massgrave/spp-stuff
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
bfc74e9d1958397620f332f9c9ec3eeaf439a6ca
spp-stuff/patterns
History
WitherOrNot bfc74e9d19 Create README.md
2025-02-13 18:56:24 -05:00
..
README.md
Create README.md
2025-02-13 18:56:24 -05:00
tokenstore.pat
Add files via upload
2025-02-13 18:52:21 -05:00
variablebag.pat
Add files via upload
2025-02-13 18:52:21 -05:00
win7_physstore.pat
Add files via upload
2025-02-13 18:52:21 -05:00
winmodern_physstore.pat
Add files via upload
2025-02-13 18:52:21 -05:00

README.md

ImHex Patterns

You can use these pattern files with ImHex to view contents of various SPP-related files.

Pattern List

  • variablebag - For product key blobs in physical store/cache.dat
  • tokenstore - For tokens.dat
  • win7_physstore/winmodern_physstore - For decrypted Windows 7/Windows 8+ physical store

Physical store can be decrypted with TSforge /dump option, ex. tsforge /dump out.dat on live system or tsforge /dump out.dat in.dat for physical store from offline system.