Manticore is the Go library of offensive and defensive security primitives that The Manticore Project’s tools are built on: SMB, LDAP, Kerberos, DCE/RPC, and the Windows data types that hold them together. Most of the work in a release like this happens below the surface, in the wire encoders that have to match exactly what a real Windows server expects.
In v1.1.1 I focused on three things: bringing the NDR codec up to NDR64 so DCE/RPC interfaces negotiate the transfer syntax modern Windows servers prefer, landing a new ms_rrp package with a Remote Registry client and a real Windows .reg file parser, and a handful of correctness improvements around Kerberos SPNs, SMB security descriptors, and GUID handling.
NDR64 across the codec
The bulk of this release is NDR64. DCE/RPC marshals its parameters with the Network Data Representation (NDR) transfer syntax, and modern Windows endpoints prefer NDR64, a 64-bit variant with different alignment, pointer, and primitive-width rules. Supporting it is what lets Manticore talk to a current domain controller the way its own clients do.
I started by adding NDR64 transfer-syntax plumbing to the codec (#593), then landed the NDR64 walker and client negotiation on main (#598) so a connection can actually advertise and agree on NDR64 during the bind. From there the work was getting the wire format exactly right: fixing NDR64 enum width to four octets (#603) and tagging the DCE/RPC enum fields so they encode correctly (#608), fixing GUID encoding to a full 16 octets (#606), and fixing the LSAPR_OBJECT_ATTRIBUTES pointer encoding (#600). I also added discriminated-union support (#605) and pipe support (#609), which are needed for the more complex interfaces.
Because NDR64 bugs are subtle and silent, the testing strategy matters as much as the code. I added a wire-anchored golden test for LsarOpenPolicy (#601) so the encoder is pinned against a known-good byte stream, and then replaced the originally captured server data with synthetic vectors (#610) so the test suite stays self-contained and reproducible without leaking live-environment artifacts.
Remote Registry and a Windows .reg file parser
The headline feature is registry support. I added a new ms_rrp protocol package implementing the MS-RRP Windows Remote Registry interface, including a RemoteRegistry client (#611). This lets Manticore-based tooling read and manipulate the registry of a remote Windows host over DCE/RPC, which is useful for both enumeration and configuration auditing.
On top of that I added .reg file encode/decode support (#617). The Windows .reg format has its own quirks (UTF-16 encoding, typed value prefixes such as hex(2) and dword, and continuation lines), and being able to parse and emit it means registry data pulled over the wire can be serialized to the same format an analyst already knows, while existing .reg exports can be loaded back into tooling.
Kerberos SPNs, SMB security descriptors, and GUID types
A few smaller changes round out the release. I implemented a Kerberos Service Principal Name (SPN) parser and validator (#597). SPNs (service/host:port/servicename) are everywhere in Active Directory work, including Kerberoasting, delegation targets, and ticket requests, and having a single component that parses and validates them avoids the ad-hoc string handling that tends to accumulate in individual tools.
I also exposed the security-descriptor query on the generic SMB client (#592), so callers can retrieve the NtSecurityDescriptor of a share or file without reaching for a specialized code path. Finally, I continued migrating GUID fields to the canonical dtyp.GUID type for the DFS and svcctl interfaces (#607). This goes together with the NDR64 GUID encoding fix and keeps a single, correct representation of GUIDs throughout the codebase.