'=============================================================================== ===== ' Title = Find Product Key Saved As = FindProductKey.

vbs ' Author = Steven Simmons ' Date Created = 9-19-2011 'Location on Web = http://www.visualbasicscript.com/Retrieve-Windows-Product-Key -m42793.aspx 'VBScript to find the DigitalProductID for your Microsoft windows Installation a nd decode it to retrieve your windows Product Key '=============================================================================== ===== 'This script is used to find the Product Key in the Registry of the current mach ine. When it is found It then decodes that value which is displayed in the Regis try as a hexadecimal value and converts it to the binary equivalent. This result ing Binary value is the same as the Product Key used to register the machine dur ing installation of the operating system. A easy to read pop up is then created that displays useful information about the current computer in use, using the WM IService. This script is useful to determine what Operating System the system is running along with the current service pack. It also displays the user that the Product Key was registered by, along with the serial number and build number of the OS. 'The techniques that are relavent to chapters 1-4 of the book are: ' 1 - On Error Resume Next ' 2 - const ' 3 - dim ' 4 - Set ' 5 - WScript ' 6 - For ' 7 - For Each 'On Error Resume Next ' --------------- Open Registry Key and populate binary data into an array ------------------------const HKEY_LOCAL_MACHINE = &H80000002 'Const Statement = Declares a constant wh ose value can't be changed throughout the life of the program or routine. One of the ideas of declaring constants is to make code easier both to write and to re ad; it allows you to replace a value with a recognizable word strKeyPath = "SOFTWARE\Microsoft\Windows NT\CurrentVersion" 'The string key pat h to go to the registry key of the Current Version of Windows strValueName = "DigitalProductId" 'Looks for the value name called DigitalProdu ctID under the CurrentVersion in the registry strComputer = "." dim iValues() Set oReg=GetObject("winmgmts:{impersonationLevel=impersonate}!\\" & _ strComputer & "\root\default:StdRegProv") oReg.GetBinaryValue HKEY_LOCAL_MACHINE,strKeyPath,strValueName,iValues 'This is getting the binary values (iValues) from the strKeyPath, strValueName, Dim arrDPID arrDPID = Array() For i = 52 to 66 ReDim Preserve arrDPID( UBound(arrDPID) + 1 ) 'The ReDim function preserves the data within an arrary when changing its single or last dimension arrDPID( UBound(arrDPID) ) = iValues(i) Next ' --------------- Create an array to hold the valid characters for a microsoft P roduct Key -------------------------Dim arrChars 'Dims the arrChars to create the arrChars reference

arrChars = Array("B","C","D","F","G","H","J","K","M","P","Q","R","T","V","W","X ","Y","2","3","4","6","7","8","9") 'This looks at the array that was gathered fr om the set oReg=GetObject and names that value arrChars for easier referencing t o later on in the script ' --------------- The clever area (Decrypts the base24 encoded binary data)------------------------'This is what creates the easy to read Product Key output when it is displayed. 'The Raw Product Key is buried inside the Product Key that is printed on the sti cker distributed with each Windows CD. It consists of five alphanumeric strings separated by '-' characters, where each string is composed of five characters, a s in: FFFFF-GGGGG-HHHHH-JJJJJ-KKKKK 'Each character is one of the following 24 letters and digits: B C D F G H J K M P Q R T V W X Y 2 3 4 6 7 8 9 'The 25 characters of the Product Key form a base-24 encoding of the binary repr esentation of the Product Key. Decoding the Product Key yields a multi-precision integer of roughly 115 bits, which is stored - in Little Endian byte order - in an array of 15 bytes. Decoding the above Product Key results in the following b yte sequence: 0x6F 0xFA 0x95 0x45 0xFC 0x75 0xB5 0x52 0xBB 0xEF 0xB1 0x17 0xDA 0 xCD 0x00 '"Little Endian" means that the low-order byte of the number is stored in memory at the lowest address, and the high-order byte at the highest address. (The lit tle end comes first.) 'Of these 15 bytes, the least significant four bytes contain the Raw Product Key in Little Endian byte order. The least significant bit is removed by shifting t his 32-bit value (0x4595FA6F - remember the Little Endian byte order) to the lef t by one bit position, resulting in a Raw Product Key of 0x22CAFD37, or 58372843 9 in decimal notation. For i = 24 To 0 Step -1 k = 0 For j = 14 To 0 Step -1 k = k * 256 Xor arrDPID(j) arrDPID(j) = Int(k / 24) k = k Mod 24 Next strProductKey = arrChars(k) & strProductKey ' ------- adds the "-" between the groups of 5 Char -------'This adds the "-" after ever 5 characters that is created in by the decrypting of the Hexadecimal Product Key. If i Mod 5 = 0 And i <> 0 Then strProductKey = "-" & strProductKey 'This tells it that after each 5th character to place a "-" symbol only if there is a charac ter after it. If there are 0 characters following it will not place a "-" after the number to prevent the product key ending with a "-" Next strFinalKey = strProductKey 'This tells the script that strFinalKey equals the value that is produced by the strProductKey ' ---------- This part of the script displays operating system Information and t he license key --------strComputer = "." Set objWMIService = GetObject("winmgmts:" _ & "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2") Set colOperatingSystems = objWMIService.ExecQuery _ ("Select * from Win32_OperatingSystem") 'This collects information from the Win32_OperatingSystem and sets its ID For Each objOperatingSystem in colOperatingSystems 'For each object in the oper ating system that was collected using the previous Set colOperatingSystems, this tells it was to name it as strOS = objOperatingSystem.Caption 'Displays what operating system the com puter is running

strCSD = objOperatingSystem.CSDVersion 'This shows what service pack the operating system has installed on it strBuild = objOperatingSystem.BuildNumber 'Displays the build number of th e OS strSerial = objOperatingSystem.SerialNumber 'Shows the Product Serial numb er that is related to the OS strRegistered = objOperatingSystem.RegisteredUser 'This shows what user has registered this particular OS Next Set wshShell=CreateObject("wscript.shell") 'This creates a wscript shell to dis play all the results in a single graphic shell strPopupMsg = strOS & vbNewLine 'Displays the current OS strPopupMsg = strPopupMsg & strCSD & vbNewLine &vbNewLine 'Displays the Service Pack and creates a two lines strPopupMsg = strPopupMsg & "Build Number: " & strBuild & vbNewLine 'Shows the build number strPopupMsg = strPopupMsg & "PID: " & strSerial & vbNewLine & vbNewLine 'This is the serial number strPopupMsg = strPopupMsg & "Registered to: " & strRegistered & vbNewLine & vb NewLine 'Result of who the registered user is strPopupMsg = strPopupMsg & "Your Windows Product Key is:" & vbNewLine & strFin alKey 'This displays the result of strFinalKey and titles its strPopupTitle = "Microsoft Windows License Information" 'This gives the pop she ll the title of Microsoft Windows License Information wshShell.Popup strPopupMsg,,strPopupTitle,vbCancelOnly+vbinformation WScript.Quit 'There are currently no changes that would need to be made to have this run on a computer, as is this script runs and displays the information that you are try ing to obtain. 'http://betterexplained.com/articles/understanding-big-and-little-endian-byte-o rder/ 'http://www.cs.umass.edu/~verts/cs32/endian.html