{"success":true,"data":{"ext":"reg","name":"Windows NT Registry and Registry Undo files","description":"Windows NT Registry and Registry Undo files are system configuration files used by Microsoft Windows and maintained by Microsoft as part of the Windows registry architecture. They store settings for the operating system, installed software, hardware profiles, and user preferences, and can be imported or restored with Registry Editor and related system tools. These files are generally safe, but importing untrusted registry data can modify system behavior and should be done cautiously.","mime":[],"risk_level":"Safe","signatures":[{"hex":"52 45 47 45 44 49 54","offset":0,"sources":[{"name":"Gary Kessler","url":"https://www.garykessler.net/library/file_sigs_GCK_latest.html"}]},{"hex":"FF FE","offset":0,"sources":[{"name":"Gary Kessler","url":"https://www.garykessler.net/library/file_sigs_GCK_latest.html"}]}],"related":["sud"],"usage":{"python":"def is_reg(file_path: str) -> bool:\n    \"\"\"Check if file is a valid REG by magic bytes.\"\"\"\n    signature = bytes([0x52, 0x45, 0x47, 0x45, 0x44, 0x49, 0x54])\n    with open(file_path, \"rb\") as f:\n        return f.read(7) == signature","node":"function isREG(buffer: Buffer): boolean {\n  const signature = Buffer.from([0x52, 0x45, 0x47, 0x45, 0x44, 0x49, 0x54]);\n  return buffer.subarray(0, 7).equals(signature);\n}","go":"func IsREG(data []byte) bool {\n    signature := []byte{0x52, 0x45, 0x47, 0x45, 0x44, 0x49, 0x54}\n    if len(data) < 7 {\n        return false\n    }\n    return bytes.Equal(data[:7], signature)\n}"}}}