Multi-OEM/Retail Project {MRP} - Mk3

In the qt it reads the Value from the registry, if defender has been removed by editing etc the registry is not always updated too, so there is always some bits left.

If defender is intact and you just disable the real-time option in its dashboard it can confuse the qt , I still need to address that.

The to do list has grown

 

This morning my laptop went into the repair boot loop, took me a couple of hours to get it out of the looping.

It turned out to be panda av had somehow decided to uninstall itself when I turned off the laptop last night.

After fixing the 'missing' file that the boot manager was complaining about in the event log/dump. I decided to look at programs and features to make sure panda was gone which it was.

Then I used bulk crap uninstaller and I saw copilot had installed yesterday, yet I never saw it on the start menu or in apps in settings not even on the taskbar??

I didn't think it was on win10 and certainly not without any ai chip as this laptop is from 2011 era!!

I not see it download or install but the date was last night, I not use wusince February and wu is set to notify anyway. Defender is gone and disabled as that was annoying me.

 

I only saw copilot when I used bulk crap uninstaller as I wanted to make sure the registry was clear of any panda av bits left over.

It was not showing anywhere else which confused me. Bcu removed copilot.

How it sneaked on I don't know, makes you wonder what other s**te ms can sneak in through the backdoor!!

 

Have uploaded the product channel ID compiled autoit file (zipped) for beta testers if they wish to help test if i have got the right offset (as there could be 2 areas in the binary block in the registry used to filter the value).

No idea if it will work on any OS below windows 10 as i not got access to that test laptop until the weekend after a hospital appointment.

I have guessed the offset as it seems it can be in more than one place, there is a lot of 00 (zero/null) areas in the binary block, i just used the 2nd area i saw the pattern i was looking for, as it seemed to be in the same place on w10 and 11.

I have added in a check if the OS is 32 or 64 bit architecture as that can make a difference too if the binary result is in the registry, this was a issue with powershell but that acted very strange even if you 'forced' pshell to look at 64 bit registry...

Anyway using the simplified method in AutoIT is so much faster than PShell, and no WMI in sight either!

 

Thank f* for that

 

Have uploaded GUI QT v1.08f for beta testers

This has the new binary code routine in for the key channel ID, it will fall back to WMI method if something not right (hopefully), the log and GUI will show {Binary : PKC} or {WMI : PKC} depending on which routine is used. Sorted the 'HWID/Digital Store Licence' reference as i forgot about that...

Technically it should work on win7 based OS's too, not too sure about win8.0 as i think i had other plans for that OS and not got round to adding that part in..

It is experimental as i not been able to check on anything other than 'Retail', such as when using KMS/MAK/OEM_DM etc as unsure what the values are - i just guessed they use same format as WMIc does... Can adjust as needed, after all it is a beta.

 

Yes as most are Retail, but those with LTSB/C or Enterprise etc that is using KMS, MAK, plus those with OEM_DM being used or the SLP ones i have guessed they are values that are the same used with WMIc productkeychannel ID's...

Such as a Server that can be KMS or other key based and not Retail as i doubt if m$ made that Retail

 

Yeah I think I not cleared a variable with n/a in which on a test further on if the variable is non blank it not get the new info added to show.

At least the code is ok for the binary to hex to string and working.

On wmi/c it would return oem_slp so at least now I can fix that easy.

Thanks for testing that really helps.

 

Much appreciated, little by little things get fixed or updated.