mirror of
https://github.com/nikaiw/VMkatz
synced 2026-09-25 07:51:06 +00:00
NK
d616a62775
LSASS credential extraction: - Minidump (.dmp) support: full MSV/Kerberos/DPAPI/WDigest/TsPkg/SSP/ LiveSSP/CredMan/CloudAP extraction from LSASS minidumps - Pre-Vista (WinXP/Win2003): 32-bit EPROCESS, PAE paging, DES-X-CBC/RC4 - Win11 24H2 (26100+): correct EPROCESS offsets, MSV LIST_64/LIST_65, Kerberos variant with shifted offsets - All MSV/SSP/LiveSSP/CloudAP/CredMan/WDigest offsets verified against mimikatz C structs and pypykatz templates - EPROCESS offsets verified against Vergilius Project (13 variants) - AES-CFB-128 cipher for non-8-aligned LSASS blobs - DPAPI extraction from dpapisrv.dll (Win10 19041+ moved g_MasterKeyCacheList) - Adaptive MSV offset discovery with build-number-aware variant ordering - MSV NT hash fix: validated variant tracking + DPAPI cross-check for human accounts (SHA1 validation only works for machine accounts) - Kerberos: AES/DES/RC4 key extraction, kirbi/ccache export, ticket quality validation, false positive filtering - CloudAP: PRT blob extraction, 7 patterns covering Win10 1507–Win11 24H2 - CredMan: correct 2-level navigation (SET_LIST→STARTER→entry) - Garbage filtering: repeating pattern detection, structural score validation, unknown etype rejection Architecture: - Carve mode: two-level degraded extraction for truncated memory files - sam/mod.rs split into 4 submodules (partition, ntfs_reader, disk_fallbacks, vmdk_scan) - ProviderStatus enum replacing string-based status tracking - Safe read helpers (utils.rs) replacing 86 try_into().unwrap() calls - GovmemError renamed to VmkatzError across all 35 source files - Named paging constants (PAGE_PHYS_MASK, LARGE_*_MASK) Performance: - TLB cache for page table translation (256-entry direct-mapped) - QCOW2 L2 table caching (64 tables, amortized I/O) - VMware region binary search (partition_point) - Stack-allocated ASN.1 length encoding, IV entropy histogram - Single-pass System process + EPT scanning - memchr::memmem for pattern matching Robustness: - Minidump parser hardening (bounds checks, overflow protection) - PE32 validation (machine type, section count, optional header size) - Multiple pagefile support (PTE pagefile_number routing) - VMware embedded memory support (.vmss/.vmsn without .vmem) - EPT false positive prevention (reserved bits, PDPT validation) - VMEM truncation detection with user warning Testing: - 8 automated tests (4 unit + 4 integration) - Non-regression framework: compare.py + esxi_test.sh - All credentials verified against pypykatz on 10+ minidumps CLI: - --all/-a: show empty sessions (hidden by default) - --no-ept: skip EPT scanning - --kirbi/--ccache: Kerberos ticket export - Silent output modes: ntlm, hashcat, text summary - Hex display for non-printable machine account passwords