skelsec / pypykatz

Mimikatz implementation in pure Python
MIT License
2.82k stars 373 forks source link

Error "signature not found!" - lsass dmp linked #49

Closed WaiZ0 closed 4 years ago

WaiZ0 commented 4 years ago

Hi, While dumping the lsass process with lsassy I encountered a signature error as it was not found. So I dump the lsass localy to give it to you in case you want to implement it ! :)

Here is the build of the remote server: image

Here is the error: image

And here is the lsass dump: lsass_pypykatz.zip

Thank you for your awesome work, I hope this will be usefull :D

skelsec commented 4 years ago

Thank you for your contribution, however the current version parses the file you submitted correctly. The exception and warning messages are normal operation in the current version, and it will halt completely if absolutely no signature can be found.
In case anyone interested as on why this is normal: the signatures are not always corresponding to buildversion/majdorversion info therefore some guessing must be done to support more versions rather than only hardcode the buildversion-signature pairs which will render some dumps unparsable.

WaiZ0 commented 4 years ago

Oh I see, so the signature expected to be found, with some "fingerprinting" I guess, are not found therefore you try with other signature, thank you for letting me know !