Create README.md
This commit is contained in:
parent
ce01862459
commit
bfc74e9d19
11
patterns/README.md
Normal file
11
patterns/README.md
Normal file
@ -0,0 +1,11 @@
|
|||||||
|
# ImHex Patterns
|
||||||
|
|
||||||
|
You can use these pattern files with [ImHex](https://github.com/WerWolv/ImHex) to view contents of various SPP-related files.
|
||||||
|
|
||||||
|
## Pattern List
|
||||||
|
|
||||||
|
- `variablebag` - For product key blobs in physical store/`cache.dat`
|
||||||
|
- `tokenstore` - For `tokens.dat`
|
||||||
|
- `win7_physstore`/`winmodern_physstore` - For decrypted Windows 7/Windows 8+ physical store
|
||||||
|
|
||||||
|
Physical store can be decrypted with TSforge `/dump` option, ex. `tsforge /dump out.dat` on live system or `tsforge /dump out.dat in.dat` for physical store from offline system.
|
Loading…
x
Reference in New Issue
Block a user