Extracting Password for SAM

I was wondering if anybody knew the organization of the window's SAM file? Sure you can get a program (Cain, Ophcrack, etc) to get the password for you, but where in the file do they get this.

My hope is that I can write my own program to extract the NT or LM hashes and so that's why i'd like to know. Couldn't find anything helpful with a hex-editor or google-fu.

Samdump2 and bkhive are open source tools, perhaps you could take a look at those tools.

Furthermore, this page contained a link to this page, which contains a lot of info about the SAM file. You should take a look. ;-)

I would be interested to see what you find. You should write an article about SAM structure if you have the time :happy: