Windows NT Registry and Registry Undo files
application/octet-stream
Magic Bytes
Offset: 0
52 45 56 4E 55 4D 3A 2C
Windows NT Registry and Registry Undo files are specialized configuration formats developed by Microsoft for the Windows operating system. These files are primarily used to automate the modification of registry keys and values, facilitating system recovery or bulk software configuration changes. While this specific header identifies legacy undo records, importing these files remains a critical operation that can alter core system settings, potentially affecting stability if sourced from untrusted or unverified locations.
Validation Code
How to validate .reg files in Python
Python
def is_reg(file_path: str) -> bool:
"""Check if file is a valid REG by magic bytes."""
signature = bytes([0x52, 0x45, 0x56, 0x4E, 0x55, 0x4D, 0x3A, 0x2C])
with open(file_path, "rb") as f:
return f.read(8) == signatureHow to validate .reg files in Node.js
Node.js
function isREG(buffer: Buffer): boolean {
const signature = Buffer.from([0x52, 0x45, 0x56, 0x4E, 0x55, 0x4D, 0x3A, 0x2C]);
return buffer.subarray(0, 8).equals(signature);
}
Go
func IsREG(data []byte) bool {
signature := []byte{0x52, 0x45, 0x56, 0x4E, 0x55, 0x4D, 0x3A, 0x2C}
if len(data) < 8 {
return false
}
return bytes.Equal(data[:8], signature)
}API Endpoint
GET
/api/v1/reg
curl https://filesignature.org/api/v1/reg