How to Recover WinXP Product key with unbootable drive

[MCR7]

I am a computer tech who runs into systems that will not boot normally or into safe mode after a new mother board install and I need to re-install windows with the customers Product Key from the unbootable system. I have tried everything I can find on the net to extract the key with no avail. Can someone please tell me a method that will work.

Marc

Marc's Computer Repair

[submix8c]

You have to hook the HDD to another PC as a secondary and Load the Hive containing the Key via a Primary Win2k/xp/2k3 Running System (using Regedt32).

The info as to how to interpret the info you Load is on the Internet (certain positions of a certain value of a certain length).

Be sure to Unload the Hive after you got the info. And be sure you got the Correct Key.

Odd that you should ask that. Usually (AFAIK, except in OEM SLP) you can just reactivate, and the OS is bootable. In the other case (OEM SLP) where the OS is "locked" to motherboard, you have to "dance with the OEM" to put in a new MoBo (sometimes a search will help on the OEM site).

In addition, wouldn't you have to reinstall the exact same OS and SP-level? Have you tested "cloning" one of these HDD's and testing the affixed Key (on the COA) of the PC in question (if OEM and if it's still there)?

(Perhaps I'm misunderstanding. Why wouldn't it boot at all just because of a new MoBo). OHHHH! - the New MoBo is Entirely Different as opposed to the Old; Chipset Problem. Via-to-Intel bites you on that...

Ennyhoo, hope the above helped. Can't/won't point you to the WWW info I referenced - you'll have to find that yourself.

Hint -

HKLM/Software/Microsoft/Windows NT/CurrentVersion->DigitalProductID (value)

Edited March 31, 2009 by submix8c

[MCR7]

Thank you for the help. I am familiar with the method you described as I've been trying it for two days. The location you mentioned in the hint would be great if I was looking for the key on the boot drive, but I'm looking for the key on the non-bootable drive. I've been told the file to use as the hive is C:\Documents and Settings\(User Name)\ntuser.dat but I cannot find where the DigitalProductID is in the newly created hive.

[IcemanND]

http://www.msfn.org/board/index.php?showto...mp;#entry383775

The pro version will let you pull the license numbers from machines and registry files in numerous ways.

[MCR7]

Hey IcemanND, if the drive is external, say E:, what path do i use and what field do I enter it in? Is the registry all one file that i can search? What's it called? Sorry for the novice questions, just new to registry stuff.

[IcemanND]

It won't get it directly from the offline registry, but you can launch regedit, select the HKLM root key, go to file select load hive, select e:\windows\system32\config\software, enter PE for the key name.

then in keydecoder go to the settings menu, select the offline registry key name option, then enter PE and click decode.

[MCR7]

Awesome - Your the man, Iceman, thank you so much for taking the time to explain that as I have been very frustrated trying to figure it out. My lack of registry experience is now cut in half.

Edited March 31, 2009 by MCR7

[Arrow22]

Are we not allowed to show the code sequence for decrypting a key for XP/Vista?

Is this against the rules?

[submix8c]

TY, IcemanND - you explained exactly what I explained, except specifically which Hive and gave a tool on MSFN.

The only tools I was aware of, I wasn't sure were to be mentioned and AFAIK only work on a Running machine (exception - one that you "enter certain positions, yadayada" as above after Loading/Unloading Hive).

For those who are curious, reverse base24 decode bytes 52 to 66 of the DigitalProductID gives yout your cd-key

(a tool exists to do that only)

You have to hook the HDD to another PC as a secondary and Load the Hive containing the Key via a Primary Win2k/xp/2k3 Running System (using Regedt32).

Be sure to Unload the Hive after you got the info. And be sure you got the Correct Key.

Was under the impression that Marc was a technician AND knew about the Hives. My bad... Edited April 1, 2009 by submix8c

[MCR7]

Hey submix8, you were right about one thing, I am a technician. 50%'s not bad. :)

BTW - I like your JusTus pic, reminds me of my old SnarkUS alias

Edited April 2, 2009 by MCR7

[Arrow22]

Here is a Borland C Code Example:

I did not write the algorithm but translated the seq from

The Microsoft Knowledge Base articles for Borland/Codegear

//---------------------------------------------------------------------------

String __fastcall TfrmMain::GetCDKey(void) {
	byte bKeyChars[] = { 'B', 'C', 'D', 'F', 'G', 'H', 'J', 'K', 'M', 'P', 'Q', 'R', 'T', 'V', 'W', 'X', 'Y', '2', '3', '4', '6', '7', '8', '9' };

	String 	sCDKey = "";
	int 	Stat;

	byte   bDigitalProductID[200];
	byte   bProductKey[14];

	TRegistry *Registry = new TRegistry(KEY_READ);
//  int KEY_WOW64_64KEY = l256;

  try  {
	if(!bWin2k) Registry->Access = 0x100 | KEY_READ;

	Registry->RootKey = HKEY_LOCAL_MACHINE;
	String KeyPath = "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion";
	String KeyName = "DigitalProductId";
	int	KeySize = 164;

	if(Registry->OpenKeyReadOnly(KeyPath)) {
	  Stat = Registry->ReadBinaryData(KeyName, bDigitalProductID, KeySize);
	  if(Stat == KeySize) {
		for(int x = 52; x < 67; x++)  bProductKey[x - 52] = bDigitalProductID[x];
		for(int ilByte = 24;  ilByte > -1; ilByte--)  {
		  int nCur = 0;
		  for(int ilKeyByte = 14;  ilKeyByte > -1; ilKeyByte--)  {
			nCur = nCur * 256 ^ bProductKey[ilKeyByte];
			bProductKey[ilKeyByte] = int(nCur / 24);
			nCur = div(nCur, 24).rem;
			}
		  String K =  char(bKeyChars[nCur]);
		  sCDKey = K + sCDKey;
		  if(ilByte != 0) if(div(ilByte, 5).rem == 0)  sCDKey = "-" + sCDKey;
		  }
		}
	  else { sCDKey = "No DigitalProductId: " + String(Stat); }
	  }
	else { sCDKey = "No Registry Access: " + String(Stat); }
	}
  __finally
  {
	delete Registry;
  }

  return(sCDKey);
}

//---------------------------------------------------------------------------

Edited April 3, 2009 by Arrow22