D&C Lug - Home Page
Devon & Cornwall Linux Users' Group

[ Date Index ][ Thread Index ]
[ <= Previous by date / thread ] [ Next by date / thread => ]

[LUG] Windows XP Activation cracked

Not Linux, I know, but interesting (amusing even), nonetheless.

"Windows XP enlists ten hardware components to calculate the installation
ID, but six of them can be canceled without any problems:

Volume ID ---------- Adapted by means of tool
MAC address -------- Tuned by means of driver
Graphics card  -------Switch over to docking station
CPU serial number - Switch off in BIOS
SCSI host adapter -- Switch over to docking station
IDE controller ------- Switch over to docking station

Important: A LAN does not tolerate two computers with the same MAC address.
(Switching to 'Docking Station' in Device Manager / Performance / File
System settings doesn't mean you actually have a docking station of any kind
so can be used for non-notebook computers that cannot even USE a docking

If you want WindowsXP on a network, you're stuck (until someone finds
another route around Activation - juding by the speed of this one, that
won't be long!) But then why would anyone want more than one copy of Windoze
XP on a LAN anyway!
"It is more than sufficient to only once activate a computer with 128 MBytes
of RAM. With its file wpa.dbl you can then "activate" all other computers of
the same memory size." [no matter what other hardware is installed as long
as it's set as a notebook and the volume tag etc is set to match].

"Can Microsoft be tricked that easily? Yes it can! After the next restart of
the computer [after changing to docking station] the analysis of the
installation ID makes clear that suddenly the graphics card and the IDE/SCSI
controller are no longer used to calculate the hardware ID. In computers
that can be docked, XP ignores the identification of the graphics card, the
SCSI host adapter and the IDE controller.

So only three more differences in the configuration of the hardware remain:

   Identification of the hard disk
   Identification of the CPU
   Identification of the CD-ROM drive

Because these three components are allowed to be different without XP
insisting on a new Activation, this should be sufficient. So we copy the
file wpa.dbl into the system32 directory of the second computer and start
Windows XP. In the start menu it still says "Activate Windows". But when you
call it up, you get your just reward though:
"Windows Product Activation: Windows is already activated. Click OK to

"So first of all Tecchannel saved the file then started changing hardware.
Two items OK, but replacing a third - the CPU - triggered the deletion.
Although you'd think the CPU is only one component, it's actually tallied up
as two. Switching off the CPU serial number in the bios and therefore
knocking it down to one doesn't get the earlier wpa.dbl back - this has been
restored in a non-activated state.

Copy the saved version back? That surely shouldn't work - but it does. Next,
Tecchannel tried a completely new installation using the same product key.
This produces a new product ID, but nevertheless copying the wpa.dbl file
back again works.

They also use this file on another computer, altering the computer's volume
ID first, which is easily enough done. They can also use forged network
cards MAC addresses, so now they've taken two parts of the hardware ID out
of the picture. Next, use the hardware profile to tell the computer it's a
notebook with a docking station. This works, and tells WPA to stop counting
the IDE/SCSI controller and the graphics card.

That gets the differences counted down to three, hard disk, CPU and CDROM
ID, which is within the limit, so WPA is effectively toast.

What does this mean? Tecchannel's investigation shows that, at the very
least, you can use the same wpa.dbl file to activate as many computers as
you like, provided the RAM size is the same. A 'universal' file that didn't
even require the same RAM might be a possibility, but it's more likely that
people will simply swap files to get one appropriate for their hardware. "




Egg on BG's face again.

Neil Williams

The Mailing List for the Devon & Cornwall LUG
Mail majordomo@xxxxxxxxxxxx with "unsubscribe list" in the
message body to unsubscribe.

Lynx friendly