BYOVD Kernel R/W to redirect an existing File handle's object pointer to ntds.dit's _FILE_OBJECT in kernel memory. No CreateFile on the hive, no lsass, no Shadow Copy. Read the live DC hive directly through the redirected handle and dumped offline: plaintext creds + domain hashes
