dissect.target.plugins.os.windows.productkey

Module Contents

Classes

WindowsProductKeyPlugin

Windows product key plugin.

Functions

decode_cd_key

Decode the given bytes to a Windows CD key using a pseudo base24 implementation.

Attributes

pid_def

c_pid

WindowsProductKeyRecord

dissect.target.plugins.os.windows.productkey.pid_def = Multiline-String
Show Value
"""
struct DigitalProductId {
    DWORD   uiSize;
    SHORT   MajorVersion;
    SHORT   MinorVersion;
    CHAR    szProductId[24];
    DWORD   uiKeyIdx;
    CHAR    szEditionId[16];
    CHAR    bCDKey[16];
    DWORD   uiCloneStatus;
    DWORD   uiTime;
    DWORD   uiRandom;
    DWORD   uiLt;
    DWORD   uiLicenseData[2];
    CHAR    sOemId[8];
    DWORD   uiBundleId;
    CHAR    sHardwareIdStatic[8];
    DWORD   uiHardwareIdTypeStatic;
    DWORD   uiBiosChecksumStatic;
    DWORD   uiVolSerStatic;
    DWORD   uiTotalRamStatic;
    DWORD   uiVideoBiosChecksumStatic;
    CHAR    sHardwareIdDynamic[8];
    DWORD   uiHardwareIdTypeDynamic;
    DWORD   uiBiosChecksumDynamic;
    DWORD   uiVolSerDynamic;
    DWORD   uiTotalRamDynamic;
    DWORD   uiVideoBiosChecksumDynamic;
    DWORD   uiCRC32;
};

struct DigitalProductId4 {
    DWORD   uiSize;
    SHORT   MajorVersion;
    SHORT   MinorVersion;
    WCHAR   szAdvancedPid[64];
    WCHAR   szActivationId[64];
    WCHAR   szOemID[8];
    WCHAR   szEditionType[260];
    BYTE    bIsUpgrade;
    CHAR    bReserved[7];
    CHAR    bCDKey[16];
    CHAR    bCDKey256Hash[32];
    CHAR    b256Hash[32];
    WCHAR   szEditionId[64];
    WCHAR   szKeyType[64];
    WCHAR   szEULA[64];
};
"""
dissect.target.plugins.os.windows.productkey.c_pid
dissect.target.plugins.os.windows.productkey.WindowsProductKeyRecord
class dissect.target.plugins.os.windows.productkey.WindowsProductKeyPlugin(target: dissect.target.target.Target)

Bases: dissect.target.plugin.Plugin

Windows product key plugin.

KEY = 'HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion'
VALUES = ('DigitalProductId4', 'DigitalProductId')
check_compatible() → None

Perform a compatibility check with the target.

This function should return None if the plugin is compatible with the current target (self.target). For example, check if a certain file exists. Otherwise it should raise an UnsupportedPluginError.

Raises:

UnsupportedPluginError – If the plugin could not be loaded.

productkey() → collections.abc.Iterator[WindowsProductKeyRecord]

Yield Windows product key(s) of the target.

References

dissect.target.plugins.os.windows.productkey.decode_cd_key(input: bytes | bytearray) → str

Decode the given bytes to a Windows CD key using a pseudo base24 implementation.