Add colored output, blank hash detection, and fix LM hash display

- Add --color auto|always|never for colored terminal output (TTY auto-detect)
- Highlight usernames (bold), hashes (yellow), section headers (green),
  provider names (cyan), plaintext passwords (red), blank hashes (dim)
- Annotate well-known blank password hashes with (blank) in text mode
- Hide zero LM hashes in text mode (mimikatz convention: LM disabled)
- Output aad3b435b51404eeaad3b435b51404ee for zero LM in ntlm/csv modes
  (impacket pwdump convention for downstream tool compatibility)
- Add acknowledgements section for mimikatz, pypykatz, and impacket

Author: nikaiw

README.md

@@ -105,6 +105,10 @@ cargo build --release
 | `hashcat` | `--format hashcat` | Raw hashes: mode 1000 (NTLM), mode 2100 (DCC2) |
 | `csv` | `--format csv` | Machine-readable, all fields |
 
+In `text` mode, well-known blank password hashes (`31d6cfe0...` for NTLM, `aad3b435...` for LM) are annotated with `(blank)`.
+
+Use `--color auto|always|never` to control colored terminal output (default: `auto`, detects TTY). Colors highlight usernames, section headers, interesting hashes, and plaintext passwords.
+
 ## Example Output
 
 ### LSASS extraction (default text)
@@ -129,7 +133,6 @@ $ vmkatz snapshot.vmsn
   LogonServer: YOURPC
   SID: S-1-5-21-4247878743-2693906039-1959858616-1000
   [MSV1_0]
-    LM Hash : 00000000000000000000000000000000
     NT Hash : bbf7d1528afa8b0fdd40a5b2531bbb6d
     SHA1    : 6ed12f1e60b17cfff120d753029314748b58aa05
     DPAPI   : 6ed12f1e60b17cfff120d753029314748b58aa05
@@ -154,9 +157,9 @@ $ vmkatz --ntds /dev/pve/vm-102-disk-0
   Hashes extracted : 18
 
 [+] AD NTLM Hashes:
-  RID: 500    Administrator            current    NT:c66d72021a2d4744409969a581a1705e  LM:00000000000000000000000000000000
-  RID: 502    krbtgt                   current    NT:9c238cafb7b4447e5f701c71dbdcf636  LM:00000000000000000000000000000000
-  RID: 1000   vagrant                  current    NT:e02bc503339d51f71d913c245d35b50b  LM:00000000000000000000000000000000
+  RID: 500    Administrator            current    NT:c66d72021a2d4744409969a581a1705e
+  RID: 502    krbtgt                   current    NT:9c238cafb7b4447e5f701c71dbdcf636
+  RID: 1000   vagrant                  current    NT:e02bc503339d51f71d913c245d35b50b
   ...
 ```
 
@@ -266,3 +269,11 @@ Tested across 7 Windows versions and 4 hypervisors.
 5. **Disk extraction**: Parses the virtual disk container (sparse VMDK, VDI, QCOW2, VHDX, VHD), finds the Windows partition (MBR/GPT), walks NTFS MFT to locate `SAM`, `SYSTEM`, `SECURITY` hives, and decrypts hashes using the boot key.
 
 6. **NTDS extraction**: For domain controllers (`--ntds`), locates `NTDS.dit` and the `SYSTEM` hive on disk, then parses the ESE (JET Blue) database natively. Traverses B+ trees to read the `datatable`, extracts the PEK (Password Encryption Key) using the bootkey, and decrypts NT/LM hashes for every AD account. Supports both 8KB pages (Windows Server 2019 and earlier) and 32KB large pages (Windows Server 2025), as well as RC4 (legacy), AES pre-Win2016, and AES Win2016+ (v0x13) hash blob formats.
+
+## Acknowledgements
+
+VMkatz builds on the foundational work of several projects that mapped out Windows credential internals:
+
+- [**mimikatz**](https://github.com/gentilkiwi/mimikatz) by Benjamin Delpy ([@gentilkiwi](https://twitter.com/gentilkiwi)) -- the original Windows credential extraction tool. mimikatz's source code is the definitive reference for LSASS internals: SSP structures, crypto key resolution, credential decryption across Windows versions. VMkatz's 9-provider extraction pipeline follows the architecture Benjamin documented.
+- [**pypykatz**](https://github.com/skelsec/pypykatz) by Tamas Jos ([@skaborern](https://twitter.com/skaborern)) -- a pure Python reimplementation of mimikatz credential parsing. pypykatz's clean separation of minidump reading from credential decryption informed VMkatz's design, and its SAM/LSA/DCC2 extraction logic served as a cross-reference for offline registry decryption.
+- [**Impacket**](https://github.com/fortra/impacket) by Fortra (originally by Alberto Solino [@agsolino](https://twitter.com/agsolino)) -- the standard Python library for Windows network protocols. Impacket's `secretsdump.py` is the reference implementation for NTDS.dit extraction, SAM dumping, and the pwdump output format that VMkatz's `--format ntlm` follows.

src/lsass/mod.rs

@@ -1,6 +1,7 @@
 pub(crate) mod cloudap;
 pub(crate) mod credman;
 pub(crate) mod crypto;
+pub use crypto::base64_encode;
 pub(crate) mod dpapi;
 pub mod finder;
 pub(crate) mod kerberos;

src/lsass/types.rs

@@ -1,5 +1,5 @@
 /// Convert Windows FILETIME (100-ns ticks since 1601-01-01) to a readable string.
-fn filetime_to_string(ft: u64) -> String {
+pub fn filetime_to_string(ft: u64) -> String {
     if ft == 0 || ft == 0x7FFF_FFFF_FFFF_FFFF {
         return "N/A".to_string();
     }
@@ -57,7 +57,7 @@ fn filetime_to_string(ft: u64) -> String {
 }
 
 /// Human-readable Windows logon type.
-fn logon_type_name(lt: u32) -> &'static str {
+pub fn logon_type_name(lt: u32) -> &'static str {
     match lt {
         0 => "UndefinedLogonType",
         2 => "Interactive",