pkeyconfig Info Reader +Plus+ [v18.0.6] [ Re Uploaded ]

Discussion in 'MDL Projects and Applications' started by Dark Vador, Apr 22, 2024.

  1. Dark Vador

    Dark Vador X Æ A-12

    Feb 2, 2011
    4,781
    7,045
    150
    Can I have a screen shot
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  2. Low Level Perform

    Low Level Perform MDL Member

    Jul 21, 2024
    108
    98
    10
    #162 Low Level Perform, Aug 19, 2025
    Last edited: Aug 19, 2025
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  3. Dark Vador

    Dark Vador X Æ A-12

    Feb 2, 2011
    4,781
    7,045
    150
    Can you provide latest pkeyconfig file ( yours )
    Or just extract data and export to excel
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  4. Low Level Perform

    Low Level Perform MDL Member

    Jul 21, 2024
    108
    98
    10
    #164 Low Level Perform, Aug 19, 2025
    Last edited: Aug 19, 2025
    I just downloaded it from your page and tried it out.
    pkeyconfig_gui v18.0.3 (ReUpload).rar on page 1
    Didn't make any changes.

    update:
    I understand now. It turns out that the operating system used makes a difference.
    I opened it in 24H2, and it turned out that it could be displayed.
    @Dark Vador, I'm sorry to bother you.

    The problem has been solved.
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  5. Dark Vador

    Dark Vador X Æ A-12

    Feb 2, 2011
    4,781
    7,045
    150
    Darki found bug,
    i will re write the code for decode key
    to match C dissambly logic

    Code:
    <#
            sppcomapi.dll
            __int64 __fastcall GetWindowsPKeyInfo(_WORD *a1, __int64 a2, __int64 a3, __int64 a4)
            {
                __int128 v46[3]; // __m128 v46[3], 48 bytes total
                int v47[44];
                int v48[320];
                memset(v46, 0, sizeof(v46));
                memset_0(v47, 0, 0xA4ui64);
                memset_0(v48, 0, 0x4F8ui64);
                v47[0] = 164;   // size of structure 1
                v48[0] = 1272;  // size of structure 2
            }
            #>    
    
    So, darky write a small C++,
    with sizeof, and get diffrent size's
    so, to mimic to real api call,
    Aka, decode key using pidgenx,
    you actualy need do this,
    Code:
    # Allocate unmanaged memory for PID, DPID, and DPID4
    $PIDPtr   = New-IntPtr -Size 0x30 -WriteSizeAtZero
    $DPIDPtr  = New-IntPtr -Size 0xB0 -InitialValue 0xA4
    $DPID4Ptr = New-IntPtr -Size 0x500 -InitialValue 0x4F8
    
    and intersting part,
    Code:
       CChkMacroETWLoggerT<CEmptyType>::LogHResultEvent(0i64);
        if ( v21 )
          v11 = ((__int64 (__fastcall *)(_WORD *, LPCWSTR, const wchar_t *, _QWORD, __int128 *, int *, int *))ProcAddress)(
                  v44,
                  v9,
                  L"03612" --> ????
                  0i64,
                  v46,
                  v47,
                  v48);
    
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  6. Dark Vador

    Dark Vador X Æ A-12

    Feb 2, 2011
    4,781
    7,045
    150
    #166 Dark Vador, Aug 26, 2025
    Last edited: Aug 26, 2025
    (OP)
    bump version to [18.0.6.]
    Main change's -->
    • Application info tab have new property, Trusted time [latest activation time]
    • SLInstallProofOfPurchase, use `msft:rm/algorithm/pkey/detect` as default
    • PidGenX implementation was changed [[[ *** ]]]
    • Add new function IsTokenBasedEdition [still think how it can be useful]
    • Some other Little fixe`s, don't remember :D
    [*]
    Code:
            <#
            sppcomapi.dll
            __int64 __fastcall GetWindowsPKeyInfo(_WORD *a1, __int64 a2, __int64 a3, __int64 a4)
            {
                __int128 v46[3]; // __m128 v46[3], 48 bytes total
                int v47[44];
                int v48[320];
                memset(v46, 0, sizeof(v46)); // size of structure 2
                memset_0(v47, 0, 0xA4ui64);
                memset_0(v48, 0, 0x4F8ui64);
                v47[0] = 164;   // size of structure 3
                v48[0] = 1272;  // size of structure 4
            }
            #>
    
            # Allocate unmanaged memory for PID, DPID, and DPID4
            $PIDPtr   = New-IntPtr -Size 0x30  -WriteSizeAtZero
            $DPIDPtr  = New-IntPtr -Size 0xB0  -InitialValue 0xA4
            $DPID4Ptr = New-IntPtr -Size 0x500 -InitialValue 0x4F8
    
            try {
                try {
                    # Call the function with appropriate parameters
                    $result = $Global:PIDGENX::PidGenX(
                        $key, $configPath,
                        "03612",  # Default value for MSPID, 03612 ?? 00000 ?
                        0,        # UnknownUsage
                        $PIDPtr, $DPIDPtr, $DPID4Ptr
                    )
    
                    #Dump-MemoryAddress -Pointer $PIDPtr   -Length 0x30  -FileName PIDPtr
                    #Dump-MemoryAddress -Pointer $DPIDPtr  -Length 0xB0  -FileName DPIDPtr
                    #Dump-MemoryAddress -Pointer $DPID4Ptr -Length 0x500 -FileName DPID4Ptr
    
                } catch {
    
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  7. Dark Vador

    Dark Vador X Æ A-12

    Feb 2, 2011
    4,781
    7,045
    150
    #167 Dark Vador, Sep 3, 2025 at 08:06
    Last edited: Sep 3, 2025 at 18:21
    (OP)
    Darki re upload the version
    fix few bugs, and upgrade some modules
    ~~~~~~~~~~~~~~~
    found intresting thing,
    so, in my prev` list, i have missing prev`
    called SeDelegateSessionUserImpersonatePrivilege
    for next time.
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...