Doesn't like my files about hiveswarming HOT 3 CLOSED

Hello

In this first answer I will focus on the reg to hive conversion.

There are three problems that are encountered here:

1. There are two empty lines after the preamble (there should be a single empty line)
2. There are multiple roots in the hive (machine and user). Try to edit the registry file and to replace [] with [ROOT], all instances of [machine with [ROOT\machine, and all instances of [user by [ROOT\user
3. Hexadecimal representations are not indented by two leading spaces in the continuation lines. The exported .reg file is not conformant to what reg.exe produces itself, and HiveSwarming is not really lax about that.

The following image shows what you can modify in your reg file for it to work with the current version of HiveSwarming.

I will try to fix those problems by Accepting an empty root name and relaxing parsing of the reg file.

from hiveswarming.

In the second answer, I focus on the first problem: exporting a hive to a reg file.

The problem here is that you have the key user\current\software\classes that is a symbolic link (the registry key has a special flag, and there is a special value named SymbolicLinkValue). Registry symbolic links are not currently supported by this version of Hiveswarming. There is probably no “correct” way to support them, but at least we could try to not fail when encountering a symlink.

I will also try to fix this soon.

from hiveswarming.

Hello.

Version 1.2 should fix the problem with symbolic links.

You can use HiveSwarming as a unique tool to convert from hive to .reg back and forth.

Please note that during the testing of this fix, I identified a bug in RegFileExport, which is that backslashes (\) in value names are not properly escaped while generating the .reg output.

from hiveswarming.