Извлекает 💻 Windows SAM используя Volume Shadow Copy Service (VSS)
The tool employs NT system calls instead of standard Windows API functions, which might bypass some user-mode API hooks commonly monitored:
▪️NtCreateFile and NtReadFile: Used to open a handle and read the bytes of the SAM and SYSTEM files in the Shadow Copy
▪️NtWriteFile: Used to save the files locally
▪️It uses a custom GetProcAddress implementation to resolve function addresses using only NtReadVirtualMemory
💻 Repo
🔗 Site
#windows #sam #soft
✈️ Whitehat Lab 💬Chat