spp-stuff/patterns

ImHex Patterns

You can use these pattern files with ImHex to view contents of various SPP-related files.

Pattern List

• variablebag - For product key blobs in physical store/cache.dat
• tokenstore - For tokens.dat
• win7_physstore/winmodern_physstore - For decrypted Windows 7/Windows 8+ physical store

Physical store can be decrypted with TSforge /dump option, ex. tsforge /dump out.dat on live system or tsforge /dump out.dat in.dat for physical store from offline system.