A collection of python scripts to work with Windows Hives.

Via python venv (on Ubuntu, you might need sudo apt install python3-venv first)

python3 -m venv ~/venv_hive
source ~/venv_hive/bin/activate
python3 -m pip install --upgrade pip
python3 -m pip install python-registry
python3 -m pip install rich

• Get a specific key in a hive:

  ./hive-get-keys.py -H ./examples/hives/SAM -k 'SAM\Domains\Builtin\Aliases\Members\S-1-5-21-877132822-430060850-1589397531\000001F4\(default)'
  

• Exporting a hive to JSON:

  ./hive-to-json.py --hive ./examples/hives/SYSTEM -o ./examples/json/SYSTEM.json
  

Pull requests are welcome. Feel free to open an issue if you want to add other features.

• http://sentinelchicken.com/data/TheWindowsNTRegistryFileFormat.pdf
• https://github.com/msuhanov/regf/blob/master/Windows%20registry%20file%20format%20specification.md