v1.2

Author: Endermanch

CMakeLists.txt

@@ -6,5 +6,10 @@ set(CMAKE_CXX_STANDARD 14)
 add_executable(
         Keygen
         main.cpp
+        xp.cpp
+        server.cpp
+        header.h
+        utilities.cpp
+        key.cpp
 )
 target_link_libraries(Keygen ${CMAKE_CURRENT_SOURCE_DIR}/lib/libcrypto.lib -static)

README.md

@@ -1,7 +1,126 @@
 # XPKeygen
-Windows XP VLK Keygen
+A command line Windows XP VLK key generator. This tool allows you to generate _valid Windows XP keys_ based on a single
+_raw product key_, which can be random. You can also provide the amount of keys to be generated using that raw
+product key.
 
-Known issues:
-* Some of the keys aren't valid, but it's generally a less common occurrence. About 2 in 3 of the keys should work.
+The **Raw Product Key (RPK)** is supplied in a form of 9 digits `XXX-YYYYYY`.
 
-Issues/Pull Requests welcome.
+
+### Download
+Check the **Releases** tab and download the latest version from there.
+
+
+### Principle of operation
+We need to use a random Raw Product Key as a base to generate a Product ID in a form of `AAAAA-BBB-CCCCCCS-DDEEE`.
+
+#### Product ID
+
+| Digits | Meaning                                                |
+|-------:|:-------------------------------------------------------|
+|  AAAAA | OS Family constant                                     |
+|    BBB | Most significant 3 digits of the RPK                   |
+| CCCCCC | Least significant 6 digits of the RPK                  |
+|      S | Check digit                                            |
+|     DD | Index of the public key used to verify the Product Key |
+|    EEE | Random 3-digit number                                  |
+
+The OS Family constant `AAAAA` is different for each series of Windows XP. For example, it is 76487 for SP3.
+
+The `BBB` and `CCCCCC` sections essentially directly correspond to the Raw Product Key. If the RPK is `XXXYYYYYY`, these two sections
+will transform to `XXX` and `YYYYYY` respectively.
+
+The check digit `S` is picked so that the sum of all `C` digits with it added makes a number divisible by 7.
+
+The public key index `DD` lets us know which public key was used to successfully verify the authenticity of our Product Key.
+For example, it's 22 for Professional keys and 23 for VLK keys.
+
+A random number `EEE` is used to generate a different Installation ID each time.
+
+#### Product Key
+
+The Product Key itself (not to confuse with the RPK) is of form `FFFFF-GGGGG-HHHHH-JJJJJ-KKKKK`, encoded in Base-24 with
+the alphabet `BCDFGHJKMPQRTVWXY2346789` to exclude any characters that can be easily confused, like `I` and `1` or `O` and `0`.
+
+As per the alphabet capacity formula, the key can at most contain 114 bits of information.
+$$N = log2(24^25) ~ 114$$
+
+Based on that calculation, we unpack the 114-bit Product Key into 4 ordered segments:
+
+| Segment   | Capacity | Data                                      |
+|-----------|----------|-------------------------------------------|
+| Flag      | 1 bit    | Reserved, always set to `0x01`*           |
+| Serial    | 30 bits  | Raw Product Key (RPK)                     |
+| Hash      | 28 bits  | RPK hash                                  |
+| Signature | 55 bits  | Elliptic Curve signature for the RPK hash |
+
+For simplicity' sake, we'll combine `Flag` and `Serial` segments into a single segment called `Data`. By that logic we'll be able to extract the RPK by
+shifting `Data` right and pack it back by shifting bits left.
+
+*It's not fully known what that bit does, but all a priori valid product keys I've checked had it set to 1.
+
+#### Elliptic Curves
+Elliptic Curve Cryptography (ECC) is a type of public-key cryptographic system.
+This class of systems relies on challenging "one-way" math problems - easy to compute one way and intractable to solve the "other" way.
+Sometimes these are called "trapdoor" functions - easy to fall into, complicated to escape.<sup>[2]</sup>
+
+ECC relies on solving equations of the form
+$$y^2 = x^3 + ax + b$$
+
+In general, there are 2 special cases for the Elliptic Curve leveraged in cryptography - **F<sub>2m</sub>** and **F<sub>p</sub>**.
+They differ only slightly. Both curves are defined over the finite field, F<sub>p</sub> uses a prime parameter that's larger than 3,
+F<sub>2m</sub> assumes $p = 2m$. Microsoft used the latter in their algorithm.
+
+An elliptic curve over the finite field F<sub>p</sub> consists of:
+* a set of integer coordinates ${x, y}$, such that $0 <= x, y < p$;
+* a set of points $y^2 = x^3 + ax + b \mod p$.
+
+**An elliptic curve over F<sub>17</sub> would look like this:**
+
+The curve consists of the blue points in above image. In practice the "elliptic curves"
+used in cryptography are "sets of points in square matrix".
+
+The above curve is "educational". It provides very small key length (4-5 bits).
+In real world situations developers typically use curves of 256-bits or more.
+
+
+Since it is a public-key cryptographic system, Microsoft had to share the public key with their Windows XP release to check entered product keys against.
+It is stored within `pidgen.dll` in a form of a BINK resource. The first set of BINK data is there to validate retail keys, the second is for the
+OEM keys respectively.
+
+In case you want to explore further, the source code of `pidgen.dll` and all its functions is available within this repository, in the "pidgen" folder.
+
+#### Generating valid keys
+
+To create the CD-key generation algorithm we must compute the corresponding private key using the public key supplied with `pidgen.dll`,
+which means we have to reverse-solve the one-way ECC task. 
+
+Judging by the key exposed in BINK, p is a prime number with a length of **384 bits**.
+The computation difficulty using the most efficient Pollard's Rho algorithm ($O(\sqrtn)$) would be at least $O(2^168)$, but lucky for us,
+Microsoft limited the value of the signature to 55 bits in order to reduce the amount of matching product keys, reducing the difficulty
+to a far more manageable $O(2^28)$.
+
+The private key was, of course, conveniently computed before us in just 6 hours on a Celeron 800 machine.
+
+The rest of the job is done within the code of this keygen.
+
+
+### Known issues
+* ~~Some keys aren't valid, but it's generally a less common occurrence. About 2 in 3 of the keys should work.~~<br>
+**Fixed in v1.2**. Prior versions generated a valid key with an exact chance of `0x40000/0x62A32`, which resulted in exactly
+`0.64884`, or about 65%. My "2 in 3" estimate was inconceivably accurate.
+* Tested **only** on Windows XP Professional SP3, but should work everywhere else as well.
+* Server 2003 key generation not included yet.
+
+
+### Literature
+I will add more decent reads into the bibliography in a later release.
+
+**Understanding basics of Windows XP Activation**:
+* [[1] Inside Windows Product Activation - Fully Licensed](https://www.licenturion.com/xp/fully-licensed-wpa.txt)
+* [[2] Elliptic Curve Cryptography for Beginners - Matt Rickard](https://matt-rickard.com/elliptic-curve-cryptography)
+* [[3] Elliptic Curve Cryptography (ECC) - Practical Cryptography for Developers](https://cryptobook.nakov.com/asymmetric-key-ciphers/elliptic-curve-cryptography-ecc)
+
+
+**Tested on Windows XP Professional SP3**.
+
+Testing/Issues/Pull Requests welcome.

header.h

@@ -0,0 +1,126 @@
+//
+// Created by Andrew on 09/04/2023.
+//
+
+#ifndef KEYGEN_HEADER_H
+#define KEYGEN_HEADER_H
+
+#include <cstdio>
+#include <cstring>
+#include <cassert>
+
+#include <windows.h>
+
+#include <openssl/bn.h>
+#include <openssl/ec.h>
+#include <openssl/sha.h>
+#include <openssl/rand.h>
+
+#define FIELD_BITS 384
+#define FIELD_BYTES (FIELD_BITS / 8)
+
+#define FIELD_BITS_2003 512
+#define FIELD_BYTES_2003 (FIELD_BITS_2003 / 8)
+
+#define PK_LENGTH 25
+#define NULL_TERMINATOR 1
+
+typedef unsigned long ul32;
+
+extern HANDLE hConsole;
+extern byte charset[];
+
+extern const char pXP[];
+extern const long aXP;
+extern const long bXP;
+
+// xp.cpp
+void unpackXP(
+        ul32 *serial,
+        ul32 *hash,
+        ul32 *sig,
+        ul32 *raw
+        );
+
+void packXP(
+        ul32 *raw,
+        ul32 *serial,
+        ul32 *hash,
+        ul32 *sig
+        );
+
+void verifyXPKey(
+        EC_GROUP    *eCurve,
+        EC_POINT    *generator,
+        EC_POINT    *publicKey,
+        char        *cdKey
+        );
+
+void generateXPKey(
+        byte        *pKey,
+        EC_GROUP    *eCurve,
+        EC_POINT    *generator,
+        BIGNUM      *order,
+        BIGNUM      *privateKey,
+        ul32        *pRaw
+        );
+
+// server.cpp
+void unpackServer(
+        ul32 *osFamily,
+        ul32 *hash,
+        ul32 *sig,
+        ul32 *prefix,
+        ul32 *raw
+        );
+
+void packServer(
+        ul32 *raw,
+        ul32 *osFamily,
+        ul32 *hash,
+        ul32 *sig,
+        ul32 *prefix
+        );
+
+void verifyServerKey(
+        EC_GROUP    *eCurve,
+        EC_POINT    *generator,
+        EC_POINT    *public_key,
+        char        *cdKey
+        );
+
+void generateServerKey(
+        byte        *pKey,
+        EC_GROUP    *eCurve,
+        EC_POINT    *generator,
+        BIGNUM      *order,
+        BIGNUM      *privateKey,
+        ul32        *osFamily,
+        ul32        *prefix
+        );
+
+// utilities.cpp
+void cprintf(const char *Format, int nColor, ...);
+void endiannessConvert(byte *data, int length);
+
+EC_GROUP *initializeEllipticCurve(
+        const char  *pSel,
+        long        aSel,
+        long        bSel,
+        const char  *generatorXSel,
+        const char  *generatorYSel,
+        const char  *publicKeyXSel,
+        const char  *publicKeyYSel,
+        BIGNUM      *genOrderSel,
+        BIGNUM      *privateKeySel,
+        EC_POINT    **genPoint,
+        EC_POINT    **pubPoint
+        );
+
+// key.cpp
+void unbase24(ul32 *byteSeq, byte *cdKey);
+void base24(byte *cdKey, ul32 *byteSeq);
+void printProductKey(const char *pKey);
+void printProductID(const ul32 *pRaw);
+
+#endif //KEYGEN_HEADER_H

key.cpp

@@ -0,0 +1,105 @@
+//
+// Created by Andrew on 09/04/2023.
+//
+
+#include "header.h"
+
+/* Convert from byte sequence to the CD-key. */
+void base24(byte *cdKey, ul32 *byteSeq) {
+    byte rbs[16];
+    BIGNUM *z;
+
+    // Copy byte sequence to the reversed byte sequence.
+    memcpy(rbs, byteSeq, sizeof(rbs));
+
+    // Skip trailing zeroes and reverse y.
+    int length;
+
+    for (length = 15; rbs[length] == 0; length--);
+    endiannessConvert(rbs, ++length);
+
+    // Convert reversed byte sequence to BigNum z.
+    z = BN_bin2bn(rbs, length, nullptr);
+
+    // Divide z by 24 and convert the remainder to a CD-key char.
+    cdKey[25] = 0;
+
+    for (int i = 24; i >= 0; i--)
+        cdKey[i] = charset[BN_div_word(z, 24)];
+
+    BN_free(z);
+}
+
+/* Convert from CD-key to a byte sequence. */
+void unbase24(ul32 *byteSeq, byte *cdKey) {
+    BIGNUM *y = BN_new();
+    BN_zero(y);
+
+    // Empty byte sequence.
+    memset(byteSeq, 0, 16);
+
+    // For each character in product key, place its ASCII-code.
+    for (int i = 0; i < 25; i++) {
+        BN_mul_word(y, 24);
+        BN_add_word(y, cdKey[i]);
+    }
+
+    // Acquire length.
+    int n = BN_num_bytes(y);
+
+    // Place the generated code into the byte sequence.
+    BN_bn2bin(y, (unsigned char *)byteSeq);
+    BN_free(y);
+
+    // Reverse the byte sequence.
+    endiannessConvert((unsigned char *) byteSeq, n);
+}
+
+/* Print Product Key. */
+void printProductKey(const char *pKey) {
+    assert(strlen((const char *)pKey) == 25);
+
+    SetConsoleTextAttribute(hConsole, 0x0A);
+
+    for (int i = 0; i < 25; i++) {
+        putchar(pKey[i]);
+        if (i != 24 && i % 5 == 4) putchar('-');
+    }
+
+    SetConsoleTextAttribute(hConsole, 0x0F);
+}
+
+/* Print Product ID using a Product Key. */
+void printProductID(const ul32 *pRaw) {
+    char raw[12];
+    char b[6], c[8];
+
+    // Cut away last bit of the product key and convert it to an ASCII-number (=raw)
+    sprintf(raw, "%lu", pRaw[0] >> 1);
+
+    // Make B-part {...-640-...} -> most significant 3 digits of Raw Product Key
+    strncpy(b, raw, 3);
+    b[3] = 0;
+
+    // Make C-part {...-123456X-...} -> least significant 6 digits of Raw Product Key
+    strcpy(c, raw + 3);
+
+    // Make checksum digit-part {...56X-}
+    assert(strlen(c) == 6);
+
+    int digit = 0;
+
+    // Reverse sum algorithm to find a check digit that would add to the rest to form a sum divisible by 7.
+    for (int i = 0; i < 6; i++)
+        digit -= c[i] - '0';
+
+    while (digit < 0)
+        digit += 7;
+
+    // Append check digit + null terminate.
+    c[6] = digit + '0';
+    c[7] = 0;
+
+    printf("Product ID: ");
+    cprintf("PPPPP-%s-%s-23XXX\n", 0x0E, b, c);
+}