Format of NTUSER.DAT ...

[Richard Sharpe]

Hi,

By inspection with od -ha etc, I can see much of the format of NTUSER.DAT.

The early part has, in UNICODE, <CR><LF> (sic) delimited lines, it seems.

Anyway, a little way through has the line $$$PROTO.HIV and then a little 
further on are the SIDS, in the format:

  LEN of this desc       2 bytes
  Permissions            4 bytes
  SID in binary format - remaining bytes
 
So, I figure I can write a small utility to print this out.

Regards
-----
Richard Sharpe, rsharpe at ns.aus.com, rsharpe at samba.org, 
sharpe at ethereal.com, http://www.richardsharpe.com