Extract Windows RT product key without jailbreak or PC

Search This thread

Myriachan

Senior Member
Feb 11, 2013
117
174
This tool can be used on Windows RT 8.0 to extract a product key without needing either a Windows PC or a jailbreak. Copy this into Notepad and save it as a .bat file. Double-click it and it'll print out your product key, and you can copy it from that console window.

I've only tested this on Windows RT 8.0. It also seems to work on Windows 8.0 (i.e. x86 versions). No idea what happens on 8.1.

Code:
::' Windows RT 8.0 Product Key Dumper by Myria of xda-developers.com
::' Original Windows 8.0 VBScript by janek2012 of mydigitallife.info
::' Batch+VBScript hybrid trick by dbenham of stackoverflow.com
::' Fix for keys starting with N by Osprey00 of xda-developers.com
::'
::' Windows RT doesn't let unsigned VBScript use WScript.Shell, which is
::' required in order to read the registry in VBScript.  So instead, we
::' have a batch file call reg.exe to do the registry lookup for us, then
::' execute the VBScript code.  Might as well do things this way, since
::' it would really suck to write this math in batch...

::' --- Batch portion ---------
rem^ &@echo off
rem^ &call :'sub
::' If we were run from double-clicking in Explorer, pause.
rem^ &if %0 == "%~0" pause
rem^ &exit /b 0

:'sub
::' Read the registry key into VBScript's stdin.
rem^ &("%SystemRoot%\System32\reg.exe" query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v DigitalProductId | cscript //nologo //e:vbscript "%~f0")
::'rem^ &echo end batch
rem^ &exit /b 0

'----- VBS portion ------------
'WScript.Echo "begin VBS"

' Get registry data that was piped in
RegData = ""
Do While Not WScript.StdIn.AtEndOfStream
    RegData = RegData & WScript.StdIn.ReadAll
Loop

' Remove any carriage returns
RegData = Replace(RegData, ChrW(13), "")

' Split into lines
RegLines = Split(RegData, ChrW(10))

' Sanity checking on data
If (RegLines(0) <> "") Or (RegLines(1) <> "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion") Then
    WScript.Echo "Got invalid header trying to run reg.exe"
    WScript.Quit(1)
End If

If Left(RegLines(2), 38) <> "    DigitalProductId    REG_BINARY    " Then
    WScript.Echo "Got invalid value list trying to run reg.exe"
    WScript.Quit(1)
End If

' Get hex string
HexString = Mid(RegLines(2), 39)
If (Len(HexString) Mod 2) <> 0 Then
    WScript.Echo "Got an odd number of hex digits in REG_BINARY data"
    WScript.Quit(1)
End If

' Convert to byte array
Dim ByteArray()
ReDim ByteArray((Len(HexString) / 2) - 1)  ' VBScript is just weird with array dimensions >.<

For i = 0 To (Len(HexString) - 2) Step 2
    ByteArray(i / 2) = CInt("&H" + Mid(HexString, i + 1, 2))
Next

Key = ConvertToKey(ByteArray)
WScript.Echo Key

' janek2012's magic decoding function
Function ConvertToKey(Key)
    Const KeyOffset = 52 ' Offset of the first byte of key in DigitalProductId - helps in loops
    isWin8 = (Key(66) \ 8) And 1 ' Check if it's Windows 8 here...
    Key(66) = (Key(66) And &HF7) Or ((isWin8 And 2) * 4) ' Replace 66 byte with logical result
    Chars = "BCDFGHJKMPQRTVWXY2346789" ' Characters used in Windows key
    ' Standard Base24 decoding...
    For i = 24 To 0 Step -1
        Cur = 0
        For X = 14 To 0 Step -1
            Cur = Cur * 256
            Cur = Key(X + KeyOffset) + Cur
            Key(X + KeyOffset) = (Cur \ 24)
            Cur = Cur Mod 24
        Next
        KeyOutput = Mid(Chars, Cur + 1, 1) & KeyOutput
        Last = Cur
    Next
    ' If it's Windows 8, put "N" in the right place
    If (isWin8 = 1) Then
        keypart1 = Mid(KeyOutput, 2, Cur)
        insert = "N"
        KeyOutput = keypart1 & insert & Mid(KeyOutput, Cur + 2)
    End If
    ' Divide keys to 5-character parts
    a = Mid(KeyOutput, 1, 5)
    b = Mid(KeyOutput, 6, 5)
    c = Mid(KeyOutput, 11, 5)
    d = Mid(KeyOutput, 16, 5)
    e = Mid(KeyOutput, 21, 5)
    ' And join them again adding dashes
    ConvertToKey = a & "-" & b & "-" & c & "-" & d & "-" & e
    ' The result of this function is now the actual product key
End Function
 
Last edited:

Subsonic44

Senior Member
Jan 21, 2012
1,179
574
Virginia
This tool can be used on Windows RT 8.0 to extract a product key without needing either a Windows PC or a jailbreak. Copy this into Notepad and save it as a .bat file. Double-click it and it'll print out your product key, and you can copy it from that console window.

I've only tested this on Windows RT 8.0. It also seems to work on Windows 8.0 (i.e. x86 versions). No idea what happens on 8.1.

Works great on 8.1 RT too. Thanks!
 
  • Like
Reactions: KrautHolg

Osprey00

Senior Member
Jul 21, 2009
388
168
Great work, Myriachan. I'd already gotten my code via other means, but I ran the script to verify that it gets the same key and it does. As Subsonic44 wrote, it does work on 8.1.

If anyone forgets how to copy it to the clipboard from the command prompt: tap and hold (or right-click) anywhere in the window, select Mark, highlight the key and tap and hold (or right-click) anywhere again.
 
Last edited:
  • Like
Reactions: demandarin

Subsonic44

Senior Member
Jan 21, 2012
1,179
574
Virginia
Where I have to use the product key I get?

When you install this: DRIVERS FOR SURFACE RT ONLY___MICROSOFT WINDOWS RT 8 1 WITH OFFICE 2013 RT RTM WOA ENGLISH DVD-WZT

you have to use an install key that won't activate. You will need to change your product key back to your original that you copied down using this tool in order to activate your new 8.1 Windows RT.
 
  • Like
Reactions: hooddy

hisoft

Senior Member
Feb 17, 2009
199
20
When you install this: DRIVERS FOR SURFACE RT ONLY___MICROSOFT WINDOWS RT 8 1 WITH OFFICE 2013 RT RTM WOA ENGLISH DVD-WZT

you have to use an install key that won't activate. You will need to change your product key back to your original that you copied down using this tool in order to activate your new 8.1 Windows RT.

Thank you for the answer. If I can find some free time I may have to try it. :good:
 
Myriachan,

Thank you very much for doing this! Before proceeding with my 8.1 RTM upgrade, I would like to confirm one thing: your scripted returned a strange key (see below).

C:\Users\XXXX>rem &
XXXXX-XXXXX-XXXXX-XXXXX-CBV2
Press any key to continue . . .

Notice the last tuple only contains 4 characters. Can this possibly be correct?

Thanks in advance,
Rich
==========================
UPDATE: I retrieved my key using WinTK on another machine. Looks like there is a displacement issue.

X????-?????-?????-????7-CBV2 - using this tool
NX???-?????-?????-?????-7CBV2 - using WinTK
 
Last edited:

Osprey00

Senior Member
Jul 21, 2009
388
168
UPDATE: I retrieved my key using WinTK on another machine. Looks like there is a displacement issue.

X????-?????-?????-????7-CBV2 - using this tool
NX???-?????-?????-?????-7CBV2 - using WinTK

[EDIT: The following doesn't solve the issue, so don't bother with it, but the code change in my later post does. Myriachan has added that change to the first post, so if you've just now created the batch file, you already have the fix.]

It seems to me that janek2012's function may not account for the possibility of 'N' being the very first character of the product key. Find this line 2/3rds of the way into his function...
Code:
	keypart1 = Mid(KeyOutput, 2, Cur)
...and replace it with...
Code:
	If (Cur = 0) Then
		keypart1 = Mid(KeyOutput, 1, 1)
	Else
		keypart1 = Mid(KeyOutput, 2, Cur)
	End If
I've done a little testing and that seems to solve it, but I had to make an assumption without having an actual key that starts with 'N'. If it doesn't solve it, Myriachan may have a better idea.
 
Last edited:
Osprey00,

That "seems" to be working. Thank you very much! As I reported in an update above, I got my key another way. I am now successfully running RT 8.1 RTM on my Surface RT. Interestingly, I did change the script as you suggested, ran it on RT 8.1 and found out that the key on RT 8.1 is entirely different than the one I used to activate RT 8.1. Hmmm....

Thanks again,
Rich
 

Osprey00

Senior Member
Jul 21, 2009
388
168
Osprey00,

That "seems" to be working. Thank you very much! As I reported in an update above, I got my key another way. I am now successfully running RT 8.1 RTM on my Surface RT. Interestingly, I did change the script as you suggested, ran it on RT 8.1 and found out that the key on RT 8.1 is entirely different than the one I used to activate RT 8.1. Hmmm....

Thanks again,
Rich

Well, in that case, my modification probably doesn't work. It ought to return the same key that you got via WinTK and activated with. If it's different, then it's likely wrong. Thanks for trying, though. It was worth a shot. I guess that I'll leave it to Myriachan to solve.
 

Myriachan

Senior Member
Feb 11, 2013
117
174
Well, in that case, my modification probably doesn't work. It ought to return the same key that you got via WinTK and activated with. If it's different, then it's likely wrong. Thanks for trying, though. It was worth a shot. I guess that I'll leave it to Myriachan to solve.

I don't know anything about the Microsoft product key algorithm itself, so I can't fix it directly. If you have the source code to a tool that does work with such keys, even in another language like C++, I could figure it out and update my tool to support it.

Melissa
 

Osprey00

Senior Member
Jul 21, 2009
388
168
Let's try this again. If anyone with the issue (to re-iterate, you get a key with only 4 characters in the last set) wants to test this, find this line of janek2012's function...

Code:
KeyOutput = Replace(KeyOutput, keypart1, keypart1 & insert, 2, 1, 0)

...and replace it with this...

Code:
KeyOutput = keypart1 & insert & Mid(KeyOutput, Cur + 2)

Verify that against what another tool told you is your key and let us know if it checks out.

For the curious, what I believe is the issue is that the original function doesn't work for when the 'N' is the first character of the product key. In that particular case, keypart1 is set to "" (because there are no characters in front of 'N' when it's the first character) and the Replace function, therefore, ends up searching for "" and not finding it, so 'N' doesn't get inserted into the string anywhere (leaving the key one character short).
 
Last edited:

Myriachan

Senior Member
Feb 11, 2013
117
174
Verify that against what another tool told you is your key and let us know if it checks out.

For the curious, what I believe is the issue is that the original function doesn't work for when the 'N' is the first character of the product key. In that particular case, keypart1 is set to "" (because there are no characters in front of 'N' when it's the first character) and the Replace function, therefore, ends up searching for "" and not finding it, so 'N' doesn't get inserted into the string anywhere (leaving the key one character short).

I've incorporated your change into the code and credited you. Thanks! =^-^=

The refurbished ASUS x86 laptop I bought to experiment with the x86 version of Secure Boot happens to have a Windows 8.0 CD key that starts with N, so I was able to test the new version. =) (It had the missing letter problem with the previous version.)
 
  • Like
Reactions: Osprey00

Subsonic44

Senior Member
Jan 21, 2012
1,179
574
Virginia
I've incorporated your change into the code and credited you. Thanks! =^-^=

The refurbished ASUS x86 laptop I bought to experiment with the x86 version of Secure Boot happens to have a Windows 8.0 CD key that starts with N, so I was able to test the new version. =) (It had the missing letter problem with the previous version.)

Works now on my 8.1 RTM Surface. My "N" now shows up. Thanks!
 

Jon4248

Senior Member
Sep 7, 2012
153
71
Nice, I have a question.
I recently stumbled upon a bat file sent to someone @ MS for a problem they where having with Windows activation on there RT.

Inside it shows the bat script clearing the activation files and registering keys for both Windows RT and Office, this maybe useful if for some reason my Surface 2 becomes deactivated, the problem is I don't know my office 2013 key...any idea's on how to get that?

I attached the bat file as i found it in case anyone wants it. (dunno who's keys are in there)
 

Attachments

  • RTactivation.zip
    606 bytes · Views: 1,120

dalexop

Member
Dec 9, 2014
19
3
Toronto
Find Product Key Batch File for Windows RT 8

Hi folks,

I have a VivoTab TF600 that hit the BSOD issue shortly after a Win 8.1 Patching cycle.
It originally hit error Code 0xc0000001 all the time.

After executing many suggestions from the Web on how to fix it, I now hit
a. Error code 0x0000005c
b. Parameters
i. 0x00000110
ii. 0x05250631
iii. 0x00000014
iv. 0xc0000001
First, then after a reboot, it hits the Code 0xc0000001

I tried the FIndProductKey.Bat file on this tablet and received:
"Error: The System was unable to find the specified registry key or value.
Got invalid header trying to run reg.exe" ( Which is echo'd from the Batch )

What would contribute to give that error ?
*** Found a work-around ***
Copy the SOFTWARE hive from the C:\Windows\System32\Config directory to the USB.
Plug it into a AMD or x86 based Windows 7 Machine and run ProduKey. Change the source to read the hive. And that's it, the key for the Win 8 RT OS and 2013 Office was displayed.
:)

Thanks
 
Last edited:

dalexop

Member
Dec 9, 2014
19
3
Toronto
Windows 8 RT Original Product Key

Hi folks,
Once Win 8.1 is on the platform, the original product key is lost. ( Unless you squirrelled away the Hives somewhere )
I understand that it`s linked to the firmware on the Tablet.
( In this case the ASUS T600TF )

When Win 8 RT Setup runs from the original image, it must compare the Input key with the once it`s expecting.
The Windows 8.1 key definitely does not work.

Anyone aware of a way to decode the original key through Windows RE ?

Thanks
 

Aka-ra

New member
Dec 5, 2016
1
0
I am a non-programmer. Can you elaborate the instruction a little simpler?

I really appreciate your contribution to the forum. However, I don't really get what you mean because i am a non-programmer. Can you make your instruction simpler so that i can follow your instruction to solve my surface RT problems. My window RT is not activated and all MS office apps did not work at all. Thank you in advance for your kind contribution to solve activation problem. also what do you mean by "change the source to read the hive"?
Hi folks,

I have a VivoTab TF600 that hit the BSOD issue shortly after a Win 8.1 Patching cycle.
It originally hit error Code 0xc0000001 all the time.

After executing many suggestions from the Web on how to fix it, I now hit
a. Error code 0x0000005c
b. Parameters
i. 0x00000110
ii. 0x05250631
iii. 0x00000014
iv. 0xc0000001
First, then after a reboot, it hits the Code 0xc0000001

I tried the FIndProductKey.Bat file on this tablet and received:
"Error: The System was unable to find the specified registry key or value.
Got invalid header trying to run reg.exe" ( Which is echo'd from the Batch )

What would contribute to give that error ?
*** Found a work-around ***
Copy the SOFTWARE hive from the C:\Windows\System32\Config directory to the USB.
Plug it into a AMD or x86 based Windows 7 Machine and run ProduKey. Change the source to read the hive. And that's it, the key for the Win 8 RT OS and 2013 Office was displayed.
:)

Thanks
 

Top Liked Posts

  • There are no posts matching your filters.
  • 25
    This tool can be used on Windows RT 8.0 to extract a product key without needing either a Windows PC or a jailbreak. Copy this into Notepad and save it as a .bat file. Double-click it and it'll print out your product key, and you can copy it from that console window.

    I've only tested this on Windows RT 8.0. It also seems to work on Windows 8.0 (i.e. x86 versions). No idea what happens on 8.1.

    Code:
    ::' Windows RT 8.0 Product Key Dumper by Myria of xda-developers.com
    ::' Original Windows 8.0 VBScript by janek2012 of mydigitallife.info
    ::' Batch+VBScript hybrid trick by dbenham of stackoverflow.com
    ::' Fix for keys starting with N by Osprey00 of xda-developers.com
    ::'
    ::' Windows RT doesn't let unsigned VBScript use WScript.Shell, which is
    ::' required in order to read the registry in VBScript.  So instead, we
    ::' have a batch file call reg.exe to do the registry lookup for us, then
    ::' execute the VBScript code.  Might as well do things this way, since
    ::' it would really suck to write this math in batch...
    
    ::' --- Batch portion ---------
    rem^ &@echo off
    rem^ &call :'sub
    ::' If we were run from double-clicking in Explorer, pause.
    rem^ &if %0 == "%~0" pause
    rem^ &exit /b 0
    
    :'sub
    ::' Read the registry key into VBScript's stdin.
    rem^ &("%SystemRoot%\System32\reg.exe" query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v DigitalProductId | cscript //nologo //e:vbscript "%~f0")
    ::'rem^ &echo end batch
    rem^ &exit /b 0
    
    '----- VBS portion ------------
    'WScript.Echo "begin VBS"
    
    ' Get registry data that was piped in
    RegData = ""
    Do While Not WScript.StdIn.AtEndOfStream
        RegData = RegData & WScript.StdIn.ReadAll
    Loop
    
    ' Remove any carriage returns
    RegData = Replace(RegData, ChrW(13), "")
    
    ' Split into lines
    RegLines = Split(RegData, ChrW(10))
    
    ' Sanity checking on data
    If (RegLines(0) <> "") Or (RegLines(1) <> "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion") Then
        WScript.Echo "Got invalid header trying to run reg.exe"
        WScript.Quit(1)
    End If
    
    If Left(RegLines(2), 38) <> "    DigitalProductId    REG_BINARY    " Then
        WScript.Echo "Got invalid value list trying to run reg.exe"
        WScript.Quit(1)
    End If
    
    ' Get hex string
    HexString = Mid(RegLines(2), 39)
    If (Len(HexString) Mod 2) <> 0 Then
        WScript.Echo "Got an odd number of hex digits in REG_BINARY data"
        WScript.Quit(1)
    End If
    
    ' Convert to byte array
    Dim ByteArray()
    ReDim ByteArray((Len(HexString) / 2) - 1)  ' VBScript is just weird with array dimensions >.<
    
    For i = 0 To (Len(HexString) - 2) Step 2
        ByteArray(i / 2) = CInt("&H" + Mid(HexString, i + 1, 2))
    Next
    
    Key = ConvertToKey(ByteArray)
    WScript.Echo Key
    
    ' janek2012's magic decoding function
    Function ConvertToKey(Key)
        Const KeyOffset = 52 ' Offset of the first byte of key in DigitalProductId - helps in loops
        isWin8 = (Key(66) \ 8) And 1 ' Check if it's Windows 8 here...
        Key(66) = (Key(66) And &HF7) Or ((isWin8 And 2) * 4) ' Replace 66 byte with logical result
        Chars = "BCDFGHJKMPQRTVWXY2346789" ' Characters used in Windows key
        ' Standard Base24 decoding...
        For i = 24 To 0 Step -1
            Cur = 0
            For X = 14 To 0 Step -1
                Cur = Cur * 256
                Cur = Key(X + KeyOffset) + Cur
                Key(X + KeyOffset) = (Cur \ 24)
                Cur = Cur Mod 24
            Next
            KeyOutput = Mid(Chars, Cur + 1, 1) & KeyOutput
            Last = Cur
        Next
        ' If it's Windows 8, put "N" in the right place
        If (isWin8 = 1) Then
            keypart1 = Mid(KeyOutput, 2, Cur)
            insert = "N"
            KeyOutput = keypart1 & insert & Mid(KeyOutput, Cur + 2)
        End If
        ' Divide keys to 5-character parts
        a = Mid(KeyOutput, 1, 5)
        b = Mid(KeyOutput, 6, 5)
        c = Mid(KeyOutput, 11, 5)
        d = Mid(KeyOutput, 16, 5)
        e = Mid(KeyOutput, 21, 5)
        ' And join them again adding dashes
        ConvertToKey = a & "-" & b & "-" & c & "-" & d & "-" & e
        ' The result of this function is now the actual product key
    End Function
    1
    This tool can be used on Windows RT 8.0 to extract a product key without needing either a Windows PC or a jailbreak. Copy this into Notepad and save it as a .bat file. Double-click it and it'll print out your product key, and you can copy it from that console window.

    I've only tested this on Windows RT 8.0. It also seems to work on Windows 8.0 (i.e. x86 versions). No idea what happens on 8.1.

    Works great on 8.1 RT too. Thanks!
    1
    Great work, Myriachan. I'd already gotten my code via other means, but I ran the script to verify that it gets the same key and it does. As Subsonic44 wrote, it does work on 8.1.

    If anyone forgets how to copy it to the clipboard from the command prompt: tap and hold (or right-click) anywhere in the window, select Mark, highlight the key and tap and hold (or right-click) anywhere again.
    1
    Where I have to use the product key I get?

    When you install this: DRIVERS FOR SURFACE RT ONLY___MICROSOFT WINDOWS RT 8 1 WITH OFFICE 2013 RT RTM WOA ENGLISH DVD-WZT

    you have to use an install key that won't activate. You will need to change your product key back to your original that you copied down using this tool in order to activate your new 8.1 Windows RT.
    1
    Verify that against what another tool told you is your key and let us know if it checks out.

    For the curious, what I believe is the issue is that the original function doesn't work for when the 'N' is the first character of the product key. In that particular case, keypart1 is set to "" (because there are no characters in front of 'N' when it's the first character) and the Replace function, therefore, ends up searching for "" and not finding it, so 'N' doesn't get inserted into the string anywhere (leaving the key one character short).

    I've incorporated your change into the code and credited you. Thanks! =^-^=

    The refurbished ASUS x86 laptop I bought to experiment with the x86 version of Secure Boot happens to have a Windows 8.0 CD key that starts with N, so I was able to test the new version. =) (It had the missing letter problem with the previous version.)