The product key of Windows 95 was implemented with an ultra-simple algorithm that can break through '111-1111111' and '000-0000000'

When installing 'Windows 95' that appeared in 1995, you are asked to enter the product key, but the product key is authenticated even with a simple number sequence such as '111-1111111' or '000-0000000'. Security researcher

stacksmashing explains why even such a simple product key can be authenticated.

Why 111-1111111 is a valid Windows 95 key-YouTube

This is the Windows 95 product key entry screen. If you enter an invalid product key, you will not be able to continue the installation, but even a simple product key of '111-1111111' will be recognized as a 'correct product key' and you can continue the installation.

You can also continue the installation by changing the first three digits to '000-1111111', '001-1111111', '567-1111111', etc.

However, it does not mean that 'anything is OK with the first three digits'. Enter '333-1111111' as a trial.

Then the installation could not continue. In addition, if you enter 'three consecutive numbers other than 0, 1, or 2' such as '444-1111111' and '555-1111111' as the first three digits, you will not be able to continue the installation.

Next, change the last 7 digits to numbers other than 'continuous 1'. First, enter '000-0000001'.

However, '000-0000001' was not recognized as the correct product key and the installation could not proceed.

By increasing the last digit by 1, '000-0000007' was recognized as the correct product key.

As a result of increasing the number of the last digit in order, it turned out that the following product key was recognized as the correct product key.

The feature of these product keys is that 'the sum of all the digits becomes a' number divisible by 7 ', such as 0 or 7'.

Similarly, '111-1111111' at the beginning will be '7' if you add up all the digits.

From the above verification results, it is considered that the last 7 digits of the product key are judged to be pass or fail based on whether or not the sum of all digits is divisible by 7.

Next, let's check the mechanism of the pass/fail judgment part of the product key with the reverse engineering tool '

Ghidra '.

As a result of reverse engineering, the first three digits are '333', '444', '555', '666', '777', '888', and '999' are blacklisted, and any other three digit number is OK turned out. In addition, it turned out that the characters connecting the first three digits and the last seven digits were not checked.

In addition, it was also found that the code included 'pass if the sum of all digits is divisible by 7'.

In summary, the conditions for the product key of Windows 95 are as follows.

・If the first 3 digits are other than ``333'', ``444'', ``555'', ``666'', ``777'', ``888'', ``999''
・The 4th digit can be any number or letter
・The last 7 digits are OK if the sum of each digit is divisible by 7

If the conditions are met, you can continue the installation even with a product key such as 'YOLO0000000'.

The above conditions are for the retail version of Windows 95. For OEM versions of Windows 95, the following conditions apply:

・The beginning is 1 to 366
・One of '95', '96', '97', '98', '99', '00', '01', and '02' following the beginning
・Enter 'OEM' after the hyphen
・A 7-digit number following a hyphen whose total is divisible by 7. However, the first digit is limited to '0'
・Anything is OK as long as the last 5 digits are numbers

in Software,   Video, Posted by log1o_hf