So if we just convince the gatherosstate.exe file
-that the system is activated by fooling it, it will generate a valid
-ticket, which can be used to get the valid HWID (Digital license). The
-script here does exactly that to get the activation for free without any
-upgrade process.
Now a question, can Microsoft differentiate counterfeit tickets and -block the license?
+There are many methods for ticket generation, however we can classify +the ticket types in 3 categories.
+Downlevel Ticket - This is the simplest ticket +generation process. In this method, ticket is signed by downlevel key by +the system and the ticket’s OSVersion is 10. If it’s generated on +Windows 10/11 then MS ideally aren’t supposed to grant activation, +however they do and method is continuously working from last 4-5 years. +Almost every HWID activator (at the time of writing this) is based on +this method.
Lockbox Ticket - This is slightly a trickier +method. The ticket is signed by Lockbox key by the system and the +ticket’s OSVersion is 10. This ticket generation process involves +cleaning Clipsvc licenses and IdentityCRL registry key in the system. +Due to some hiccups in the process, this method is not primarily used in +MAS, however these are the types of tickets that are identical to the +genuine ticket generated by system on activated Windows 10/11.
Universal Ticket - In this method, we set the +OSVersion =<5 in the ticket and when we apply the ticket, system +ignores the HWID in the ticket due to lower OSVersion and grant the +activation anyway. This ticket can be applied on any system. These +tickets can either be Downlevel or Lockbox type. MS ideally aren’t +supposed to grant activation, however they do.
Latest version of MAS is using Universal ticket method. Other ticket +method scripts can be found in this repo MAS-Legacy-Methods
+Now a question, can Microsoft block the new requests or revoke +already established HWID license?
QPM6N-7J2WJ-P88HH-P3YRH-YY74HJ7NJW-V6KBM-CC8RW-Y29Y4-HQ2MJVK7JG-NPHTM-C97JM-9MPGT-3V66T2B87N-8KFHP-DKV6R-Y2C8J-PKCKT8PTT6-RNW4C-6V7J2-C2D3X-MHBPBGJTYN-HDMQY-FRR76-HVGC7-QPF8PDXG7C-N36C4-C4HTG-X4T3X-2YV77WYPNQ-8C467-V2W6J-TX4WX-WT2RQV3WVW-N2PV2-CGWC3-34QGF-VMJ2CNH9J3-68WK7-6FB93-4K3DF-DJ4F6K9VKN-3BGWV-Y624W-MCRMQ-BHDCDKY7PN-VR6RX-83W6Y-6DDYQ-T6R4WXKCNC-J26Q9-KFHD2-FKTHY-KD72YDownlevel = downlevelGTkey
-Lockbox = clientLockboxKey
-Downlevel Method: It creates a downlevelGTkey ticket for -activation with the simplest process.
LockBox Method: It creates a clientLockboxKey ticket which better -mimics genuine activation, But requires more steps such as,
-Cleaning ClipSVC licenses
Deleting a volatile and protected registry key by taking
-ownership
-HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ClipSVC\Volatile\PersistedSystemState
System may need a restart for successful activation
Microsoft Account and Store Apps may need relogin-restart in the -system
Notes:
-We don’t suggest running the Lockbox method on a production -system. Hence by default script will choose the Downlevel method and -won’t show you the option to select the Lockbox method. However, if you -want, you can apply it through command line switches.
Microsoft accepts both types of tickets and that’s unlikely to -change.
This is applicable only in separate files versions.
If any parameter is used then the script will automatically run -in unattended mode.
To activate with the Downlevel method (default),
"HWID_Activation.cmd" /a
"HWID_Activation.cmd" /g
"HWID_Activation.cmd" /a /k
"HWID_Activation.cmd" /g /k
Besides the plain batch script, HWID activation requires the use of -the official gatherosstate.exe (x86) file.
- File: gatherosstate.exe
-SHA-1: FABB5A0FC1E6A372219711152291339AF36ED0B5 It’s taken from Windows 10 -Version 1607 ADK (Section: User State Migration Tool)
The process here is based on Universal ticket method. Here we will +create identical tickets which are used in MAS HWID script and activate +the system with it.
You need the gatherosstate.exe file, get it from MAS
-separate files version.
Download file from the below official MS link and extract this
+.cab file.
+https://download.microsoft.com/download/9/A/E/9AE69DD5-BA93-44E0-864E-180F5E700AB4/adk/Installers/14f4df8a2a7fc82a4f415cf6a341415d.cab
Find the file named
+filf8377e82b29deadca67bc4858ed3fba9 and rename it as
+gatherosstate.exe
Make a folder named Files in C drive,
C:\Files and copy the gatherosstate.exe file
in that folder.
gatherosstate.exe file.
$bytes = [System.IO.File]::ReadAllBytes("C:\Files\gatherosstate.exe")
-$bytes[320] = 0x9c
+$bytes[320] = 0xf8
$bytes[321] = 0xfb
$bytes[322] = 0x05
+$bytes[324] = 0x03
$bytes[13672] = 0x25
$bytes[13674] = 0x73
$bytes[13676] = 0x3b
@@ -739,6 +729,7 @@ $bytes[33581] = 0x55
$bytes[33582] = 0x01
$bytes[33583] = 0x00
$bytes[33584] = 0x00
+$bytes[33978] = 0xc3
$bytes[34189] = 0x59
$bytes[34190] = 0xeb
$bytes[34191] = 0x28
@@ -752,13 +743,16 @@ $bytes[34376] = 0xeb
$bytes[34377] = 0x63
[System.IO.File]::WriteAllBytes("C:\Files\gatherosstatemodified.exe", $bytes)gatherosstatemodified.exe
+and goto properties and set the compatibility to Windows XP SP3.$value = (Get-ItemProperty HKLM:\SYSTEM\CurrentControlSet\Control\ProductOptions).OSProductPfn
-C:\Files\gatherosstatemodified.exe Pfn=$value`;DownlevelGenuineState=1C:\Files\ now let’s apply it.Notes:
+If the system is already activated then created ticket will be a +Lockbox ticket and if not then it will be a Downlevel ticket.
To make the exact ticket used in MAS HWID script, make sure
+system is already activated and fix the time with below Powershell
+command and then initiate the ticket generation process as per above
+mentioned steps.
+$date=[datetime]"2022/10/11 12:00";while($true){set-date $date; start-sleep -milliseconds 10}