mirror of
https://github.com/nikaiw/VMkatz
synced 2026-09-25 07:51:06 +00:00
NK
61858889e4
When file-backed resolution provides lsasrv.dll .text section, the key init pattern is found but .data globals read as 0 (pages paged out). Previously, the .data section fallback was only triggered when the .text pattern wasn't found — not when all offset sets failed. Changes: - Fall through to .data section scan when all 7 offset sets fail (some .data pages may be accessible as transition pages even when the specific globals referenced by the pattern are paged out) - Add physical UUUR scan as third-level fallback: enumerate all present+transition LSASS pages for BCRYPT_HANDLE_KEY structures, bypassing .data globals entirely - Wire physical scan fallback in finder.rs VBox results: crypto keys now extracted via .data fallback, enabling MSV1_0 hash extraction (previously failing with "Invalid BCrypt handle pointer: 0x0"). Pagefile resolves 998 pages (up from 0).