get shell with hivex
set shell with hivex