mkorman90 / regipy

Regipy is an os independent python library for parsing offline registry hives
MIT License
244 stars 53 forks source link

Add boot key extraction plugin #188

Closed ravenexp closed 3 years ago

ravenexp commented 3 years ago

The boot key is an encryption key that is stored in the Windows SYSTEM registry hive.

This key is used by several Windows components to encrypt sensitive information like the AD database, machine account password or system certificates etc.

Add a new NKRecord method for reading registry key class name strings.