RegistryHiveLib is a .NET library for offline parsing of Windows registry hive files. It supports advanced features such as key traversal, value data reading, SDDL access, and transaction log recovery.
- Complete registry hive parsing (REGF, HBIN, NK, VK, SK, LF/LH/LI/RI, DB records)
- Supports all registry value types
- No Windows Registry API required – safe offline analysis of hive files
- Transaction log recovery (.LOG files)
- Hive metadata (version, checksum, timestamp, clustering factor)
- Security descriptor access (SK records), supports retrieving raw binary data or SDDL strings
- SID translator (pure static dictionary, no system API dependency)
- Extension methods for convenient reading of common data types
dotnet add package RegistryHiveLib
Or via Visual Studio Package Manager Console:
Install-Package RegistryHiveLib
Download the file from the Releases page. You can install it locally via NuGet Package Manager, or extract it directly to obtain RegistryHiveLib.dll and add a reference.
using CJH.RegistryHiveLib;
// 1. Load a hive file
var registry = new Registry(@"C:\Windows\System32\config\SOFTWARE");
// 2. Get the root key
RegistryKey root = registry.Root;
// 3. Traverse subkeys and values
foreach (var subKey in root.Subkeys)
{
Console.WriteLine($"Key: {subKey.Name}");
foreach (var value in subKey.Values)
{
Console.WriteLine($" {value.DisplayName} = {value.Value} ({value.ValueTypeString})");
}
}
// 4. Find a key by path
RegistryKey versionKey = registry.Open("Microsoft\\Windows NT\\CurrentVersion");
// 5. Read values
string productName = versionKey.GetStringValue("ProductName", "Unknown");
uint buildNumber = versionKey.GetDWordValue("CurrentBuild", 0);
Console.WriteLine($"Product Name: {productName}");
Console.WriteLine($"Build Number: {buildNumber}");
// 6. Get security descriptor
string sddl = versionKey.GetSecurityDescriptorSDDL();
if (!string.IsNullOrEmpty(sddl))
{
Console.WriteLine($"SDDL: {sddl}");
}
// 7. Transaction log recovery
using (var log = new RegistryLog(@"C:\path\to\SYSTEM", @"C:\path\to\SYSTEM.LOG"))
{
if (log.IsEligibleLog)
{
uint? seq = log.RecoverHive();
Console.WriteLine($"Recovery complete, sequence: {seq}");
}
}RegistryHiveLib/
├── RegistryHiveLib/ # Main library project
│ ├── RegistryHiveLib.cs # Core library file
│ └── RegistryHiveLib.csproj # Project file
├── Tools/ # Auxiliary tool scripts
├── Doc.CN.md # Chinese documentation
├── Doc.EN.md # English documentation
├── ReadMe.md # ReadMe English version
├── ReadMe.CN.md # ReadMe Chinese version
├── RegistryHiveLib.sln # Visual Studio solution
...
-
Timothy D. Morgan - The Windows NT Registry File Format - Registry Hive file format specification
-
python-registry - Parsing approach referenced from this project
This project is open sourced under the MIT License. See the License file for details.
You are free to use, modify, and distribute this software in compliance with the license terms.