Windows 98 Product Key Algorithm

[AlexJ]

For fun, I thought I'd give it a go and see if I could "see inside" the windows 98 product key (like the windows 95 product key) to see if it was as easy as before in making one, this is what I came up with...

HR4TT-FJX9Y-CHBCR-PF847-4K4F8 < Windows 98 SE (found it on Google)

I thought I'd try see if the letters were equal to numbers as in...

A=1
B=2
C=3 and so on...

Block 1: 8/18/4/20/20 = 70
Block 2: 6/10/24/9/25 = 74
Block 3: 3/8/2/3/18 = 34
Block 4: 16/6/8/4/7 = 41
Block 5: 4/11/4/6/8 = 33

All the numbers together = 252

252/25 = 10.08

I might be completely off track here but that's what I got.

-

The Product ID for the above Product Key: 06507-OEM-0077194-26671

Now, the product id is more easier to understand, as in it's the same format as the Windows 95 product key (as we know and understand how to add them up to make the key).

Block 1: 0+6+5+0+7=18
[OEM]
Block 3: 0+0+7+7+1+9+4=28
Block 4: 2+6+6+7+1=21

Question is, how did Microsoft get the product id (numbers) into the product key (a mix of letters and numbers).

[linuxlove]

I looked into these letter/number keys a while ago; I wanted to write a program which could tell what version of Windows a key was for. From what I remember, the keys are checked with elliptic curves and other complex maths.

[ViennaXP]

The algorithm is easy...
The entered key must be a Digit sum of 7 , as i can remember

[AlexJ]

The algorithm is easy...
The entered key must be a Digit sum of 7 , as i can remember

For Windows 98/SE?

[ViennaXP]

For 95/NT4 for sure i think
and i think for 98 this works too

[ViennaXP]

Found it (95/Nt4) :

1. the first digit of the first 5-digit block must be a 1 or 2
2. the first 3 digits of the 7-digit blick must be 000
3. the digit sum of the last 4 digits in the 7-digit block must be 7
4. the 5 digits of the last block are irrelevant

[AlexJ]

Found it (95/Nt4) :

1. the first digit of the first 5-digit block must be a 1 or 2
2. the first 3 digits of the 7-digit blick must be 000
3. the digit sum of the last 4 digits in the 7-digit block must be 7
4. the 5 digits of the last block are irrelevant

Thanks, but this topic is for Windows 98/SE.

[ViennaXP]

yeah i searching for 98 but good to know if you have 95.... (for 95 it should also work if you only type in 7s , but i am really unsure , i have to test it out again).

[nathaniel87]

Hey, you guys might find this interesting (I found this at http://www.licenturion.com/xp/fully-licensed-wpa.txt). I know this document is specifically about Windows XP, but I imagine that some of the same techniques might go into decoding a Windows 98 key.

>>>> Product Key

The Raw Product Key is buried inside the Product Key that is printed
on the sticker distributed with each Windows XP CD. It consists of
five alphanumeric strings separated by '-' characters, where each
string is composed of five characters, as in

FFFFF-GGGGG-HHHHH-JJJJJ-KKKKK

Each character is one of the following 24 letters and digits:

B C D F G H J K M P Q R T V W X Y 2 3 4 6 7 8 9

Very similar to the decimal encoding of the Installation ID the 25
characters of the Product Key form a base-24 encoding of the binary
representation of the Product Key. Decoding the Product Key yields a
multi-precision integer of roughly 115 bits, which is stored - again
in little endian byte order - in an array of 15 bytes. Decoding the
above Product Key results in the following byte sequence.

0x6F 0xFA 0x95 0x45 0xFC 0x75 0xB5 0x52
0xBB 0xEF 0xB1 0x17 0xDA 0xCD 0x00

Of these 15 bytes the least significant four bytes contain the Raw
Product Key in little endian byte order. The least significant bit is
removed by shifting this 32-bit value (0x4595FA6F - remember the
little endian byte order) to the left by one bit position, resulting
in a Raw Product Key of 0x22CAFD37, or

583728439

in decimal notation.

The eleven remaining bytes form a digital signature, allowing
verification of the authenticity of the Product Key by means of a
hard-coded public key.

>>>> Product Key -> Product ID

The three most significant digits, i.e. 583, of the Raw Product Key's
nine-digit decimal representation directly map to the BBB component of
the Product ID described above.

To obtain the CCCCCCC component, a check digit is appended to the
remaining six digits 728439. The check digit is chosen such that the
sum of all digits - including the check digit - is divisible by
seven. In the given case, the sum of the six digits is

7 + 2 + 8 + 4 + 3 + 9 = 33

which results in a check digit of 2, since

7 + 2 + 8 + 4 + 3 + 9 + 2 = 33 + 2 = 35

which is divisible by seven. The CCCCCCC component of the Product ID
is therefore 7284392.

For verifying a Product Key, more than one public key is available. If
verification with the first public key fails, the second is tried,
etc. The DD component of the Product ID specifies which of the public
keys in this sequence was successfully used to verify the Product Key.

This mechanism might be intended to support several different parties
generating valid Product Keys with different individual private keys.

However, the different private keys might also represent different
versions of a product. A Product Key for the 'professional' release
could then be signed with a different key than a Product Key for the
'server' release. The DD component would then represent the product
version.

Finally, a valid Product ID derived from our example Product Key might
be

55034-583-7284392-00123