massgrave/spp-stuff
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Create README.md

Browse Source
This commit is contained in:
WitherOrNot 2025-02-13 18:56:24 -05:00 committed by GitHub
parent ce01862459
commit bfc74e9d19
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
1 changed files with 11 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
patterns/README.md Normal file
View File

@ -0,0 +1,11 @@
# ImHex Patterns
You can use these pattern files with [ImHex](https://github.com/WerWolv/ImHex) to view contents of various SPP-related files.
## Pattern List
- `variablebag` - For product key blobs in physical store/`cache.dat`
- `tokenstore` - For `tokens.dat`
- `win7_physstore`/`winmodern_physstore` - For decrypted Windows 7/Windows 8+ physical store
Physical store can be decrypted with TSforge `/dump` option, ex. `tsforge /dump out.dat` on live system or `tsforge /dump out.dat in.dat` for physical store from offline system.