8/3/2019 Find Product Key

1/3

'====================================================================================' Title = Find Product Key Saved As = FindProductKey.vbs' Author = Steven Simmons' Date Created = 9-19-2011'Location on Web = http://www.visualbasicscript.com/Retrieve-Windows-Product-Key-m42793.aspx

'VBScript to find the DigitalProductID for your Microsoft windows Installation and decode it to retrieve your windows Product Key'===================================================================================='This script is used to find the Product Key in the Registry of the current machine. When it is found It then decodes that value which is displayed in the Registry as a hexadecimal value and converts it to the binary equivalent. This resulting Binary value is the same as the Product Key used to register the machine during installation of the operating system. A easy to read pop up is then createdthat displays useful information about the current computer in use, using the WMIService. This script is useful to determine what Operating System the system isrunning along with the current service pack. It also displays the user that the

Product Key was registered by, along with the serial number and build number ofthe OS.

'The techniques that are relavent to chapters 1-4 of the book are:' 1 - On Error Resume Next' 2 - const' 3 - dim' 4 - Set' 5 - WScript' 6 - For' 7 - For Each

'On Error Resume Next

' --------------- Open Registry Key and populate binary data into an array --------------------------const HKEY_LOCAL_MACHINE = &H80000002 'Const Statement = Declares a constant whose value can't be changed throughout the life of the program or routine. One ofthe ideas of declaring constants is to make code easier both to write and to read; it allows you to replace a value with a recognizable wordstrKeyPath = "SOFTWARE\Microsoft\Windows NT\CurrentVersion" 'The string key path to go to the registry key of the Current Version of WindowsstrValueName = "DigitalProductId" 'Looks for the value name called DigitalProductID under the CurrentVersion in the registrystrComputer = "."

dim iValues()Set oReg=GetObject("winmgmts:{impersonationLevel=impersonate}!\\" & _strComputer & "\root\default:StdRegProv")

oReg.GetBinaryValue HKEY_LOCAL_MACHINE,strKeyPath,strValueName,iValues 'This isgetting the binary values (iValues) from the strKeyPath, strValueName,Dim arrDPIDarrDPID = Array()For i = 52 to 66ReDim Preserve arrDPID( UBound(arrDPID) + 1 ) 'The ReDim function preserves thedata within an arrary when changing its single or last dimensionarrDPID( UBound(arrDPID) ) = iValues(i)Next

' --------------- Create an array to hold the valid characters for a microsoft Product Key --------------------------Dim arrChars 'Dims the arrChars to create the arrChars reference

8/3/2019 Find Product Key

2/3

arrChars = Array("B","C","D","F","G","H","J","K","M","P","Q","R","T","V","W","X","Y","2","3","4","6","7","8","9") 'This looks at the array that was gathered from the set oReg=GetObject and names that value arrChars for easier referencing to later on in the script' --------------- The clever area (Decrypts the base24 encoded binary data)--------------------------

'This is what creates the easy to read Product Key output when it is displayed.'The Raw Product Key is buried inside the Product Key that is printed on the sticker distributed with each Windows CD. It consists of five alphanumeric stringsseparated by '-' characters, where each string is composed of five characters, as in: FFFFF-GGGGG-HHHHH-JJJJJ-KKKKK'Each character is one of the following 24 letters and digits: B C D F G H J K MP Q R T V W X Y 2 3 4 6 7 8 9'The 25 characters of the Product Key form a base-24 encoding of the binary representation of the Product Key. Decoding the Product Key yields a multi-precisioninteger of roughly 115 bits, which is stored - in Little Endian byte order - inan array of 15 bytes. Decoding the above Product Key results in the following byte sequence: 0x6F 0xFA 0x95 0x45 0xFC 0x75 0xB5 0x52 0xBB 0xEF 0xB1 0x17 0xDA 0

xCD 0x00'"Little Endian" means that the low-order byte of the number is stored in memoryat the lowest address, and the high-order byte at the highest address. (The little end comes first.)'Of these 15 bytes, the least significant four bytes contain the Raw Product Keyin Little Endian byte order. The least significant bit is removed by shifting this 32-bit value (0x4595FA6F - remember the Little Endian byte order) to the left by one bit position, resulting in a Raw Product Key of 0x22CAFD37, or 583728439 in decimal notation.For i = 24 To 0 Step -1k = 0For j = 14 To 0 Step -1k = k * 256 Xor arrDPID(j)

arrDPID(j) = Int(k / 24)k = k Mod 24NextstrProductKey = arrChars(k) & strProductKey' ------- adds the "-" between the groups of 5 Char --------'This adds the "-" after ever 5 characters that is created in by the decryptingof the Hexadecimal Product Key.If i Mod 5 = 0 And i 0 Then strProductKey = "-" & strProductKey 'This tellsit that after each 5th character to place a "-" symbol only if there is a character after it. If there are 0 characters following it will not place a "-" afterthe number to prevent the product key ending with a "-"NextstrFinalKey = strProductKey 'This tells the script that strFinalKey equals thevalue that is produced by the strProductKey

' ---------- This part of the script displays operating system Information and the license key ---------strComputer = "."Set objWMIService = GetObject("winmgmts:" _

& "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2")Set colOperatingSystems = objWMIService.ExecQuery _

("Select * from Win32_OperatingSystem") 'This collects information from theWin32_OperatingSystem and sets its IDFor Each objOperatingSystem in colOperatingSystems 'For each object in the operating system that was collected using the previous Set colOperatingSystems, this

tells it was to name it asstrOS = objOperatingSystem.Caption 'Displays what operating system the com

puter is running

8/3/2019 Find Product Key

3/3

strCSD = objOperatingSystem.CSDVersion 'This shows what service pack theoperating system has installed on it

strBuild = objOperatingSystem.BuildNumber 'Displays the build number of the OS

strSerial = objOperatingSystem.SerialNumber 'Shows the Product Serial number that is related to the OS

strRegistered = objOperatingSystem.RegisteredUser 'This shows what user has

registered this particular OSNextSet wshShell=CreateObject("wscript.shell") 'This creates a wscript shell to display all the results in a single graphic shellstrPopupMsg = strOS & vbNewLine 'Displays the current OSstrPopupMsg = strPopupMsg & strCSD & vbNewLine &vbNewLine 'Displays the ServicePack and creates a two linesstrPopupMsg = strPopupMsg & "Build Number: " & strBuild & vbNewLine 'Shows thebuild numberstrPopupMsg = strPopupMsg & "PID: " & strSerial & vbNewLine & vbNewLine 'Thisis the serial numberstrPopupMsg = strPopupMsg & "Registered to: " & strRegistered & vbNewLine & vb

NewLine 'Result of who the registered user isstrPopupMsg = strPopupMsg & "Your Windows Product Key is:" & vbNewLine & strFinalKey 'This displays the result of strFinalKey and titles itsstrPopupTitle = "Microsoft Windows License Information" 'This gives the pop shell the title of Microsoft Windows License InformationwshShell.Popup strPopupMsg,,strPopupTitle,vbCancelOnly+vbinformationWScript.Quit'There are currently no changes that would need to be made to have this run ona computer, as is this script runs and displays the information that you are trying to obtain.'http://betterexplained.com/articles/understanding-big-and-little-endian-byte-order/

'http://www.cs.umass.edu/~verts/cs32/endian.html