Reg Hive Parser is an entirely JavaScript-based tool for parsing Windows Registry hive files, such as the NTUSER.dat file in the user prfiles, enhancing the security of the analysis process. The tool does not rely on any third-party libraries as dependencies. You can involve it in Node.js by using CommonJS or ESM. Furthermore, it is compatible with web browsers. To get a firsthand experience, simply click here.
The parser is implemented based on this format specification. We appreciate the hard work and dedication of the author, whose efforts have made this project possible.
NPM: see here.
npm install reg-hive-parser
const { parse } = require('reg-hive-parser')
;(async () => {
const parsed = await parse('path/to/hive.dat', { recurse: true })
console.log(parsed)
})()
import { parse } from 'reg-hive-parser'
;(async () => {
const parsed = await parse('path/to/hive.dat', { recurse: true })
console.log(parsed)
})()
<input type="file" />
<script src="./node_modules/reg-hive-parser/dist/index.umd.js"></script>
<script>
const { parse } = regHiveParser
const input = document.querySelector('input')
input.addEventListener('change', e => {
const file = e.target.files[0]
const reader = new FileReader()
reader.onload = async e => {
const parsed = await parse(e.target.result, {
recurse: false
})
console.log(parsed)
}
reader.readAsArrayBuffer(file)
})
<script>
Parses a Windows Registry hive file and returns a parsed object.
Type: String
, ArrayBuffer
(browser) or Buffer
(nodejs)
If the argument is a String
type, it represents the path of the hive file. Please note that this functionality is not supported in web browsers.
If the argument is an ArrayBuffer
(for browsers) or a Buffer
(for Node.js), it corresponds to the content of the file data.
Type: Object
Type: Boolean
Default: false
If true
, the parser will recursively parse subkeys. To efficiently parse large hive files, we recommend setting the recurse
parameter to false
in order to minimize latency.
Type: Boolean
Default: true
If set false
, the parser returns the raw parsed object of each node. Here is the example.
{
"signature": "regf",
"primarySeqNum": 1446218,
"secondarySeqNum": 1446218,
"majVer": 1,
"minVer": 5,
"fileType": 0,
"fileFormat": 1,
"rootCellOffset": 32,
"root": {
"size": 88,
"signature": "nk",
"keyNameLength": 4,
"classNameLength": 0,
"keyNameString": "ROOT",
"virtualControlFlags": {
"number": 0,
"dontVirtualize": false,
"dontSilentFail": false,
"recurseFlag": false
}
// ...
},
// ...
}
If set true
, the parser simplifies the parsed object. Here is the example.
{
"base": {
"signature": "regf",
"primarySeqNum": 1446218,
"secondarySeqNum": 1446218,
// ...
},
"root": {
"type": "key",
"name": "root",
"children": [
{
"type": "key",
"name": "AppEvents",
"children": [
// ...
]
},
{
"type": "value",
"name": "",
"valType": "REG_SZ",
"val": "Default Beep"
}
// ...
]
}
}
Note: if the recurse
parameter is set to false
and the simplify
parameter is set to true
, the following behavior is observed:
- For each simplified key node, the
children
property will always be an empty array. - For each simplified value node, the
val
property will always benull
. - Each node will include a
parse
function. - Invoking the
parse
function on a key node will return the children of the key. - Invoking the
parse
function on a value node will return the data content of the value.
Type: Function
Default: () => undefined
You have the flexibility to add any property that you are interested in to the simplified object. This allows you to include additional information or customize the structure according to your specific needs. By extending the simplified object, you can enhance its functionality and tailor it to suit your requirements. Here is the example.
await parse(e.target.result, {
recurse: false,
simplify: true,
extra: raw => ({ signature: raw.signature })
})
This will add the signature
property to each simplified object.
{
"base": {
// ...
},
"root": {
"extra": {
"signature": "nk"
},
"type": "key",
"name": "root",
"children": [
{
"extra": {
"signature": "nk"
},
"type": "key",
"name": "AppEvents",
"children": [
// ...
]
},
{
"extra": {
"signature": "vk"
},
"type": "value",
"name": "",
"valType": "REG_SZ",
"val": "Default Beep"
}
// ...
]
}
}
This project is licensed under the MIT license.