Captured Windows 8 KMS Activation Network Traffic

Discussion in 'Windows 8' started by Dhilip89, Aug 14, 2012.

  1. DarkStarXxX

    DarkStarXxX MDL Member

    Feb 14, 2010
    225
    71
    10
    I believe we will not see this time mini-kms, because that the whole traffic between Host & Client is crypted
     
  2. Mr Jinje

    Mr Jinje MDL Expert

    Aug 19, 2009
    1,769
    1,106
    60
    It was designed by men not by gods

    Why not, we have both a server and a client, we only need a russonivellian to determine what dll function is encrypting/decrypting. If these two OS's can figure out how to do it without talking to MSFT, it is only a matter of time before someone figures out how the OS is doing it and duplicates it.

    MSFT seems to say the same thing every few years, this new scheme will never be broken, yada yada yada. It's a sales and marketing gimmick, nothing more.
     
  3. lunar21

    lunar21 MDL Addicted

    Dec 14, 2008
    753
    270
    30
    Everything can be broken. If someone can code it, someone can decode it, its just a matter of time thats all :)

     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  4. FiB3R_OPTiC

    FiB3R_OPTiC MDL Member

    Oct 30, 2011
    154
    45
    10
    Behold, to be broken one must cast it into the fires from once it was forged, only then will it be unmade.
     
  5. Garbellano

    Garbellano MDL Addicted

    Aug 13, 2012
    947
    248
    30
    Wait! According to this "genius" is here! :

    :haha:

    I was browsing Microsoft Software Protection Platform Service for about a month now and nothing useful (related to the main function) is there.
     
  6. Mr Jinje

    Mr Jinje MDL Expert

    Aug 19, 2009
    1,769
    1,106
    60
    #126 Mr Jinje, Sep 19, 2012
    Last edited by a moderator: Apr 20, 2017
    Maybe the reason you can't find it in sppsvc.exe is cause they aint in there. My guess is you need to be looking in advapi32.dll. Found this in about 5 minutes. Now we just need access to a server + client + process monitor running on both to figure out what order we need to access them. Do we programatically "getHashParam" first, or CryptCreateHash first, then call CryptSignHashA or what is the order. For all we know, we start with CryptGenKey and go from there. You get my drift, it can be done, and will be much easier once someone has both sides of the equation under microscope takes a look.

    Code:
    00782048   CryptGenRandom                                       ADVAPI32 
    0078204C   CryptAcquireContextW                                 ADVAPI32 
    00782050   CryptReleaseContext                                  ADVAPI32 
    00782070   CryptGetHashParam                                    ADVAPI32 
    00782074   CryptVerifySignatureA                                ADVAPI32 
    00782078   CryptSignHashA                                       ADVAPI32 
    0078207C   CryptDecrypt                                         ADVAPI32 
    00782080   CryptEncrypt                                         ADVAPI32 
    00782084   CryptImportKey                                       ADVAPI32 
    00782088   CryptExportKey                                       ADVAPI32 
    0078208C   CryptDestroyKey                                      ADVAPI32 
    00782090   CryptGenKey                                          ADVAPI32 
    00782094   CryptDestroyHash                                     ADVAPI32 
    00782098   CryptHashData                                        ADVAPI32 
    0078209C   CryptCreateHash                                      ADVAPI32 
    
     
  7. Mr Jinje

    Mr Jinje MDL Expert

    Aug 19, 2009
    1,769
    1,106
    60
    #127 Mr Jinje, Sep 19, 2012
    Last edited: Sep 19, 2012
    I was thinking more along the lines of front-ending it. SPPSVC.exe is a KMS front-end for lack of a better term. We need a MDLSVC.exe to replace SPPSVC.exe on the server side and it can use built-in MSFT encryption to send the data in the approved format that the client is expecting.

    Once we know the handshake procedure our middleman service could in theory impersonate a KMS host and send a key for the client to encrypt with (which we could obviously decrypt upon return packet), my assumption is that the key is generated at the server because the server needs to be able to communicate with any random machine that attempts to contact it.

    Could be nice and neat and run from 127.0.0.1
     
  8. Jachra

    Jachra MDL Member

    Apr 5, 2010
    184
    55
    10
    Why doesn't anyone run the Windows 8 client and the Windows Server in debugged mode to see if that helps?
     
  9. velocidad

    velocidad MDL Member

    Nov 15, 2009
    152
    73
    10
    I'm curious, does a KMS host contact to MS after it's initial activation? I mean, it's possible to have a kms host on a private intranet?
     
  10. TCM

    TCM MDL Addicted

    Aug 25, 2011
    808
    417
    30
    That's the whole point, isn't it?
     
  11. velocidad

    velocidad MDL Member

    Nov 15, 2009
    152
    73
    10

    Maybe it is but I read somewhere that kms host contact MS from time to time, just want to know if someone has a little more info and not just a rumor.
     
  12. frwil

    frwil MDL Addicted

    Sep 22, 2008
    542
    198
    30
    Of course it checks for updates as any other Windows system, so at least for that it contacts MS, but i don't think it'd check something special for KMS, anyway it doesn't need internet connection (after activation) and to contact MS in any other way to eternally function as KMS host in local network space.
     
  13. tonyh2004

    tonyh2004 MDL Member

    Aug 2, 2011
    181
    39
    10
    This looks like a giant step forward in the activation stakes, really hope it can be made smaller and we can run our own vhd
     
  14. ZaForD

    ZaForD MDL Expert

    Jan 26, 2008
    1,211
    201
    60
    #135 ZaForD, Sep 20, 2012
    Last edited by a moderator: Sep 20, 2012
    As I understand it:
    You active the Host as ususal.
    Then add the KMS service and Host key, which also has to be activate with MS.
    Then all systems Server and Clients check their activation status as normal (180 days or so) with their Activation Server which in the case of the KMS Host Server may well be MS.
     
  15. FreeStyler

    FreeStyler MDL Guru

    Jun 23, 2007
    3,563
    3,853
    120
    #136 FreeStyler, Sep 20, 2012
    Last edited: Sep 20, 2012
    Not entirely true...
    U activate the OS with the KMS HOST key, once a KMS HOST key is inserted the OS automaticly enables the KMS Service
     
  16. ZaForD

    ZaForD MDL Expert

    Jan 26, 2008
    1,211
    201
    60
    OK, now things make alittle more sence. :cool:

    So are there different Host keys for OS/KMS Activation and just KMS Activation ?

    My SVR2008 R2 is activated already and when I tried to install the KMS service it asked for the KMS Host key.
    Which I guess will change the type of licence its running ???
     
  17. pisthai

    pisthai Imperfect Human

    Jul 29, 2009
    7,202
    2,271
    240
    AFAIK it will only change the type of License which is running if the Host-Key is for running OS. A Host-Key for an other type Licenses will not affect the running Licenses.
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  18. 100

    100 MDL Expert

    May 17, 2011
    1,354
    1,590
    60
    A KMS host key for Windows will work as both a license for the OS and enable it to work as a KMS. It will replace the previous OS license, so it doesn't matter if it was activated or not.
    A host key for Office will be installed as an additional license that only allows it to activate Office KMS clients, and it won't activate the host OS.

    You can run "slmgr.vbs /dlv all" to view all the available licenses, and it will show the KMS host license as well. It just isn't active and shows up as "not in use" until a KMS host key is entered and activated.
     
  19. Garbellano

    Garbellano MDL Addicted

    Aug 13, 2012
    947
    248
    30
    Thats THE crypto library, controlling this, you control the whole m$ crypto system (even the EFS, which catch my attention for awhile till I give up). The KMS 'system' exchange with this dll but it seems its a lil complex, at least to me, understand this dialog.
    The KMS 'idea' (based on the russians work/hack, like the did with enterprise on 7) seems a good start but in some point has no sense, I mean, you need to run something every 180 days, for the rest of this system life, to validate your system and I want something more definitive.