Hivetools

Hivetools software is an excellent tool for accessing raw hive files. It is divided into three components: a low-level library (lib), a mid-level library (hivetools), and user programs (bin). The low-level library is designed to emulate the win32 registry API and provides users with access to raw hive files. On the other hand, the mid-level library facilitates the use of the low-level library and provides users with a POSIX-like API as well as functions that operate on data stored within the registry.

The user programs leverage both the mid and low-level libraries, allowing users to perform actions on the registry. There are currently three programs available: regmod, hiveshell, and sam. Regmod allows users to insert and extract .reg (Regedit style) files, while hiveshell provides users with access to an updated chntpw interface; some of the chntpw functionality is still missing from hiveshell at this time. Finally, sam provides access to Security Accounts Manager data, allowing users to retrieve the user list, decode user V,F structures, decode SAM F structure, and perform password crypto functions.

The mid-level library is located in the hivetools directory and is designed to make registry access more manageable. It currently provides registry access through a more POSIX-like interface, providing useful functions such as ns_open, ns_opendir, ns_readdir, ns_rewinddir, ns_mkdir, ns_unlink, ns_exists, and more.

The low-level library provides users with functions that emulate the windows registry API, such as rlRegOpenHiveFile, rlRegOpenKeyEx, rlRegQueryValueEx, rlRegEnumKeyEx, rlRegEnumValue, rlRegSetValueEx, rlRegCreateKeyEx, rlRegQueryInfoKey, rlRegQueryMultipleValues, rlRegCloseKey, rlRegFlushKey, rlRegDeleteKey, and rlRegDeleteValue.

In the newest release of Hivetools software, users can expect vastly improved Unicode support, along with various bug fixes. Additionally, a new tool, proftool, has been added to aid in manual profile migration. Overall, Hivetools software is an excellent resource for anyone needing to access or manipulate registry data.