RegistryHiveLib 1.0.0.26081

<h1 align="center"> <a href="https://github.com/cjhdevact/RegistryHiveLib">RegistryHiveLib - .NET Registry Hive Parser Library</a> </h1>

<p align="center"> Language <a href="ReadMe.md">EN</a> | <a href="ReadMe.CN.md">CN</a> </p>

About

RegistryHiveLib is a .NET library for offline parsing of Windows registry hive files. It supports advanced features such as key traversal, value data reading, SDDL access, and transaction log recovery.

Features

• Complete registry hive parsing (REGF, HBIN, NK, VK, SK, LF/LH/LI/RI, DB records)
• Supports all registry value types
• No Windows Registry API required – safe offline analysis of hive files
• Transaction log recovery (.LOG files)
• Hive metadata (version, checksum, timestamp, clustering factor)
• Security descriptor access (SK records), supports retrieving raw binary data or SDDL strings
• SID translator (pure static dictionary, no system API dependency)
• Extension methods for convenient reading of common data types

Installation

Via NuGet (recommended)

dotnet add package RegistryHiveLib

Or via Visual Studio Package Manager Console:

Install-Package RegistryHiveLib

Download from GitHub Releases

Download the file from the Releases page. You can install it locally via NuGet Package Manager, or extract it directly to obtain RegistryHiveLib.dll and add a reference.

Quick Start

using CJH.RegistryHiveLib;

// 1. Load a hive file
var registry = new Registry(@"C:\Windows\System32\config\SOFTWARE");

// 2. Get the root key
RegistryKey root = registry.Root;

// 3. Traverse subkeys and values
foreach (var subKey in root.Subkeys)
{
    Console.WriteLine($"Key: {subKey.Name}");
    foreach (var value in subKey.Values)
    {
        Console.WriteLine($"  {value.DisplayName} = {value.Value} ({value.ValueTypeString})");
    }
}

// 4. Find a key by path
RegistryKey versionKey = registry.Open("Microsoft\\Windows NT\\CurrentVersion");

// 5. Read values
string productName = versionKey.GetStringValue("ProductName", "Unknown");
uint buildNumber = versionKey.GetDWordValue("CurrentBuild", 0);

Console.WriteLine($"Product Name: {productName}");
Console.WriteLine($"Build Number: {buildNumber}");

// 6. Get security descriptor
string sddl = versionKey.GetSecurityDescriptorSDDL();
if (!string.IsNullOrEmpty(sddl))
{
    Console.WriteLine($"SDDL: {sddl}");
}

// 7. Transaction log recovery
using (var log = new RegistryLog(@"C:\path\to\SYSTEM", @"C:\path\to\SYSTEM.LOG"))
{
    if (log.IsEligibleLog)
    {
        uint? seq = log.RecoverHive();
        Console.WriteLine($"Recovery complete, sequence: {seq}");
    }
}

Documentation

• Chinese version
• English version

Project Structure

RegistryHiveLib/
├── RegistryHiveLib/              # Main library project
│   ├── RegistryHiveLib.cs        # Core library file
│   └── RegistryHiveLib.csproj    # Project file
├── Tools/                        # Auxiliary tool scripts
├── Doc.CN.md                     # Chinese documentation
├── Doc.EN.md                     # English documentation
├── ReadMe.md                     # ReadMe English version
├── ReadMe.CN.md                  # ReadMe Chinese version
├── RegistryHiveLib.sln           # Visual Studio solution
...

References

• RegistryHiveLib - Registry Hive file format specification

• python-registry - Parsing approach referenced from this project

License

This project is open sourced under the MIT License. See the License file for details.

You are free to use, modify, and distribute this software in compliance with the license terms.