12 lines
541 B
Markdown
12 lines
541 B
Markdown
|
# ImHex Patterns
|
||
|
|
|
||
|
|
You can use these pattern files with [ImHex](https://github.com/WerWolv/ImHex) to view contents of various SPP-related files.
|
||
|
|
|
||
|
|
## Pattern List
|
||
|
|
|
||
|
|
- `variablebag` - For product key blobs in physical store/`cache.dat`
|
||
|
|
- `tokenstore` - For `tokens.dat`
|
||
|
|
- `win7_physstore`/`winmodern_physstore` - For decrypted Windows 7/Windows 8+ physical store
|
||
|
|
|
||
|
|
Physical store can be decrypted with TSforge `/dump` option, ex. `tsforge /dump out.dat` on live system or `tsforge /dump out.dat in.dat` for physical store from offline system.
|