NK 00802654c4 Add pagefile.sys resolution for paged-out LSASS memory ...

When a VM directory contains both memory snapshots and disk images,
open pagefile.sys from the VMDK/VDI/QCOW2 disk to resolve pages
that Windows swapped out. Uses pre-built NTFS data run map with
RefCell<Box<dyn DiskImage>> for interior mutability.

- PTE pagefile detection (bits 0/10/11 + pagefile number/offset)
- PageFileFault error variant in page table walker
- PagefileReader: opens disk, extracts pagefile.sys data runs,
  binary-search page resolution
- --disk CLI option for explicit disk image in single-file mode
- Folder mode auto-discovers disk and opens pagefile automatically
- Feature-gated behind "sam" (requires NTFS + disk image support)

2026-02-09 03:44:41 +01:00

src

Add pagefile.sys resolution for paged-out LSASS memory

2026-02-09 03:44:41 +01:00

.gitignore

vmkatz: VM memory forensics tool with LSASS, SAM, and folder modes

2026-02-08 22:02:50 +01:00

Cargo.lock

vmkatz: VM memory forensics tool with LSASS, SAM, and folder modes

2026-02-08 22:02:50 +01:00

Cargo.toml

vmkatz: VM memory forensics tool with LSASS, SAM, and folder modes

2026-02-08 22:02:50 +01:00

Makefile

Add Makefile and improve CLI help/usage

2026-02-09 00:32:09 +01:00

S

Description

Automated archival mirror of github.com/nikaiw/VMkatz

MIT

1.3 MiB

Languages

Rust 99%

Python 0.8%

Makefile 0.2%