Repository files navigation

A collection of python scripts to work with Windows Hives.

Via python venv (on Ubuntu, you might needsudo apt install python3-venv first)

python3 -m venv ~/venv_hivesource ~/venv_hive/bin/activatepython3 -m pip install --upgrade pippython3 -m pip install python-registrypython3 -m pip install rich

• Get a specific key in a hive:

  ./hive-get-keys.py -H ./examples/hives/SAM -k 'SAM\Domains\Builtin\Aliases\Members\S-1-5-21-877132822-430060850-1589397531\000001F4\(default)'

• Exporting a hive to JSON:

  ./hive-to-json.py --hive ./examples/hives/SYSTEM -o ./examples/json/SYSTEM.json

Pull requests are welcome. Feel free to open an issue if you want to add other features.

• http://sentinelchicken.com/data/TheWindowsNTRegistryFileFormat.pdf
• https://github.com/msuhanov/regf/blob/master/Windows%20registry%20file%20format%20specification.md