FORUMS
Remove All Ads from XDA

Extract Windows RT product key without jailbreak or PC

117 posts
Thanks Meter: 177
 
By Myriachan, Senior Member on 13th September 2013, 08:43 AM
Post Reply Email Thread
This tool can be used on Windows RT 8.0 to extract a product key without needing either a Windows PC or a jailbreak. Copy this into Notepad and save it as a .bat file. Double-click it and it'll print out your product key, and you can copy it from that console window.

I've only tested this on Windows RT 8.0. It also seems to work on Windows 8.0 (i.e. x86 versions). No idea what happens on 8.1.

Code:
::' Windows RT 8.0 Product Key Dumper by Myria of xda-developers.com
::' Original Windows 8.0 VBScript by janek2012 of mydigitallife.info
::' Batch+VBScript hybrid trick by dbenham of stackoverflow.com
::' Fix for keys starting with N by Osprey00 of xda-developers.com
::'
::' Windows RT doesn't let unsigned VBScript use WScript.Shell, which is
::' required in order to read the registry in VBScript.  So instead, we
::' have a batch file call reg.exe to do the registry lookup for us, then
::' execute the VBScript code.  Might as well do things this way, since
::' it would really suck to write this math in batch...

::' --- Batch portion ---------
rem^ &@echo off
rem^ &call :'sub
::' If we were run from double-clicking in Explorer, pause.
rem^ &if %0 == "%~0" pause
rem^ &exit /b 0

:'sub
::' Read the registry key into VBScript's stdin.
rem^ &("%SystemRoot%\System32\reg.exe" query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v DigitalProductId | cscript //nologo //e:vbscript "%~f0")
::'rem^ &echo end batch
rem^ &exit /b 0

'----- VBS portion ------------
'WScript.Echo "begin VBS"

' Get registry data that was piped in
RegData = ""
Do While Not WScript.StdIn.AtEndOfStream
    RegData = RegData & WScript.StdIn.ReadAll
Loop

' Remove any carriage returns
RegData = Replace(RegData, ChrW(13), "")

' Split into lines
RegLines = Split(RegData, ChrW(10))

' Sanity checking on data
If (RegLines(0) <> "") Or (RegLines(1) <> "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion") Then
    WScript.Echo "Got invalid header trying to run reg.exe"
    WScript.Quit(1)
End If

If Left(RegLines(2), 38) <> "    DigitalProductId    REG_BINARY    " Then
    WScript.Echo "Got invalid value list trying to run reg.exe"
    WScript.Quit(1)
End If

' Get hex string
HexString = Mid(RegLines(2), 39)
If (Len(HexString) Mod 2) <> 0 Then
    WScript.Echo "Got an odd number of hex digits in REG_BINARY data"
    WScript.Quit(1)
End If

' Convert to byte array
Dim ByteArray()
ReDim ByteArray((Len(HexString) / 2) - 1)  ' VBScript is just weird with array dimensions >.<

For i = 0 To (Len(HexString) - 2) Step 2
    ByteArray(i / 2) = CInt("&H" + Mid(HexString, i + 1, 2))
Next

Key = ConvertToKey(ByteArray)
WScript.Echo Key

' janek2012's magic decoding function
Function ConvertToKey(Key)
    Const KeyOffset = 52 ' Offset of the first byte of key in DigitalProductId - helps in loops
    isWin8 = (Key(66) \ 8) And 1 ' Check if it's Windows 8 here...
    Key(66) = (Key(66) And &HF7) Or ((isWin8 And 2) * 4) ' Replace 66 byte with logical result
    Chars = "BCDFGHJKMPQRTVWXY2346789" ' Characters used in Windows key
    ' Standard Base24 decoding...
    For i = 24 To 0 Step -1
        Cur = 0
        For X = 14 To 0 Step -1
            Cur = Cur * 256
            Cur = Key(X + KeyOffset) + Cur
            Key(X + KeyOffset) = (Cur \ 24)
            Cur = Cur Mod 24
        Next
        KeyOutput = Mid(Chars, Cur + 1, 1) & KeyOutput
        Last = Cur
    Next
    ' If it's Windows 8, put "N" in the right place
    If (isWin8 = 1) Then
        keypart1 = Mid(KeyOutput, 2, Cur)
        insert = "N"
        KeyOutput = keypart1 & insert & Mid(KeyOutput, Cur + 2)
    End If
    ' Divide keys to 5-character parts
    a = Mid(KeyOutput, 1, 5)
    b = Mid(KeyOutput, 6, 5)
    c = Mid(KeyOutput, 11, 5)
    d = Mid(KeyOutput, 16, 5)
    e = Mid(KeyOutput, 21, 5)
    ' And join them again adding dashes
    ConvertToKey = a & "-" & b & "-" & c & "-" & d & "-" & e
    ' The result of this function is now the actual product key
End Function
The Following 25 Users Say Thank You to Myriachan For This Useful Post: [ View ] Gift Myriachan Ad-Free
 
 
14th September 2013, 12:12 AM |#2  
Subsonic44's Avatar
Senior Member
Flag Virginia
Thanks Meter: 577
 
More
Quote:
Originally Posted by Myriachan

This tool can be used on Windows RT 8.0 to extract a product key without needing either a Windows PC or a jailbreak. Copy this into Notepad and save it as a .bat file. Double-click it and it'll print out your product key, and you can copy it from that console window.

I've only tested this on Windows RT 8.0. It also seems to work on Windows 8.0 (i.e. x86 versions). No idea what happens on 8.1.

Works great on 8.1 RT too. Thanks!
The Following User Says Thank You to Subsonic44 For This Useful Post: [ View ] Gift Subsonic44 Ad-Free
14th September 2013, 01:30 AM |#3  
Senior Member
Thanks Meter: 72
 
More
Great work, Myriachan. I'd already gotten my code via other means, but I ran the script to verify that it gets the same key and it does. As Subsonic44 wrote, it does work on 8.1.

If anyone forgets how to copy it to the clipboard from the command prompt: tap and hold (or right-click) anywhere in the window, select Mark, highlight the key and tap and hold (or right-click) anywhere again.
The Following User Says Thank You to Osprey00 For This Useful Post: [ View ] Gift Osprey00 Ad-Free
14th September 2013, 04:07 PM |#4  
Senior Member
Thanks Meter: 19
 
More
Where I have to use the product key I get?
14th September 2013, 06:49 PM |#5  
Subsonic44's Avatar
Senior Member
Flag Virginia
Thanks Meter: 577
 
More
Quote:
Originally Posted by hisoft

Where I have to use the product key I get?

When you install this: DRIVERS FOR SURFACE RT ONLY___MICROSOFT WINDOWS RT 8 1 WITH OFFICE 2013 RT RTM WOA ENGLISH DVD-WZT

you have to use an install key that won't activate. You will need to change your product key back to your original that you copied down using this tool in order to activate your new 8.1 Windows RT.
The Following User Says Thank You to Subsonic44 For This Useful Post: [ View ] Gift Subsonic44 Ad-Free
14th September 2013, 07:03 PM |#6  
Senior Member
Thanks Meter: 19
 
More
Quote:
Originally Posted by Subsonic44

When you install this: DRIVERS FOR SURFACE RT ONLY___MICROSOFT WINDOWS RT 8 1 WITH OFFICE 2013 RT RTM WOA ENGLISH DVD-WZT

you have to use an install key that won't activate. You will need to change your product key back to your original that you copied down using this tool in order to activate your new 8.1 Windows RT.

Thank you for the answer. If I can find some free time I may have to try it.
14th September 2013, 07:16 PM |#7  
rabilancia's Avatar
Senior Member
Thanks Meter: 26
 
More
Myriachan,

Thank you very much for doing this! Before proceeding with my 8.1 RTM upgrade, I would like to confirm one thing: your scripted returned a strange key (see below).

C:\Users\XXXX>rem &
XXXXX-XXXXX-XXXXX-XXXXX-CBV2
Press any key to continue . . .

Notice the last tuple only contains 4 characters. Can this possibly be correct?

Thanks in advance,
Rich
==========================
UPDATE: I retrieved my key using WinTK on another machine. Looks like there is a displacement issue.

X????-?????-?????-????7-CBV2 - using this tool
NX???-?????-?????-?????-7CBV2 - using WinTK
14th September 2013, 09:58 PM |#8  
Subsonic44's Avatar
Senior Member
Flag Virginia
Thanks Meter: 577
 
More
Quote:
Originally Posted by rabilancia

Myriachan,


C:\Users\XXXX>rem &
XXXXX-XXXXX-XXXXX-XXXXX-CBV2
Press any key to continue . . .

Notice the last tuple only contains 4 characters. Can this possibly be correct?

Thanks in advance,
Rich

Just checked mine and it only has 4 characters in the last group. I think you are fine.
15th September 2013, 12:01 AM |#9  
Senior Member
Thanks Meter: 72
 
More
Quote:
Originally Posted by rabilancia

UPDATE: I retrieved my key using WinTK on another machine. Looks like there is a displacement issue.

X????-?????-?????-????7-CBV2 - using this tool
NX???-?????-?????-?????-7CBV2 - using WinTK

[EDIT: The following doesn't solve the issue, so don't bother with it, but the code change in my later post does. Myriachan has added that change to the first post, so if you've just now created the batch file, you already have the fix.]

It seems to me that janek2012's function may not account for the possibility of 'N' being the very first character of the product key. Find this line 2/3rds of the way into his function...
Code:
	keypart1 = Mid(KeyOutput, 2, Cur)
...and replace it with...
Code:
	If (Cur = 0) Then
		keypart1 = Mid(KeyOutput, 1, 1)
	Else
		keypart1 = Mid(KeyOutput, 2, Cur)
	End If
I've done a little testing and that seems to solve it, but I had to make an assumption without having an actual key that starts with 'N'. If it doesn't solve it, Myriachan may have a better idea.
15th September 2013, 02:08 AM |#10  
rabilancia's Avatar
Senior Member
Thanks Meter: 26
 
More
Osprey00,

That "seems" to be working. Thank you very much! As I reported in an update above, I got my key another way. I am now successfully running RT 8.1 RTM on my Surface RT. Interestingly, I did change the script as you suggested, ran it on RT 8.1 and found out that the key on RT 8.1 is entirely different than the one I used to activate RT 8.1. Hmmm....

Thanks again,
Rich
15th September 2013, 02:30 AM |#11  
Senior Member
Thanks Meter: 72
 
More
Quote:
Originally Posted by rabilancia

Osprey00,

That "seems" to be working. Thank you very much! As I reported in an update above, I got my key another way. I am now successfully running RT 8.1 RTM on my Surface RT. Interestingly, I did change the script as you suggested, ran it on RT 8.1 and found out that the key on RT 8.1 is entirely different than the one I used to activate RT 8.1. Hmmm....

Thanks again,
Rich

Well, in that case, my modification probably doesn't work. It ought to return the same key that you got via WinTK and activated with. If it's different, then it's likely wrong. Thanks for trying, though. It was worth a shot. I guess that I'll leave it to Myriachan to solve.
Post Reply Subscribe to Thread

Guest Quick Reply (no urls or BBcode)
Message:
Previous Thread Next Thread
Thread Tools Search this Thread
Search this Thread:

Advanced Search
Display Modes