The Windows XP activation algorithm has been cracked
theregister.com
theregister.com
https://news.ycombinator.com/item?id=35993044
(238 points/7 days ago/151 comments)
Chart for reference
My word was Dubya popular in 2001
You can use rainbow tables to crack passwords for XP which was super quick though!
I wonder if that’s still possible.
https://learn.microsoft.com/en-us/microsoft-desktop-optimiza...
This only works for local accounts, though similarly trivial techniques apply to Active Directory accounts if you have "live CD" access to a domain controller.
Just to be clear, in neither case is this a security vulnerability; under the "live CD" assumption — specifically, that you're able to make even a single arbitrary registry edit — there are far simpler ways to completely bypass Windows security that require neither tools nor understanding of the (AFAIK undocumented) HKEY_LOCAL_MACHINE\SAM registry hive.
For example, make the registry edit given by the
reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\
Image File Execution Options\sethc.exe"
/v Debugger /d C:\Windows\System32\cmd.exe /f
Then, at any login, lock, or "Ctrl+Alt+Delete" screen, pressing the Shift key five times pops up a shell running as NT AUTHORITY\SYSTEM[1].
This has immediate effect — you don't even need to reboot or log out.
[1] https://learn.microsoft.com/en-us/windows/win32/services/loc...
Sure it had issues but at least it wasn't an actively hostile bloated piece of adware it is now.
My favorite in terms of looks and behavior is Windows 2000, and it's still in the top 5 when I think of desktop UIs that don't try to grab the user's attention. It was also much lighter on resources than XP, and didn't have poorly-animated dogs hiding behind the menus.
But oh man, let me tell you, the first time I experienced one of the newer versions restart its graphics driver without losing state was magical. I can't remember how many hours I lost to blue screens with a stack trace deep inside some ATI/nVidia dll, and to this day I can get a kernel panic in Linux if I tickle the GPU the right way, but modern Windows has proper GPU driver isolation and they did it without wrecking performance.
I wish it were somehow possible to run the pre-XP interface on the modern OS.
Ah yes, the grand stability of plugging in the wrong USB accessory into the wrong USB port and the computer crashing. Great times :)
Personally the only thing I can think of is the slightly better calculator.
Windows 2000 was the best version I ever used, though I admit I'd switched to Linux pretty soon after it was released.
So it kind of flip flops. Microsoft makes a bunch of changes that everyone hates. Then they roll back a lot of them in the next OS.
That being said, 11 is shaping up to be a debacle. But don't worry, 12 will drop all the things you hate about 11 but keep things they really wanted to include.
That doesn't really describe Vista to 7. Windows 7 was largely Vista Service Pack 3, with some interface tweaks to give it is own visual marketing identity.
The Kernel Version Numbers are a better hint at what is going on than the marketing releases, or the service packs. Windows 2000 was NT5, XP was NT 5.1 (which was mostly a dos compatibility layer on top of 2000, so it could run consumer games and such.) Vista was NT6, 7 was NT6.1, 8 was NT6.2 8.1 was NT6.3.
Like the reason we don't have a "Windows 9", because programs check for that to see if they're running on Windows 95 or 98 because it uses the 9x kernel.
Vista to 7 was significant. An operating system is more than just the kernel.
What you described was a combination of marketing and a change in behavior. They skipped 7 because it would be confusing for 10 to be NT 7. They skipped 8 for the same reason, and 9 for the reason you described.
Nothing about those choices changes that from 2000 to 8.1 there were only one major kernel build number changes, and it was from XP to Vista. Although unpopular, Vista was the biggest leap between any two versions, and part of its lack of popularity was that it was a breaking change that broke most drivers. It also didn't help that they were certifying underpowered machines as compatible.
The conversation I started was about the frequency of major build number increments, not what number they chose to signify a change.
> We have added native support for additional archive formats, including tar, 7-zip, rar, gz and many others using the libarchive open-source project. You now can get improved performance of archive functionality during compression on Windows.
It doesn't mention unarchiving/decompressing, maybe I'm being nitpicky, but at a glance, it seems to only be about compression? That'd be horrible though, but more horrible changes that that have gone through lately so I guess you never know...
My worry is that this will just make drive-by malware easier.
(At least quickly thinking about it; I could easily have overlooked some complexity, but barring an unpatched libarchive exploit, I don't think this markedly increases attack surface...and at that point, you could probably make similar arguments about adding any new file format?)
Why is that?
Now the floodgates of the masses have opened to computing, and look at us
Only XP Home required this.
XP Pro did not need online activation.
That's likely why some people are saying they never had to do it.
This morning it confidently told me that BFD packets from a cisco IOS device would be tagged EF. I asked if it were sure it wasn't CS6, then it apologised and said it was CS6. Then I asked if it was sure it wasn't AF31 and it agreed it was AF31.
And back in the days, as a teenager, I typed "format c:" every week-end ;)
Maybe it's the later builds that need activation ?
Activation became a hard requirement further down the line, I think the process got more strict during one of the service pack upgrades.
It's possible your installs were all automatically activated over the internet. I think the hardware ID and the serial number were some kind of combined identifier and if your computer(s) were part of "the good list", your fingerprint may have been whitelisted so that automatic online activation never caused a problem.
From what I remember this was pushed around the time of SP2, but if you had a launch-day install disk and reformatted your disk that often then you probably never got as far as receiving that update.
Volume License and some OEM didn't need activation, but any "retail" versions - Home/Pro in a box for instance - did require activation.
Retail versions of Windows XP required Activation by internet or phone.
Volume Licensing customers could bypass Activation with a Volume Licensing key - like the infamous key mentioned by others here that began "FCKGW-". This was a valid key prior to Service Pack 1 (SP1). SP1 blocked it and several other "widely known" keys.
Windows Vista and later made Activation mandatory for Volume Licences to stop this sort of key abuse.
Someone has mentioned Windows Updates imposing the Activation requirement - they are probably thinking of Windows Genuine Advantage (WGA) - https://en.wikipedia.org/wiki/Windows_Genuine_Advantage.
WGA was a separate technology to Activation. It added further checks to detect various types of pirated copies.
One thing that's often overlooked about Activation is that it was only intended to deal with "casual piracy" - where people buy or obtain a genuine copy of Windows, but then try and use it on more PCs than the licence permits.
Making keygen is the ultimate cracker's job, bruteforcing one key is significantly easier task.