NK 5bc7e25a76 Fix MSV NT hash offset: detect DPAPI-shifted layout (NT at 0x4A not 0x36) ...

Win10 1607+ (build 19045) stores a 20-byte SHA/DPAPI field at +0x36 before
the actual hashes, shifting NtOwfPassword from +0x36 to +0x4A. Previous code
extracted the first 16 bytes of ShaOwPassword instead of the real NT hash.

Changes:
- Add DPAPI-shifted layout detection in structural_score(): compares data at
  0x36 with data at 0x6A (both contain ShaOwPassword/dppiGenericRandom)
- Add 6 PRIMARY_CRED_OFFSET_VARIANTS: canonical mimikatz (0x36, 0x28, 0x20),
  no-unk (0x30), and empirical DPAPI-shifted (0x4A, 0x4C)
- Replace first-match entropy selection with scored candidates, preferring
  variants with highest structural_score()
- When DPAPI layout detected: variant 0x36 gets score=0, variant 0x4A gets
  score=23 (flags validated + zero LM + DPAPI confirmed)

Verified against pypykatz: NT=bbf7d1528afa8b0fdd40a5b2531bbb6d matches
across all 3 VMware snapshots and VBox snapshot.

2026-02-10 20:51:40 +01:00

src

Fix MSV NT hash offset: detect DPAPI-shifted layout (NT at 0x4A not 0x36)

2026-02-10 20:51:40 +01:00

.gitignore

vmkatz: VM memory forensics tool with LSASS, SAM, and folder modes

2026-02-08 22:02:50 +01:00

Cargo.lock

vmkatz: VM memory forensics tool with LSASS, SAM, and folder modes

2026-02-08 22:02:50 +01:00

Cargo.toml

Add QEMU/KVM/Proxmox ELF core dump and Hyper-V .bin support

2026-02-10 17:39:37 +01:00

Makefile

Add Makefile and improve CLI help/usage

2026-02-09 00:32:09 +01:00

S

Description

Automated archival mirror of github.com/nikaiw/VMkatz

MIT

1.3 MiB

Languages

Rust 99%

Python 0.8%

Makefile 0.2%