mirror of
https://github.com/nikaiw/VMkatz
synced 2026-09-25 07:51:06 +00:00
NK
00b9b2980d
- Bypass Select key requirement: try ControlSet001/002/003 directly when Select key is missing from fragmented SYSTEM hive - Phase 2c gating: detect small SYSTEM hives (< 512KB) from Phase 2b and allow fragmented assembly to try building a larger hive - Relax SYSTEM hive validation: accept ControlSet001/002 in addition to Select for both build_hive_from_hbins and validate_hive_content - Add brute-force NK cell scan: when tree navigation fails, scan all cells in assembled hive for JD/Skew1/GBG/Data bootkey components - Add read_class_hex helper for UTF-16LE class name cell decoding