Just Another (Broken) Registry Parser (JARP)

On a few recent ransomware investigations, there was a need to read partially encrypted reg hives, but no FOSS tools existed to do so! 🙁

That’s why JARP was created 🙂

We’ll talk about JARP and the internals of registry hives, along with the challenges of working with semi-encrypted, essentially corrupted hives usually with no headers and random segments of encrypted data interspersed with normal data.