HiveSwarming
Conversions between registry hive and registry export formats without a need
for special privileges.
Changelog - Latest version
© 2026 Stormshield
Usage
HiveSwarming.exe --from --to
Supported values for ``:
reg : .reg format as produced by the Registry Editorhive : binary format used by MS Windowspol : .pol format used in Group Policy DataStoresreg+ : .reg format with extensions for readability of REG_MULTI_SZ,
REG_EXPAND_SZ and REG_QWORD values. This format is NOT recognized by the
standard tools!
Exit code 0 means success, other values mean failure.
Failure will be accompanied by some output on standard error.
FAQ
Why this name?
Registry vocabulary tends to follow beekeeping terms. Swarming is a term
that perfectly applies to a migration of your data.
See also Raymond Chen's explanation.
Any limitations?
Yes. First, if a key name contains a closing bracket followed by a newline
character, your .reg file is not parseable. This limitation is also valid for
standard .reg files.
Second, when converting from .reg file to a hive, any key containing a single
value named SymbolicLinkValue and of type REG_LINK will be recreated as a
symbolic link. This should be what is expected most of the time.
Is the .reg file compatible with reg.exe import?
Mostly. The generated .reg file has [(HiveRoot)] as root key. You will have
to substitute it globally to make it importable at any desired location. When
converting back, it is not necessary to keep this name for the root key, but a
requirement is that all keys descend of the first one.
What are requirements for .reg files?
.reg files must:
- be encoded as UTF-16, Little-Endian, with a Byte Order Mark
- Use
\r\n for line endings
- Start with
Windows Registry Editor Version 5.00 and at least one blank line
- Have non-empty root key (first key) name
- Have all keys be descendants of the root key
- Have no trailing or leading spaces on lines
- Have no blank lines between a key and its last value (except inside string
values when the string themselves contain blank lines)
- Have a blank line after the last value of a key (including last key)
- Be importable to the registry
Some third party software will generate invalid files. For example double
quotes inside strings will be left unescaped; export file encoding will use a
multi-byte character set, and Unicode data will be lost. Those files are not
supported.
Some random system, hidden files appeared in the process.
This is a consequence of the internals of registry hives. We try to delete
these files once the conversions are done, but it is possible that something
failed (handle still opened for example). You may probably delete these files
themselves if your hive is not mounted anywhere and not in use by any process.
Contribute
Your pull requests are welcome and will be reviewed.
Privacy pledge
This product works offline. It will not use the network other than for
accessing the files you specified on the command line.
AI policy
This product was written, reviewed and tested by humans.
It will never interact with LLMs at runtime.
You may use AI agents to find problems and get code change suggestions, but
please have a human involved in submitting issues or merge requests.
Get it
Hiveswarming is a standalone executable. You can just download any version from
the Github release pages. The executable should be digitally signed.
As of August 2025, Hiveswarming v1.5 has been made available on WinGet by a
third-party user contribution.
You can install this specific version with:
winget install Hiveswarming --exact --id HiveSwarming --version 1.5.0.0