summaryrefslogtreecommitdiff
path: root/hwid.md
diff options
context:
space:
mode:
Diffstat (limited to 'hwid.md')
-rw-r--r--hwid.md150
1 files changed, 63 insertions, 87 deletions
diff --git a/hwid.md b/hwid.md
index 5517cc2..f0bf1b1 100644
--- a/hwid.md
+++ b/hwid.md
@@ -36,122 +36,88 @@
- In the background, the upgrade process runs a file named `gatherosstate.exe` and it checks the license of current Windows if found activated, it generates a valid GenuineTicket.xml which is sent to Microsoft and in return, MS authorizes a license.
-- So if we just convince the `gatherosstate.exe` file that the system is activated by fooling it, it will generate a valid ticket, which can be used to get the valid HWID (Digital license). The script here does exactly that to get the activation for free without any upgrade process.
-
-Now a question, can Microsoft differentiate counterfeit tickets and block the license?
-
-- Umm.. Yes, but actually no. The signature type can (sort of) be used to determine what utility is responsible for the ticket. There is no way (in a standard environment) for a non-activated Windows 10 installation to generate a ticket. In the normal process, gatherosstate will ask SLC for the entire ticket, but when this fails it will generate and sign it by itself, creating a "downlevelGTkey" signature. For every activated system, a generated ticket will be returned by SLC and thus will have a "clientLockboxKey" signature. Put simply, the signature (should) always be a "clientLockboxKey" one in the case of an activated system, but in this case, it isn't. Microsoft will not take action against it, because of the risk of voiding valid licenses. Besides, they never really cared for consumer piracy; That's not where they get the most money from.
+- So if we just convince the `gatherosstate.exe` file that the conditions are met for ticket generation by fooling it, it will generate a valid ticket, which can be used to get the valid HWID (Digital license). The script here does exactly that to get the activation for free without any upgrade process.
------------------------------------------------------------------------
-## Supported Products
+## Types of Tickets
-| Windows 10/11 | Generic Retail/OEM/MAK Key |
-|:-------------------------|:--------------------------------|
-| Education | `YNMGQ-8RYV3-4PGQ3-C8XTP-7CFBY` |
-| Education N | `84NGF-MHBT6-FXBX8-QWJK7-DRR8H` |
-| Enterprise | `XGVPP-NMH47-7TTHJ-W3FW7-8HV2C` |
-| Enterprise N | `3V6Q6-NQXCX-V8YXR-9QCYV-QPFCT` |
-| Enterprise LTSB 2015 | `FWN7H-PF93Q-4GGP8-M8RF3-MDWWW` |
-| Enterprise LTSB 2016 | `NK96Y-D9CD8-W44CQ-R8YTK-DYJWX` |
-| Enterprise LTSC 2019 | `43TBQ-NH92J-XKTM7-KT3KK-P39PB` |
-| Enterprise N LTSB 2015 | `NTX6B-BRYC2-K6786-F6MVQ-M7V2X` |
-| Enterprise N LTSB 2016 | `2DBW3-N2PJG-MVHW3-G7TDK-9HKR4` |
-| Home | `YTMG3-N6DKC-DKB77-7M9GH-8HVX7` |
-| Home N | `4CPRK-NM3K3-X6XXQ-RXX86-WXCHW` |
-| Home China | `N2434-X9D7W-8PF6X-8DV9T-8TYMD` |
-| Home Single Language | `BT79Q-G7N6G-PGBYW-4YWX6-6F4BT` |
-| IoT Enterprise | `XQQYW-NFFMW-XJPBH-K8732-CKFFD` |
-| IoT Enterprise LTSC 2021 | `QPM6N-7J2WJ-P88HH-P3YRH-YY74H` |
-| Pro | `VK7JG-NPHTM-C97JM-9MPGT-3V66T` |
-| Pro N | `2B87N-8KFHP-DKV6R-Y2C8J-PKCKT` |
-| Pro Education | `8PTT6-RNW4C-6V7J2-C2D3X-MHBPB` |
-| Pro Education N | `GJTYN-HDMQY-FRR76-HVGC7-QPF8P` |
-| Pro for Workstations | `DXG7C-N36C4-C4HTG-X4T3X-2YV77` |
-| Pro N for Workstations | `WYPNQ-8C467-V2W6J-TX4WX-WT2RQ` |
-| S | `V3WVW-N2PV2-CGWC3-34QGF-VMJ2C` |
-| S N | `NH9J3-68WK7-6FB93-4K3DF-DJ4F6` |
-| SE | `K9VKN-3BGWV-Y624W-MCRMQ-BHDCD` |
-| SE N | `KY7PN-VR6RX-83W6Y-6DDYQ-T6R4W` |
-| Team | `XKCNC-J26Q9-KFHD2-FKTHY-KD72Y` |
+There are many methods for ticket generation, however we can classify the ticket types in 3 categories.
-**Notes:**
+1. **Downlevel Ticket** - This is the simplest ticket generation process. In this method, ticket is signed by downlevel key by the system and the ticket's OSVersion is 10. If it's generated on Windows 10/11 then MS ideally aren't supposed to grant activation, however they do and method is continuously working from last 4-5 years. Almost every HWID activator (at the time of writing this) is based on this method.
-- X86-X64 and ARM64 architecture systems are supported.
+2. **Lockbox Ticket** - This is slightly a trickier method. The ticket is signed by Lockbox key by the system and the ticket's OSVersion is 10. This ticket generation process involves cleaning Clipsvc licenses and IdentityCRL registry key in the system. Due to some hiccups in the process, this method is not primarily used in MAS, however these are the types of tickets that are identical to the genuine ticket generated by system on activated Windows 10/11.
-- Any Evaluation version of Windows (i.e. 'EVAL' LTSB/C) cannot be activated.
+3. **Universal Ticket** - In this method, we set the OSVersion =\<5 in the ticket and when we apply the ticket, system ignores the HWID in the ticket due to lower OSVersion and grant the activation anyway. This ticket can be applied on any system. These tickets can either be Downlevel or Lockbox type. MS ideally aren't supposed to grant activation, however they do.
-- IoTEnterpriseS (LTSC) 2021 key will be used to activate the unsupported EnterpriseS (LTSC) 2021 edition.
+Latest version of MAS is using Universal ticket method. Other ticket method scripts can be found in this repo [MAS-Legacy-Methods](https://github.com/massgravel/MAS-Legacy-Methods)
-- Windows Server does not support HWID activation.
+Now a question, can Microsoft block the new requests or revoke already established HWID license?
-- ServerRdsh edition does not [officially](https://docs.microsoft.com/en-us/azure/virtual-desktop/windows-10-multisession-faq#can-i-run-windows-10-enterprise-multi-session-on-premises) support activation on non-azure systems.
+- Revoking the license would be insane and will face many complications and risk of voiding valid licenses. However maybe they can block the new activation requests coming from Downlevel and Universal tickets. But the tools are working from 4-5 years and they don't seem to care much for consumer piracy; That's not where they get the most money from.
------------------------------------------------------------------------
-## Downlevel & Lockbox Ticket
-
-Downlevel = downlevelGTkey
-
-Lockbox = clientLockboxKey
-
-- Downlevel Method: It creates a downlevelGTkey ticket for activation with the simplest process.
-
-- LockBox Method: It creates a clientLockboxKey ticket which better mimics genuine activation, But requires more steps such as,
+## Supported Products
- - Cleaning ClipSVC licenses
+| Windows 10/11 | Generic Retail/OEM/MAK Key |
+|:---------------------------------|:--------------------------------|
+| Education | `YNMGQ-8RYV3-4PGQ3-C8XTP-7CFBY` |
+| Education N | `84NGF-MHBT6-FXBX8-QWJK7-DRR8H` |
+| Enterprise | `XGVPP-NMH47-7TTHJ-W3FW7-8HV2C` |
+| Enterprise N | `3V6Q6-NQXCX-V8YXR-9QCYV-QPFCT` |
+| Enterprise LTSB 2015 | `FWN7H-PF93Q-4GGP8-M8RF3-MDWWW` |
+| Enterprise LTSB 2016 | `NK96Y-D9CD8-W44CQ-R8YTK-DYJWX` |
+| Enterprise LTSC 2019 | `43TBQ-NH92J-XKTM7-KT3KK-P39PB` |
+| Enterprise N LTSB 2015 | `NTX6B-BRYC2-K6786-F6MVQ-M7V2X` |
+| Enterprise N LTSB 2016 | `2DBW3-N2PJG-MVHW3-G7TDK-9HKR4` |
+| Home | `YTMG3-N6DKC-DKB77-7M9GH-8HVX7` |
+| Home N | `4CPRK-NM3K3-X6XXQ-RXX86-WXCHW` |
+| Home China | `N2434-X9D7W-8PF6X-8DV9T-8TYMD` |
+| Home Single Language | `BT79Q-G7N6G-PGBYW-4YWX6-6F4BT` |
+| IoT Enterprise | `XQQYW-NFFMW-XJPBH-K8732-CKFFD` |
+| IoT Enterprise LTSC 2021 | `QPM6N-7J2WJ-P88HH-P3YRH-YY74H` |
+| IoT Enterprise LTSC Subscription | `J7NJW-V6KBM-CC8RW-Y29Y4-HQ2MJ` |
+| Pro | `VK7JG-NPHTM-C97JM-9MPGT-3V66T` |
+| Pro N | `2B87N-8KFHP-DKV6R-Y2C8J-PKCKT` |
+| Pro Education | `8PTT6-RNW4C-6V7J2-C2D3X-MHBPB` |
+| Pro Education N | `GJTYN-HDMQY-FRR76-HVGC7-QPF8P` |
+| Pro for Workstations | `DXG7C-N36C4-C4HTG-X4T3X-2YV77` |
+| Pro N for Workstations | `WYPNQ-8C467-V2W6J-TX4WX-WT2RQ` |
+| S | `V3WVW-N2PV2-CGWC3-34QGF-VMJ2C` |
+| S N | `NH9J3-68WK7-6FB93-4K3DF-DJ4F6` |
+| SE | `K9VKN-3BGWV-Y624W-MCRMQ-BHDCD` |
+| SE N | `KY7PN-VR6RX-83W6Y-6DDYQ-T6R4W` |
+| Team | `XKCNC-J26Q9-KFHD2-FKTHY-KD72Y` |
- - Deleting a volatile and protected registry key by taking ownership\
- `HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ClipSVC\Volatile\PersistedSystemState`
+**Notes:**
- - System may need a restart for successful activation
+- X86-X64 and ARM64 architecture systems are supported.
- - Microsoft Account and Store Apps may need relogin-restart in the system
+- Any Evaluation version of Windows (i.e. 'EVAL' LTSB/C) cannot be activated.
-**Notes:**
+- IoTEnterpriseS (LTSC) 2021 key will be used to activate the unsupported EnterpriseS (LTSC) 2021 edition.
-- We don't suggest running the Lockbox method on a production system. Hence by default script will choose the Downlevel method and won't show you the option to select the Lockbox method. However, if you want, you can apply it through command line switches.
+- Windows Server does not support HWID activation.
-- Microsoft accepts both types of tickets and that's unlikely to change.
+- ServerRdsh edition does not [officially](https://docs.microsoft.com/en-us/azure/virtual-desktop/windows-10-multisession-faq#can-i-run-windows-10-enterprise-multi-session-on-premises) support activation on non-azure systems.
------------------------------------------------------------------------
## Command line Switches
-- This is applicable only in separate files versions.
-
-- If any parameter is used then the script will automatically run in unattended mode.
-
-- To activate with the Downlevel method (default),
-
-`"HWID_Activation.cmd" /a`
-
-- To only generate GenuineTicket.xml with the Downlevel method (default),
-
-`"HWID_Activation.cmd" /g`
-
-- To enable LockBox method (not recommended), run the script with /k parameter You need to use this option with either activation or ticket generation. Example,
-
-`"HWID_Activation.cmd" /a /k`
-
-`"HWID_Activation.cmd" /g /k`
+- Check [here](https://massgrave.dev/command_line_switches.html).
------------------------------------------------------------------------
-## File Details
-
-Besides the plain batch script, HWID activation requires the use of the official gatherosstate.exe (x86) file.
-
- File: gatherosstate.exe
- SHA-1: FABB5A0FC1E6A372219711152291339AF36ED0B5
+## Manual Activation
-It's taken from [Windows 10 Version 1607 ADK](https://go.microsoft.com/fwlink/p/?LinkId=526740) (Section: User State Migration Tool)
+The process here is based on Universal ticket method. Here we will create identical tickets which are used in MAS HWID script and activate the system with it.
-------------------------------------------------------------------------
-
-## Manual Activation
+- Download file from the below official MS link and extract this .cab file.\
+ <https://download.microsoft.com/download/9/A/E/9AE69DD5-BA93-44E0-864E-180F5E700AB4/adk/Installers/14f4df8a2a7fc82a4f415cf6a341415d.cab>
-- You need the `gatherosstate.exe` file, get it from MAS separate files version.
+- Find the file named `filf8377e82b29deadca67bc4858ed3fba9` and rename it as `gatherosstate.exe`
- Make a folder named `Files` in C drive, `C:\Files` and copy the `gatherosstate.exe` file in that folder.
@@ -168,9 +134,10 @@ It's taken from [Windows 10 Version 1607 ADK](https://go.microsoft.com/fwlink/p/
<!-- -->
$bytes = [System.IO.File]::ReadAllBytes("C:\Files\gatherosstate.exe")
- $bytes[320] = 0x9c
+ $bytes[320] = 0xf8
$bytes[321] = 0xfb
$bytes[322] = 0x05
+ $bytes[324] = 0x03
$bytes[13672] = 0x25
$bytes[13674] = 0x73
$bytes[13676] = 0x3b
@@ -221,6 +188,7 @@ It's taken from [Windows 10 Version 1607 ADK](https://go.microsoft.com/fwlink/p/
$bytes[33582] = 0x01
$bytes[33583] = 0x00
$bytes[33584] = 0x00
+ $bytes[33978] = 0xc3
$bytes[34189] = 0x59
$bytes[34190] = 0xeb
$bytes[34191] = 0x28
@@ -234,13 +202,14 @@ It's taken from [Windows 10 Version 1607 ADK](https://go.microsoft.com/fwlink/p/
$bytes[34377] = 0x63
[System.IO.File]::WriteAllBytes("C:\Files\gatherosstatemodified.exe", $bytes)
+- Now right click on the file `gatherosstatemodified.exe` and goto properties and set the compatibility to Windows XP SP3.\
- Now we need to generate the ticket, to do that, enter the below command.
<!-- -->
$value = (Get-ItemProperty HKLM:\SYSTEM\CurrentControlSet\Control\ProductOptions).OSProductPfn
- C:\Files\gatherosstatemodified.exe Pfn=$value`;DownlevelGenuineState=1
+ C:\Files\gatherosstatemodified.exe /c Pfn=$value`;DownlevelGenuineState=1
- A GenuineTicket.xml file should be created in the folder `C:\Files\` now let's apply it.
@@ -256,6 +225,13 @@ It's taken from [Windows 10 Version 1607 ADK](https://go.microsoft.com/fwlink/p/
- Done.
+**Notes:**
+
+- If the system is already activated then created ticket will be a Lockbox ticket and if not then it will be a Downlevel ticket.
+
+- To make the exact ticket used in MAS HWID script, make sure system is already activated and fix the time with below Powershell command and then initiate the ticket generation process as per above mentioned steps.\
+ `$date=[datetime]"2022/10/11 12:00";while($true){set-date $date; start-sleep -milliseconds 10}`
+
------------------------------------------------------------------------
## Setup Preactivate