Skip to content

Initial Helium registry HiveType support for RECmd#94

Merged
EricZimmerman merged 2 commits into
EricZimmerman:masterfrom
reece394:master
Jul 8, 2025
Merged

Initial Helium registry HiveType support for RECmd#94
EricZimmerman merged 2 commits into
EricZimmerman:masterfrom
reece394:master

Conversation

@reece394
Copy link
Copy Markdown
Contributor

@reece394 reece394 commented Jul 7, 2025

Description

As mentioned in EricZimmerman/Registry#32 this adds initial support for the Helium registry hives found in UWP/ Windows Store Applications. After this is merged will probably need a nuget package upgrade @EricZimmerman so that works properly

Checklist:

Please replace every instance of [ ] with [X] OR click on the checkboxes after you submit your PR

- [ ] I have generated a unique GUID for my Batch file(s)
- [ ] I have tested and validated the new Batch file(s) against test data and achieved the desired output
- [ ] I have placed the Batch file(s) within the .\RECmd\BatchExamples directory
- [ ] I have set or updated the version of my Batch file(s)
- [ ] I have made an attempt to document the artifacts within the Batch file(s)
- [ ] I have consulted the [Guide](https://github.com/EricZimmerman/RECmd/blob/master/BatchExamples/!RECmdBatch.guide)/[Template](https://github.com/EricZimmerman/RECmd/blob/master/BatchExamples/!RECmdBatch.template) to ensure my Map(s) follow the same format

Thank you for your submission and for contributing to the DFIR community!

Copy link
Copy Markdown

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull Request Overview

Adds initial support for Helium registry hives by extending the HiveType_ enum and updating the DoWork method to recognize and ignore new hive files.

  • Extended HiveType_ enum with User, UserClasses, and settings members.
  • Updated DoWork to add new hive types to okFileParts and include their ignore patterns.

Reviewed Changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File Description
RECmd/ReBatch.cs Added new enum members for User, UserClasses, settings.
RECmd/Program.cs Appended new hive types and ignore patterns in DoWork.
Comments suppressed due to low confidence (3)

RECmd/ReBatch.cs:58

  • Enum member 'settings' is lowercase, which is inconsistent with the PascalCase convention of other members; consider renaming it to 'Settings'.
        [Description("settings")] settings = 20

RECmd/Program.cs:511

  • String literal 'settings' is lowercase and differs from the uppercase style used for other hive names; consider using 'SETTINGS' for consistency.
            okFileParts.Add("settings");

RECmd/Program.cs:655

  • Ignore pattern '*settings.dat' is lowercase and inconsistent with other uppercase patterns like '*COMPONENTS'; consider '*SETTINGS.dat'.
                "*settings.dat"

@EricZimmerman EricZimmerman merged commit 41f307a into EricZimmerman:master Jul 8, 2025
1 check passed
@EricZimmerman
Copy link
Copy Markdown
Owner

nuget coming

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants