Closed Dethada closed 5 years ago
Reason for this parameter to exist: In order to choose the correct structure for parsing we need the tiomestamp timestamp info of the msv dll file. Rekall sadly doesnt always have this info for some reason, therefore the parsing may be failing.
thx
https://github.com/skelsec/pypykatz#why-do-i-need-these-dumps-files
In order to create mimikatz in Python one would have to create structure ~difinitions~ definitions of a gazillion different structures...