Captured Windows 8 KMS Activation Network Traffic

Discussion in 'Windows 8' started by Dhilip89, Aug 14, 2012.

  1. CODYQX4

    CODYQX4 MDL Developer

    Sep 4, 2009
    4,813
    45,776
    150
    #301 CODYQX4, Feb 10, 2013
    Last edited: Apr 12, 2019
    .
     
  2. mikmik38

    mikmik38 MDL Novice

    Dec 22, 2012
    23
    649
    0
    #302 mikmik38, Feb 11, 2013
    Last edited: Feb 11, 2013
    int RequestActivation(handle_t IDL_Handle, int RequestSize, unsigned char *Request,
    int *ResponseSize, unsigned char **Response)
    {
    int i;
    REQUEST_V5 *Request_v5;
    RESPONSE_V5 *Response_v5;
    BYTE *Buffer;
    MemoryBuffer=(unsigned char*)midl_user_allocate(MemoryBufferSize);
    Buffer = new BYTE[512];
    Request_v5=(REQUEST_V5 *)Request;
    Response_v5 = new RESPONSE_V5;
    memset(Response_v5,0x00,sizeof(RESPONSE_V5));
    memcpy((BYTE *)Response_v5->Salt,(BYTE *)Request_v5->Salt,16);
    AesInit(AES_TYPE_128,AES_MODE_CBC,0x02,SessionKey,Request_v5->Salt);
    DecryptMessage(256,(BYTE *)(&Request_v5->Salt));
    Response_v5->MinorVer=0;
    Response_v5->MajorVer=5;
    Response_v5->Response.MinorVer=0;
    Response_v5->Response.MajorVer=5;
    Response_v5->Response.KmsPIDLen=0x62;
    memcpy((BYTE *)Response_v5->Response.kmsPID,(BYTE *)kmsPID,0x62);
    memcpy((BYTE *)(&Response_v5->Response.CmId),(BYTE *)(&Request_v5->Request.CmId),16);
    memcpy((BYTE *)(&Response_v5->Response.TimeStamp),(BYTE *)(&Request_v5->Request.TimeStamp),8);
    Response_v5->Response.ActivatedMachines=ActivatedMachines;
    Response_v5->Response.ActivationInterval=ActivationInterval;
    Response_v5->Response.RenewalInterval=RenewalInterval;
    for(i=0 ; i<16 ; i++){
    Response_v5->Data1=Request_v5->Salt^Response_v5->Salt^0x61;
    };
    memcpy((BYTE *)(Response_v5->Data2),Data2,16);
    memcpy((BYTE *)(Response_v5->Data3),Data3,16);
    EncryptMessage(190,(BYTE *)&Response_v5->Response);
    AesClear();
    memcpy(MemoryBuffer,(BYTE *)Response_v5,sizeof(RESPONSE_V5));
    *ResponseSize=sizeof(RESPONSE_V5);
    *Response = MemoryBuffer;
    printf("Activation response sent.\r\n");
    delete(Response_v5);
    delete(Buffer);
    return 0;
    };
     
  3. mikmik38

    mikmik38 MDL Novice

    Dec 22, 2012
    23
    649
    0
    #303 mikmik38, Feb 11, 2013
    Last edited: Feb 11, 2013
    The session key is static.

    For KMS-server based on Windows7x86 with the update KB2691586 we have:
    Response_v5.Data1=Salt^DSalt]^aaaa. This is an error of Microsoft.

    For KMS-server based on Windows7x86 with the update KB2757817 and later we have:
    Response_v5.Data1=Salt^DSalt]^aaaa^Rnd. In this case "Rnd" affects Data2 and Data3.
    Unfortunately, I do not know this algorithm. The Rnd word is changed every time when
    the KMS-server reloads. But this is not important, because Data2 and Data3 posted early
    work properly.
     
  4. CODYQX4

    CODYQX4 MDL Developer

    Sep 4, 2009
    4,813
    45,776
    150
    #304 CODYQX4, Feb 11, 2013
    Last edited: Apr 12, 2019
    .
     
  5. CODYQX4

    CODYQX4 MDL Developer

    Sep 4, 2009
    4,813
    45,776
    150
    #305 CODYQX4, Feb 11, 2013
    Last edited: Apr 12, 2019
    .
     
  6. mikmik38

    mikmik38 MDL Novice

    Dec 22, 2012
    23
    649
    0
    Please look up an attachment.

    {
    BYTE *Buffer;
    Buffer = new BYTE[512];
    delete(Buffer);
    } - > This code is not needed...

    const int MemoryBufferSize=1024;
    const int ActivatedMachines=50;
    const int ActivationInterval=120;
    const int RenewalInterval=7*24*60;
    BYTE *MemoryBuffer;

    void DecryptMessage(int MessageSize, BYTE *Message)
    {
    BYTE *p;
    DWORD q;
    p = new BYTE[MessageSize];
    memcpy(p,Message,MessageSize);
    AesDecrypt(p,MessageSize,Message,&q);
    delete(p);
    };

    void EncryptMessage(int MessageSize, BYTE *Message)
    {
    BYTE *p;
    DWORD q;
    p = new BYTE[MessageSize];
    memcpy(p,Message,MessageSize);
    AesEncrypt(p,MessageSize,Message,&q);
    delete(p);
    };
     

    Attached Files:

  7. CODYQX4

    CODYQX4 MDL Developer

    Sep 4, 2009
    4,813
    45,776
    150
    #307 CODYQX4, Feb 12, 2013
    Last edited: Apr 12, 2019
    .
     
  8. mikmik38

    mikmik38 MDL Novice

    Dec 22, 2012
    23
    649
    0
    I think you should include in the file data.h after line "#define DataH" the following information:
    #include <windows.h> or #include "Defines.h" to define "BYTE", "WORD" etc.
     
  9. mikmik38

    mikmik38 MDL Novice

    Dec 22, 2012
    23
    649
    0
    #309 mikmik38, Feb 12, 2013
    Last edited: Feb 12, 2013
    It is advisable to set the Project's property "Struct Member Alignment" to "1" to prevent any surprises.
     
  10. CODYQX4

    CODYQX4 MDL Developer

    Sep 4, 2009
    4,813
    45,776
    150
    #310 CODYQX4, Feb 12, 2013
    Last edited: Apr 12, 2019
    .
     
  11. CODYQX4

    CODYQX4 MDL Developer

    Sep 4, 2009
    4,813
    45,776
    150
    #311 CODYQX4, Feb 12, 2013
    Last edited: Apr 12, 2019
    .
     
  12. mikmik38

    mikmik38 MDL Novice

    Dec 22, 2012
    23
    649
    0
    Well done! We all look forward to working KMSEmulator with the ability to change the KMSPid.
     
  13. user_hidden

    user_hidden MDL Expert

    Dec 18, 2007
    1,034
    1,062
    60
    If i'm not mistaken you can change the KMSpid with KMSServer.

    KMSserver.exe [port#] [KMSpid#]
     
  14. CODYQX4

    CODYQX4 MDL Developer

    Sep 4, 2009
    4,813
    45,776
    150
    #314 CODYQX4, Feb 12, 2013
    Last edited: Apr 12, 2019
    .
     
  15. paul44

    paul44 MDL Member

    Feb 11, 2010
    176
    80
    10
    Amazing news so far CODYQX4! All the best :)
     
  16. CODYQX4

    CODYQX4 MDL Developer

    Sep 4, 2009
    4,813
    45,776
    150
    #316 CODYQX4, Feb 15, 2013
    Last edited: Apr 12, 2019
    .
     
  17. Superfly

    Superfly MDL Expert

    Jan 12, 2010
    1,142
    543
    60
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  18. FreeStyler

    FreeStyler MDL Guru

    Jun 23, 2007
    3,563
    3,853
    120
    mikmik38, thank you for your contributions! Wouldn't be where we are, without it :D
     
  19. mikmik38

    mikmik38 MDL Novice

    Dec 22, 2012
    23
    649
    0
    I just wanted to help people.:rolleyes:
     
  20. rrohela

    rrohela MDL Expert

    Sep 1, 2009
    1,610
    1,409
    60
    Thanks for your great help...:worthy: