Converting Windows Registry hex to ASCII text #

Convert REGEDIT4 (ANSI, single-byte) and Windows Registry Editor Version 5.00 (Unicode, double-byte) hex strings to text with hex2text. ImagePath in this ver 4 example

becomes \SystemRoot\system32\drivers\iaStorV.sys and in this ver 5 one

becomes \ S y s t e m R o o t \ s y s t e m 3 2 \ d r i v e r s \ i a S t o r V . s y s.

UPDATE: xxd can perform the same conversion and is preinstalled on macOS and many Linux distributions (as well as being available for Windows via the open source xxd for Windows or WSL):

$ echo '5C,53,79,73,74,65,6D,52,6F,6F,74,5C,73,79,73,74,65,6D,33,32,5C,64,72,69,76,65,72,73,5C,69,61,53,74,6F,72,56,2E,73,79,73,00' | xxd -r -p
\SystemRoot\system32\drivers\iaStorV.sys

$ echo '5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,74,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,64,00,72,00,69,00,76,00,65,00,72,00,73,00,5c,00,69,00,61,00,53,00,74,00,6f,00,72,00,56,00,2e,00,73,00,79,00,73,00,00,00' | xxd -r -p
\SystemRoot\system32\drivers\iaStorV.sys

/windows | Apr 01, 2012


Subscribe or visit the archives.