massgrave/spp-stuff
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
spp-stuff/patterns/README.md
WitherOrNot bfc74e9d19
Create README.md
2025-02-13 18:56:24 -05:00

541 B
Raw Blame History

ImHex Patterns

You can use these pattern files with ImHex to view contents of various SPP-related files.

Pattern List

  • variablebag - For product key blobs in physical store/cache.dat
  • tokenstore - For tokens.dat
  • win7_physstore/winmodern_physstore - For decrypted Windows 7/Windows 8+ physical store

Physical store can be decrypted with TSforge /dump option, ex. tsforge /dump out.dat on live system or tsforge /dump out.dat in.dat for physical store from offline system.