Ethical hacking tutorials

HARDWARE MODIFICATIONS

When looking at the effects of hardware modifications on an already
activated installation of Windows XP, the file 'wpa.dbl' in the
'system32' directory plays a central role. It is a simple
RC4-encrypted database that stores, among other things like expiration
information and the Confirmation ID of an activated installation,

a) the bit-field values representing the current hardware
configuration,

and

the bit-field values representing the hardware configuration
at the time of product activation.

While a) is automatically updated each time the hardware configuration
is modified in order to reflect the changes, remains fixed. Hence,
can be thought of as a snapshot of the hardware configuration at
the time of product activation.

This snapshot does not exist in the database before product activation
and if we compare the size of 'wpa.dbl' before and after activation,
we will notice an increased file size. This is because the snapshot is
added to the database.

When judging whether re-activation is necessary, the bit-field values
of a) are compared to the bit-field values of , i.e. the current
hardware configuration is compared to the hardware configuration at
the time of activation.

>>> Non-dockable computer

Typically all bit-fields with the exception of the unused field and
the 'dockable' field are compared. If more than three of these ten
bit-fields have changed in a) since product activation, re-activation
is required.

This means, for example, that in our above real-world example, we
could replace the harddrive and the CD-ROM drive and substantially
upgrade our RAM without having to re-activate our Windows XP
installation.

However, if we completely re-installed Windows XP, the information in
would be lost and we would have to re-activate our installation,
even if we had not changed our hardware.

>>> Dockable computer

If bit 31 of H2 indicates that our computer supports a docking
station, however, only seven of the ten bit-fields mentioned above are
compared. The bit-fields corresponding to the SCSI host adapter, the
IDE controller, and the graphics board are omitted. But again, of
these remaining seven bit-fields, only up to three may change without
requiring re-activation.