NK 387c61bdb6 Fix PID 0 garbage in process listing and improve SAM scan resilience ...

- Skip PID 0 (System Idle Process) in enumeration: has no valid DTB,
  PEB, or name, only adds noise to the listing
- Filter ImageFileName to printable ASCII to prevent replacement
  characters from non-UTF8 bytes (e.g. 0xFF fill in Idle process)
- Add hbin-based fallback scan for NTFS-fragmented hives where regf
  header and hbin data are at non-contiguous disk locations
- Validate hive sizes: reject SYSTEM < 512KB and SAM < 16KB to avoid
  false matches (e.g. 28KB volatile "System" hive)

2026-02-08 22:44:50 +01:00

src

Fix PID 0 garbage in process listing and improve SAM scan resilience

2026-02-08 22:44:50 +01:00

.gitignore

vmkatz: VM memory forensics tool with LSASS, SAM, and folder modes

2026-02-08 22:02:50 +01:00

Cargo.lock

vmkatz: VM memory forensics tool with LSASS, SAM, and folder modes

2026-02-08 22:02:50 +01:00

Cargo.toml

vmkatz: VM memory forensics tool with LSASS, SAM, and folder modes

2026-02-08 22:02:50 +01:00

S

Description

Automated archival mirror of github.com/nikaiw/VMkatz

MIT

1.3 MiB

Languages

Rust 99%

Python 0.8%

Makefile 0.2%