Windows (and Office?) product key finder

[miskox]

There are scripts published on the web that display Windows (XP and up) product keys (XXXXX-XXXXX-XXXXX-XXXXX-XXXXX). On Microsoft's site you can find this .vbs script (I replaced msgbox with wscript.echo). This script displays Windows 10 key for your computer:

Code: Select all

Set WshShell = CreateObject("WScript.Shell")
wscript.echo ConvertToKey(WshShell.RegRead("HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\DigitalProductId"))

Function ConvertToKey(Key)
Const KeyOffset = 52
i = 28
Chars = "BCDFGHJKMPQRTVWXY2346789"
Do
Cur = 0
x = 14
Do
Cur = Cur * 256
Cur = Key(x + KeyOffset) + Cur
Key(x + KeyOffset) = (Cur \ 24) And 255
Cur = Cur Mod 24
x = x -1
Loop While x >= 0
i = i -1
KeyOutput = Mid(Chars, Cur + 1, 1) & KeyOutput
If (((29 - i) Mod 6) = 0) And (i <> -1) Then
i = i -1
KeyOutput = "-" & KeyOutput
End If
Loop While i >= 0
ConvertToKey = KeyOutput
End Function

I might try and convert it to batch. I am sure some of you would be more efficient (Aacini, aGerman...). This is not a competition... (yet).

It would be great to have a .cmd that would display product key for Windows and Office from XP and up (have to search for info how to distinguish this).

Saso

Did some search:

https://answers.microsoft.com/en-us/win ... 3db2f6ae11

https://answers.microsoft.com/en-us/win ... h=1&page=4:

Note mentioned above:

Code: Select all

You may need to change the code to DigitalProductId4 if it is 64 bits, that's what I had to do.

https://answers.microsoft.com/en-us/win ... 86f381da3e

[Compo]

I am sure some of you would be more efficient (Aacini, aGerman...). This is not a competition... (yet).

If you want one of those two to assist you, send them a personal message, instead of telling everyone else that you feel they have less worth to you, and demotivating them.

[T3RRY]

You could simply use:

Code: Select all

wmic  path softwarelicensingservice get OA3xOriginalProductKey | findstr /r ".....-"

[jfl]

You could simply use:

Code: Select all

wmic  path softwarelicensingservice get OA3xOriginalProductKey | findstr /r ".....-"

This does not work for me. I tested it on 5 different systems, with different versions of Windows, and it either returns nothing, or a WMI query error.

[ShadowThief]

There were a couple of tricky things here: vbscript substrings are 1-indexed while batch substrings are 0-indexed, and WshShell.RegRead interprets a hex byte array as an array of integers, while reg query takes the value as a string. Other than that, not too bad.

Code: Select all

@echo off
setlocal enabledelayedexpansion
set "reg_key=HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion"
set "reg_value=DigitalProductId"
if "%processor_architecture%"=="AMD64" set "reg_value=%reg_value%4"
set "reg_query=reg query "%reg_key%" /v %reg_value%"
for /f "tokens=3" %%A in ('%reg_query%') do set "key=%%A"
for /L %%A in (0,2,326) do (
	set /a index=%%A/2
	for /f %%B in ("!index!") do set /a key[%%B]=0x!key:~%%A,2!
)
set "key_offset=52"
set "i=28"
set "chars=BCDFGHJKMPQRTVWXY2346789"

:outer_loop
set /a cur=0, x=14

:inner_loop
set /a cur*=256
set /a x_plus_offset=x+key_offset
set /a cur+=!key[%x_plus_offset%]!
set /a "key[!x_plus_offset!]=(!cur!/24)&255"
set /a cur=!cur!%%24
set /a x-=1
if !x! GEQ 0 goto :inner_loop

set /a i-=1
set "key_output=!chars:~%cur%,1!!key_output!"
set /a i_test=(29-!i!)%%6
if "!i_test!"=="0" if not "!i!"=="-1" (
	set /a i-=1
	set "key_output=-!key_output!"
)

if !i! GEQ 0 goto :outer_loop
echo !key_output!

[Compo]

Here's an example, now tested successfully only on Windows 2000, and Windows 10 x64 in both 32-bit and 64-bit modes)

Code: Select all

@Echo Off
SetLocal EnableExtensions EnableDelayedExpansion
Set "sKey=HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion"
Set PROCESSOR_ARCHITE | %SystemRoot%\System32\find.exe "64" 1>NUL && (
    Set "sVal=DigitalProductId4 /Reg:64") || Set "sVal=DigitalProductId" 
Set "Key=" & For /F "Tokens=2,*" %%G In ('%SystemRoot%\System32\reg.exe
 Query "%sKey%" /V %sVal% 2^>NUL') Do Set "Key=%%H"
If Not Defined Key Exit /B
Set "Chars=BCDFGHJKMPQRTVWXY2346789"
Set "KeyOffset=52"
For /L %%G In (104,2,132
) Do Set /A "aVal_!KeyOffset! = 0x!Key:~%%G,2!, KeyOffset += 1"
For /L %%G In (24,-1,0) Do (Set /A "index = 0, KeyOffset = %%G %% 5"
    For /L %%H In (66,-1,52) Do (Set /A "index = (index << 8) + !aVal_%%H!"
        Set /A "aVal_%%H = index / 24, index %%= 24")
    For %%I In (!index!) Do Set "KeyOutput=!Chars:~%%I,1!!KeyOutput!"
    If %%G NEq 0 If !KeyOffset! Equ 0 Set "KeyOutput=-!KeyOutput!")
Echo Windows Product Key: %KeyOutput%
For /F "Tokens=1,2" %%G In ("!CMDCMDLINE!"
) Do If /I "%%~nG" == "cmd" If /I "%%~H" == "/c" Pause

The only thing, I'm unsure about is whether the Windows XP x64, version of reg.exe included the /Reg:64 option, and confirmation that the DigitalProductId4 became the correct registry value from that version onwards. If somebody could verify those things, I'd appreciate it.

[miskox]

Thank you both.

ShadowThief's version is not working on my work computer (x64).

Errors I get:

Code: Select all

ERROR: The system was unable to find the specified registry key or value.
Invalid number.  Numeric constants are either decimal (17),
hexadecimal (0x11), or octal (021).
...

But set p displays

Code: Select all

PROCESSOR_ARCHITECTURE=x86
PROCESSOR_ARCHITEW6432=AMD64
PROCESSOR_IDENTIFIER=Intel64 Family 6 Model 94 Stepping 3, GenuineIntel
PROCESSOR_LEVEL=6
PROCESSOR_REVISION=5e03

System info shows:

Code: Select all

System Type:               x64-based PC
Processor(s):              1 Processor(s) Installed.
                           [01]: Intel64 Family 6 Model 94 Stepping 3 GenuineIntel ~3192 Mhz
                           
                           

Info.bat shows this:

Code: Select all

 INFO.BAT version 1.5
--------------------------------------------------------------------------------
Windows version        :  Microsoft Windows [Version 10.0.19042.867]
Product name           :  Windows 10 Enterprise, 64 bit
Performance indicators :  Processor Cores: 4      Visible RAM: 8274356 kilobytes

Date/Time format       :  (dd/mm/yy)  pon. 19. 04. 2021  12:22:32,65
__APPDIR__             :  C:\WINDOWS\SysWOW64\
ComSpec                :  C:\WINDOWS\system32\cmd.exe
PathExt                :  .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC
Extensions             :  system: Enabled   user: Enabled 
Delayed expansion      :  system: Disabled  user: Disabled
Locale name            :  sl-SI       Code Pages: OEM  852    ANSI 1250
DIR  format            :  12. 04. 2021  09:41     3.758.096.384 pagefile.sys
Permissions            :  Elevated Admin=No, Admin group=No

                          Missing from the PATH environment: C:\WINDOWS\SysWOW64\wbem
                          Missing from the PATH environment: C:\WINDOWS\SysWOW64\WindowsPowerShell\v1.0
                          Missing from the tool collection:  debug

Compo's version works.

I will check both of them on XP later today.

Thank you again to both of you.

Saso

[Compo]

Compo's version works.

I will check both of them on XP later today.

Just to clarify my body text:

Here's an example, now tested successfully only on Windows 2000, and Windows 10 x64 in both 32-bit and 64-bit modes)
<snip />
The only thing, I'm unsure about is whether the Windows XP x64, version of reg.exe included the /Reg:64 option, and confirmation that the DigitalProductId4 became the correct registry value from that version onwards. If somebody could verify those things, I'd appreciate it.

If it already works on Windows 2000, it doesn't really need to be checked in XP. The only tests you should need to do are in the x64 versions of XP, (and probably Vista, if that fails), to validate the /Reg:64 option exists in their respective reg.exe versions. I've only ever used one PC with a x64 version of Windows XP before, it seems as if the general consensus was that, at the time it was released, there wasn't much benefit in having a 64-bit version, and for most users systems, the x86 version was recommended.

[miskox]

I wanted to test both programs (not related to your post). I can't test it on x64 XP, sorry. What is strange is that

Code: Select all

PROCESSOR_ARCHITECTURE=x86

but it really is 64-bit computer.
And Shadow tests

Code: Select all

if "%processor_architecture%"=="AMD64"

but SET P shows

Code: Select all

PROCESSOR_ARCHITECTURE=x86
PROCESSOR_ARCHITEW6432=AMD64

So maybe PROCESSOR_ARCHITEW6432 should be tested and not PROCESSOR_ARCHITECTURE (I don't know what values can be set)?

Thank you.
Saso

[Compo]

What is strange is that

Code: Select all

PROCESSOR_ARCHITECTURE=x86

but it really is 64-bit computer.
And Shadow tests

Code: Select all

if "%processor_architecture%"=="AMD64"

but SET P shows

Code: Select all

PROCESSOR_ARCHITECTURE=x86
PROCESSOR_ARCHITEW6432=AMD64

So maybe PROCESSOR_ARCHITEW6432 should be tested and not PROCESSOR_ARCHITECTURE (I don't know what values can be set)?

My code takes account of that problem.

On a 64-bit system, if cmd.exe is running as a 32-bit process, PROCESSOR_ARCHITECTURE=x86, however, only in that scenario, PROCESSOR_ARCHITEW6432 is defined.

The usual way of determining this is via an IF command sequence:

Code: Select all

@SetLocal EnableExtensions
@Set "OSArchitecture=x64"
@If %PROCESSOR_ARCHITECTURE:~-2% Equ 86 If Not Defined PROCESSOR_ARCHITEW6432 Set "OSArchitecture=x86"
@Set OSArchitecture
@Pause

Please also be aware that the options for %PROCESSOR_ARCHITECTURE% are not just AMD64 and x86, most people tend to forget the possibility that it could be IA64 too.
I used variable expansion and the last two characters above to cater for such things, because for me it's simpler.

In the example code for my product key finder above, I used:

Code: Select all

Set PROCESSOR_ARCHITE | %SystemRoot%\System32\find.exe "64" 1>NUL

Essentially, if the string 64 exists, the OS must be 64-bit.

Those are the reasons why I need to know whether the /Reg:64 option was correctly introduced in Windows XP x64, because the registry location HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion is not accessible from a 32-bit process on a 64-bit Operating System, without it. If that was the case, and the option was not included, the simplest way to work around it would be to determine the OS architecture first, and if it is 64-bit running in a 32-bit process, self invoke the script in a 64-bit cmd.exe instance, exiting the 32-bit one.

Example:

Code: Select all

If Defined PROCESSOR_ARCHITEW6432 (
   Start "" "%SystemRoot%\SysNative\cmd.exe" /D /C "%~f0" & Exit /B)

[ShadowThief]

I only tested 32-bit Windows XP, because why are you running Windows XP in 2021?

[Compo]

There were a couple of tricky things here: <snip />

Code: Select all

<snip />
if "%processor_architecture%"=="AMD64" set "reg_value=%reg_value%4"
set "reg_query=reg query "%reg_key%" /v %reg_value%"
for /f "tokens=3" %%A in ('%reg_query%') do set "key=%%A"
<snip />

I'd advise that you take account of my previous post, because your code does not determine whether the batch file is being run in a 32-bit process on a 64-bit OS. This means that reg.exe, cannot access the required key, and will therefore output many Set /A errors, and return the product key BBBBB-BBBBB-BBBBB-BBBBB-BBBBB.

[ShadowThief]

My script runs correctly in Windows 10 (and by correctly, I mean it matches the output of the vbs script in the first post). Frankly, that's the only thing I care about because I refuse to support older versions of Windows.

Also, to be blunt, literally nobody needs this script. Your product ID is either on a sticker on the side of your computer or in the email that got sent to you when you purchased your copy of Windows.

[Compo]

My script runs correctly in Windows 10.

Okay, let me put this to you in a different way; your script does not work correctly in Windows 10 x64, if it is run in a 32-bit cmd.exe instance.

It only works correctly in a 64-bit cmd.exe instance, on a Windows x64 OS, and a 32-bit cmd.exe instance on a Windows x86 OS. It is not certain that an end user will always be able to deploy and invoke your script from a process which has the same 'bitness' as the underlying Operating System. If you take a look at miskox own posts above, you'll note that when they've done exactly that, your script did not work.

Frankly, that's the only thing I care about because I refuse to support older versions of Windows.

Also, to be blunt, literally nobody needs this script. Your product ID is either on a sticker on the side of your computer or in the email that got sent to you when you purchased your copy of Windows.

Whilst I agree, that there isn't really much use for such a thing in modern Windows versions, as once you've activated your OS, MS servers will be able to re-activate you without you needing to input a Product Key again it was mentioned, right from the opening line.

Windows (XP and up)

As a sidenote, I have very rarely found that the 'sticker' on the side/bottom of an end users OEM machine, (the vast majority), matches that used to activate the OS. The OEM uses special keys for this, which MS has licensed to them, and the sticker has only really been used by less knowledgeable end users for clean reinstallations, as opposed to using the usual reset options.