# ImHex Patterns

You can use these pattern files with [ImHex](https://github.com/WerWolv/ImHex) to view contents of various SPP-related files.

## Pattern List

 - `variablebag` - For product key blobs in physical store/`cache.dat`
 - `tokenstore` - For `tokens.dat`
 - `win7_physstore`/`winmodern_physstore` - For decrypted Windows 7/Windows 8+ physical store

Physical store can be decrypted with TSforge `/dump` option, ex. `tsforge /dump out.dat` on live system or `tsforge /dump out.dat in.dat` for physical store from offline system.