hivexget(1)

💅 hivexget — the low-level Windows Registry hive extractor, bestie edition 🎀

okay so picture this: you have a Windows Registry binary "hive" file just sitting there, and you need to pull a subkey out of it. that's literally what hivexget does. it's the manual page for hivexget, and we're gonna get through it together, no cap. ✨

🌸 SYNOPSIS 🌸

hivexget hivefile '\Path\To\SubKey'

hivexget hivefile '\Path\To\SubKey' name

two whole forms, two whole vibes. pick your fighter. 🫶

---

🦋 NOTE 🦋

okay real talk, this is a low-level tool. like, it's giving "I know what I'm doing" energy, not "casual Sunday browsing" energy.

if you want a more convenient way to navigate the Windows Registry in Windows virtual machines, go look at virt-win-reg(1) instead — that's the user-friendly bestie. 💖

and if you want proper regedit formatting, use hivexregedit(1). it understands formatting. this one does not. periodt.

---

💜 DESCRIPTION 💜

this program navigates through a Windows Registry binary "hive" file and extracts either all the (key, value) data pairs stored in that subkey or just the single named data item. your choice, main character. 👑

✨ first form ✨

hivexget hivefile '\Path\To\SubKey'

so here, hivefile is some Windows Registry binary hive, and '\Path\To\Subkey' is a path within that hive.

NB bestie — the path is relative to the top of this hive, and it is not the full path as you would use in Windows. like, "HKEY_LOCAL_MACHINE\SYSTEM" is not a valid path here. 😭 don't do it. please. I'm begging.

if the subkey exists, then the output lists all data pairs under this subkey, in a format similar to "regedit" in Windows. cute, right? 🌈

✨ second form ✨

hivexget hivefile '\Path\To\SubKey' name

hivefile and path are as above (same deal, same rules, same NB). name is the name of the value of interest — and yes, use "@" for the default value. 💅 iykyk.

the corresponding data item is printed "raw" (ie. no processing or escaping) — except for these three iconic exceptions:

1. if it's a string we will convert it from Windows UTF-16 to UTF-8, if this conversion is possible. the string is printed with a single trailing newline.
2. if it's a multiple-string value, each string is printed on a separate line.
3. if it's a numeric value, it is printed as a decimal number.

three exceptions, three slays. no more, no less. 🍓

---

🔥 SEE ALSO 🔥

hivex(3), hivexml(1), hivexsh(1), hivexregedit(1), virt-win-reg(1), guestfs(3), <http://libguestfs.org/>, virt-cat(1), virt-edit(1).

go read them. they're all part of the family. 🧚

---

👑 AUTHORS 👑

Richard W.M. Jones ("rjones at redhat dot com") — the legend responsible. respect. 🫶

---

💀 COPYRIGHT 💀

Copyright (C) 2009 Red Hat Inc.

This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2 of the License, or (at your option) any later version.

This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.

You should have received a copy of the GNU General Public License along with this program; if not, write to the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.

🚨 this is a license, bestie, not a vibe — please actually read it and keep the notices intact. it's literally the law. 💖

---

and that's the whole page, bestie. this gem is hivex-1.3.24, dated 2024-09-04, from the hivexget(1) manual — okay bye, go poke at some hives, slay 💅✨🦋