systemreg

Documentation

Overview

Package systemreg provides a wrapper around the SYSTEM registry.

Index

• type SystemRegistry
  • func NewFromFile(path string) (*SystemRegistry, error)
  • func (s *SystemRegistry) Syskey() ([]byte, error)

Types

type SystemRegistry

type SystemRegistry struct {
	registry.Registry
}

SystemRegistry is a wrapper around a SYSTEM registry.

func NewFromFile

func NewFromFile(path string) (*SystemRegistry, error)

NewFromFile creates a new SystemRegistry from a file.

func (*SystemRegistry) Syskey

func (s *SystemRegistry) Syskey() ([]byte, error)

Syskey returns the syskey used to decrypt user hashes. The syskey is stored as UTF16-le encoded hexadecimal in the class name of the 4 registry keys denoted by `syskeyPaths`. Once the hexadecimal is decoded, the result is still obfuscated and the order of the bytes needs to be swapped using the indexes detonated in the `transforms` table.