quarkspwdump
quarkspwdump copied to clipboard
Added offline SYSKEY support and fixed memory issues
Added offline SYSKEY extraction to support offline NTDS.dit parsing from another machine. This feature required adding an extra parameter (-sf/--system-file) which accepts a SYSTEM file as its argument. Also, changed all references to VirtualAlloc/Free to malloc/free to reduce memory consumption. VirtualAlloc allocates a minimum of 64kb. Most fields within the ldap* structure are only a few bytes long which means that the remaining space would be wasted. For large NTDS.dit files, the parser would fail when calling VirtualAlloc with an 'out of memory' error. This change fixes these issues.