blob: 5e86e41ba8481378d067a99af9702779a90f9502 (
plain)
1
2
3
4
5
6
7
8
9
10
11
|
# ImHex Patterns
You can use these pattern files with [ImHex](https://github.com/WerWolv/ImHex) to view contents of various SPP-related files.
## Pattern List
- `variablebag` - For product key blobs in physical store/`cache.dat`
- `tokenstore` - For `tokens.dat`
- `win7_physstore`/`winmodern_physstore` - For decrypted Windows 7/Windows 8+ physical store
Physical store can be decrypted with TSforge `/dump` option, ex. `tsforge /dump out.dat` on live system or `tsforge /dump out.dat in.dat` for physical store from offline system.
|
