I noticed that Windows 10 x86 build 19043 does not work (neither does in mimikatz, to be fair)
I intended to make a PR but I just lack the understanding to provide you with fully functional code, I can give you some suggestions though.
Once parsed, the hardkey ends up being empty and that breaks every calculation that follows.
I found that adding an unknown field number 10 appears to "fix" this:
Notice that the elif will be true if the build number is greater than 9800, which it is since this Windows build is 19043
The final "else" branch will never be called.
I found that if that branch is instead used, the signature is properly found and the wdigest data is parsed without errors.
To presenting what it appears to be legitimate information. I can't say for sure that the output is indeed correct or if these changes work for many other builds of Windows.
I hope you find this helpful and that I made it a little easier to better implement support for 32-bit Windows machines 😄
I have uploaded the minidump file that I used for this with the name: windows_10_x86_build_19043.dmp
Let me know if I can help you with anything.
I noticed that Windows 10 x86 build 19043 does not work (neither does in mimikatz, to be fair) I intended to make a PR but I just lack the understanding to provide you with fully functional code, I can give you some suggestions though.
First of all, some background:
Encryption keys (AES and DES)
in
pypykatz/lsadecryptor/lsa_template_nt6.py:296
we can find this structure:Once parsed, the hardkey ends up being empty and that breaks every calculation that follows. I found that adding an unknown field number 10 appears to "fix" this:
wdigest signature
in
pypykatz/lsadecryptor/packages/wdigest/decryptor.py:73
the signature is set with this piece of code:Notice that the elif will be true if the build number is greater than 9800, which it is since this Windows build is 19043 The final "else" branch will never be called. I found that if that branch is instead used, the signature is properly found and the wdigest data is parsed without errors.
result
You go from crashing with this:
To presenting what it appears to be legitimate information. I can't say for sure that the output is indeed correct or if these changes work for many other builds of Windows. I hope you find this helpful and that I made it a little easier to better implement support for 32-bit Windows machines 😄
I have uploaded the minidump file that I used for this with the name:
windows_10_x86_build_19043.dmp
Let me know if I can help you with anything.