Instantly share code, notes, and snippets.

Embed
What would you like to do?
#!/usr/bin/env python3
from yarp import *
import sys
if len(sys.argv) != 2:
sys.exit('No file specified!')
with open(sys.argv[1], 'rb') as hive_file:
hive = Registry.RegistryHive(hive_file)
cit_key = hive.find_key('Microsoft\\Windows NT\\CurrentVersion\\AppCompatFlags\\CIT\\System')
if cit_key is None:
sys.exit('No CIT\\System key found in the hive specified!')
for cit_value in cit_key.values():
data = cit_value.data_raw()
if len(data) <= 8:
continue
compressed_data = data[8 : ]
# This is an ugly hack to get the decompression code working without CyXpress.
if len(compressed_data) < RegistryHelpers.NTFS_CLUSTER_SIZE:
compressed_data += b'\x00' * (RegistryHelpers.NTFS_CLUSTER_SIZE - len(compressed_data))
decompressed_data = RegistryHelpers.NTFSDecompressUnit(compressed_data)
dump_name = '{}.bin'.format(cit_value.name())
with open(dump_name, 'wb') as dump_file:
dump_file.write(decompressed_data)
print('Wrote: {}'.format(dump_name))
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment