Skip to content

Commit

Permalink
Merge branch 'master' of https://github.com/UMSKT/umskt.github.io
Browse files Browse the repository at this point in the history
  • Loading branch information
techguy16 committed Sep 26, 2023
2 parents ec410d2 + b0503b9 commit cc44b47
Show file tree
Hide file tree
Showing 2 changed files with 4 additions and 26 deletions.
2 changes: 1 addition & 1 deletion README.md
Original file line number Diff line number Diff line change
Expand Up @@ -11,9 +11,9 @@ Visit [https://umskt.github.io](https://umskt.github.io) to see it in action.
* Downloads for UMSKT and xpmgr
* List of BINK IDs, Ports and Development Libraries
* How to get in touch
* Documents archive/library

### Coming soon

* Command line options help
* Documents archive/library
* Frequently Asked Questions
28 changes: 3 additions & 25 deletions doc/keygeneration/bink.md
Original file line number Diff line number Diff line change
Expand Up @@ -21,32 +21,10 @@

By Endermanch and WitherOrNot

## *The Problem*
**In general, the only thing that separates us from generating valid Windows XP keys for EVERY EDITION and EVERY BUILD is the lack of respective private keys generated from their public counterparts inside `pidgen.dll`**. There's no code for the elliptic curve discrete logarithm function widely available online, there's only vague information on how to do it.

As time went on, the problem has been _partially_ solved.

The BINK resource was not encoded in any way and the data was just sequentially written to the resource. **sk00ter** also fully explained the BINK format on the MDL forums.
Utilizing prior community knowledge on the subject, I wrote a BINK Reader in Python 3. The file is public in this repository, [click here](https://github.com/Endermanch/XPKeygen/blob/main/BINKReader.py) to view the source code.

The discrete logarithm solution is the most unexplored area of research as of **May 28th, 2023**. However, my friend **nephacks** did find that elusive tool to solve that difficult problem in the darkest corners of the internet.
It's called ECDLP (Elliptic Curve Discrete Logarithm Problem) Solver by Mr. HAANDI. Since it was extremely frustrating to find online, I did reupload it on my website. You can download the tool [here](https://dl.malwarewatch.org/software/advanced/ecc-research-tools/).

The ReadMe file that comes with the version **0.2a** of the solver is good enough by itself, so anyone with a brain will be able to set that tool up. However, it's not open-source, so integrating it into my keygen is proven impossible.

In the ideal scenario, the keygen would ask you for a BINK-resource extracted from `pidgen.dll`, which it would then unpack into the following segments:
* Public key (`pubX`; `pubY`)
* Generator (`genX`; `genY`)
* Base point (`a`; `b`)
* Point count `p`

Knowing these segments, the keygen would bruteforce the geneator order `genOrder` using Schoof's algorithm followed by the private key `privateKey`, leveraging the calculated `genOrder` to use the most optimal Pollard's Rho algorithm. There's no doubt we can crack any private key in a matter of 20 minutes using modern computational power, provided we have the working algorithm.
## Product ID

# Principle of operation
We need to use a random Raw Product Key as a base to generate a Product ID in a form of `AAAAA-BBB-CCCCCCS-DDEEE`.

## Product ID

| Digits | Meaning |
|-------:|:----------------------|
| AAAAA | OS Family constant |
Expand Down Expand Up @@ -133,7 +111,7 @@ In real world situations developers typically use curves of 256-bits or more.

An important concept is that addition can be defined between two points on an elliptic curve. This also allows a definition of integer multiplication ($nP$ is $P$ added to itself $n$ times).

The core of elliptic curve cryptography uses this multiplication definition, as solving the equation $Q=nP$ for known points $P$ and $Q$ is difficult with known algorithms, providing cryptographic security.
The core of elliptic curve cryptography uses this multiplication definition, as solving the equation $Q=nP$ for known points $P$ and $Q$ is difficult with known algorithms, but it is easy to compute knowing $n$ and $Q$. This allows elliptic curve multiplication to act as a trapdoor function.

## BINK resource

Expand Down Expand Up @@ -254,7 +232,7 @@ The constant $n$, not included in the BINK, is the order of the point $G$.
3. Compute the elliptic curve point $R = hK + sG$
4. Compute `digest = SHA1(m || R.x || R.y)`, where `||` represents byte concatenation
5. Convert `digest` to an integer
6. Let $h_t$ be the upper 28 bits of `digest`
6. Let $h_t$ be the lower 28 bits of `digest`
7. Compare $h$ and $h_t$, if they are equal, the product key is valid

#### Generation
Expand Down

0 comments on commit cc44b47

Please sign in to comment.