errors.
Self-contained VMFS-6 parser that reads flat VMDKs directly from raw
SCSI partition devices, bypassing VMFS file locks on running VMs.
Key features:
- Full VMFS-6 on-disk format parsing: LVM, superblock, FDC, SBC, PB/PB2
- Directory traversal with allocation map and entry bitmap support
- Block map building with batched PB reads (320 reads vs 262K individual)
- Sub-block resolution for small files via SBC resource metadata
- Auto-scan mode: enumerates all VMs, skips non-Windows VMDKs
- NTFS-only extraction for fast batch scanning
Verified on ESXi 8.0 datastore: 73 VMDKs scanned in <2min, 4 Windows
VMs with SAM hashes + LSA secrets + DCC2 cached credentials extracted.
SHA1 cross-validation only works for machine accounts (where
ShaOwPassword = SHA1(NTHash)). For human accounts, ShaOwPassword =
SHA1(UTF16LE(password)), so the entropy fallback could pick the wrong
offset variant (reading DPAPI Protected field as NT hash).
Two fixes:
- Track SHA1-validated variant across credentials in same LSASS process
(same Windows build → same offsets). Reuse for subsequent credentials.
- DPAPI cross-check: when isDPAPIProtected=1, reject entropy candidates
whose NT hash matches the DPAPIProtected field at offset 0x6A.
Verified: Administrator NT hash now correct (09f6ff15...) on both
Citrix DC snapshots, matching pypykatz ground truth.
- Extract pKeyList keys even when credential substructure is paged out
- Physical scan for KIWI_KERBEROS_KEYS_LIST_6 structures in LSASS pages
- Match key groups to credentials via RC4 key = NT hash correlation
- Merge Kerberos credentials by username/domain when LUID is unknown
- Remove duplicate DPAPI line (was always same as SHA1)
- Hide all-zero LM hashes in output
- --kirbi <DIR>: export individual .kirbi files per ticket
- --ccache <FILE>: export all tickets as MIT Kerberos ccache v4 format
- Uses actual Kerberos name types from ticket data for ccache principals
- Sanitizes filenames for cross-platform compatibility
Read KIWI_KERBEROS_KEYS_LIST_6 from the session entry's pKeyList
pointer, parse KERB_HASHPASSWORD_6[_1607] entries, decrypt and
extract AES128, AES256, RC4 (NTLM), and DES key material.
Offsets for Win10 1607+, Win10 1507, Win8, and Win7 variants.
Keys are displayed in both text and Display formats.
This closes the gap vs pypykatz which extracts these keys from
minidumps. VMkatz now extracts passwords, keys, and tickets.
Add LUID and username validation to reject phantom sessions caused by
wrong MSV struct offsets being applied to valid memory. Filters:
- LUID must have high 32 bits zero (real Windows LUIDs are 32-bit)
- Username must contain at least one alphanumeric char, no file paths
or control characters
Tested on SilverFort-AD (Server 2022 DC, 32GB): eliminates 3 false
sessions while preserving all 10 legitimate ones.
NK