Skip to main content

Scan Keys

Overview​

  • How to use it? Instructions can be found here.
  • The Scan Keys option recovers product keys from various sources on the system, including files, the Windows registry, Digital Product ID blobs, the SPP/OSPP trusted store, and the BIOS/UEFI (MSDM).
  • Each scan method targets a different source and can be used independently.

Scan Keys in Files​

Scans a single file or an entire folder for 5x5 product keys. It reads each file's raw bytes, then extracts all unique keys matching the 5x5 format via regex. Files larger than 100 MB are skipped.

  • Supports scanning a single file or an entire folder.
  • Supports a Recurse option to include subdirectories when scanning a folder.
  • Supports a Filter option to limit scanning to specific file types (e.g. *.txt, *.ini). The default filter is *.ini,*.txt,*.xml,*.exe,*.dll.
  • Supports a Logs option to save found keys.

Windows files with keys​

Windows ISO file​

# Keys found in Windows 7 ISO, Windows 10 16299 and later ESDs, and UUP-created ISOs.
# Some other RTM/Beta ISOs also contain it, like WE8S 8.0.
\sources\product.ini

# File appeared in Windows 10 1507 and was removed in Windows 11 24H2.
\sources\gatherosstate.exe

# Keys found in Windows 10 and later versions
\sources\setupcore.dll
\sources\winsetup.dll

Windows installation​

# Contains 1 key, found in Windows 8.1 and some early versions of Windows 10
C:\Windows\System32\reseteng.dll

# Contains 1 key, found in Windows Vista, 7, 8, 8.1 and some early versions of Windows 10
C:\Windows\System32\secinit.exe

# Keys found in early versions of Windows 10
# The following files contain identical keys.
C:\Windows\System32\EditionUpgradeHelper.dll
C:\Windows\System32\EditionUpgradeManagerObj.dll
C:\Windows\System32\sppwinob.dll

# Keys found in newer versions of Windows 10 and later
# winsetup.dll usually contains almost all the keys found in other files.
C:\Windows\System32\ClipUp.exe
C:\Windows\System32\clipwinrt.dll
C:\Windows\System32\Dism\TransmogProvider.dll
C:\Windows\System32\LicensingWinRT.dll
C:\Windows\System32\oobe\winsetup.dll
C:\Windows\System32\pkeyhelper.dll

Microsoft Office files with keys​

Keys (other than the default KMS installation key) started appearing from Office 2013.

# Office 2013 MSI
C:\Program Files\Common Files\microsoft shared\OFFICE15\MSO.DLL

# Office 2016 MSI
C:\Program Files\Common Files\microsoft shared\OFFICE16\Mso30win32client.dll

# Office 2013 C2R
# integratedoffice.exe appeared in the latest version.
C:\Program Files\Microsoft Office 15\ClientX64\integratedoffice.exe
C:\Program Files\Microsoft Office 15\root\flattener\Flattener.exe
C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE15\MSO.DLL

# Office 2016 and later C2R (latest)
# Mso98win32client.dll contains a different set of keys.
C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe
C:\Program Files\Microsoft Office\root\Office16\capture.exe
C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe
C:\Program Files\Microsoft Office\root\Office16\WritingAssistant\WritingAssistant.exe
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ActionsServer\ActionsServer.exe
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\Mso20win32client.dll
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\Mso98win32client.dll

Scan DPID in Files​

Scans files for Digital Product ID (DPID) binary blobs. DPIDs can appear as raw binary data or as hex-encoded text (e.g. in .reg files). The script detects and parses DPID structures in version 2, 3, and 4 format, and decodes them to show the embedded product key, Product ID, and integrity check results.

  • Supports scanning a single file or an entire folder.
  • Supports a Recurse option to include subdirectories when scanning a folder.
  • Supports .reg and .bin files. For example, you can export HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion to a .reg file to view all DPID fields. Raw DPID2, DPID3, and DPID4 binary files generated by PKeyMaster's Logs option can also be scanned in the same way.
  • Supports a Logs option to save decoded DPID output.

Example​

Folder  : C:\Users\Home\Desktop\PKeyMaster-Logs\KeyChecker\2026-06-19_12-42-35_649
Recurse : Yes
Filter  : *.reg, *.bin
Scanning, please wait...

[C:\Users\Home\Desktop\PKeyMaster-Logs\KeyChecker\2026-06-19_12-42-35_649\NJCF7-PW8QT-3324D-688JX-2YV66\DPID2.bin]
        [-] : BlobSize                 : 50
        [-] : MajorVersion             : 2
     [0-49] : ProductId                : 00389-20000-00001-AA998

--------------------------------------------------------------------------------

[C:\Users\Home\Desktop\PKeyMaster-Logs\KeyChecker\2026-06-19_12-42-35_649\NJCF7-PW8QT-3324D-688JX-2YV66\DPID3.bin]
        [-] : BlobSize                 : 164
        [-] : ProductKey               : NJCF7-PW8QT-3324D-688JX-2YV66
        [-] : CRC32Check               : Pass
      [0-3] : UISize                   : 164
      [4-5] : MajorVersion             : 3
      [6-7] : MinorVersion             : 0
     [8-31] : ProductId                : 00389-20000-00001-AA998
    [32-35] : KeyIndex                 : 3892
    [36-51] : EditionId                : [RS3]X21-41295
    [52-67] : CDKeyBytes               : 52, 15, 16, 0, 0, 0, 108, 234, 194, 41, 56, 126, 146, 16, 8, 0
    [68-71] : CloneStatus              : 0
    [72-75] : Time                     : 1781872955
    [76-79] : Random                   : 1738104998
    [80-83] : Lt                       : 0
    [84-87] : LicenseData0             : 0
    [88-91] : LicenseData1             : 0
    [92-99] : OemId                    : 
  [100-103] : BundleId                 : 0
  [104-111] : HardwareIdStatic         : 
  [112-115] : HardwareIdTypeStatic     : 0
  [116-119] : BiosChecksumStatic       : 0
  [120-123] : VolumeSerialStatic       : 0
  [124-127] : TotalRamStatic           : 0
  [128-131] : VideoBiosChecksumStatic  : 0
  [132-139] : HardwareIdDynamic        : 
  [140-143] : HardwareIdTypeDynamic    : 0
  [144-147] : BiosChecksumDynamic      : 0
  [148-151] : VolumeSerialDynamic      : 0
  [152-155] : TotalRamDynamic          : 0
  [156-159] : VideoBiosChecksumDynamic : 0
  [160-163] : CRC32                    : 2919805276

--------------------------------------------------------------------------------

[C:\Users\Home\Desktop\PKeyMaster-Logs\KeyChecker\2026-06-19_12-42-35_649\NJCF7-PW8QT-3324D-688JX-2YV66\DPID4.bin]
        [-] : BlobSize                 : 1272
        [-] : ProductKey               : NJCF7-PW8QT-3324D-688JX-2YV66
        [-] : Hash256Check             : Pass
        [-] : CDKey256HashCheck        : Pass
      [0-3] : UISize                   : 1272
      [4-5] : MajorVersion             : 4
      [6-7] : MinorVersion             : 0
    [8-135] : AdvancedPid              : 00000-03892-000-000001-00-1033-26200.0000-1702026
  [136-263] : ActivationId             : df96023b-dcd9-4be2-afa0-c6c871159ebe
  [264-279] : OemId                    : 
  [280-799] : EditionType              : ServerRdsh
  [800-800] : IsUpgrade                : 0
  [801-807] : ReservedBytes            : 0, 0, 0, 0, 0, 0, 0
  [808-823] : CDKeyBytes               : 52, 15, 16, 0, 0, 0, 108, 234, 194, 41, 56, 126, 146, 16, 8, 0
  [824-855] : CDKey256Hash             : 174, 128, 107, 88, 158, 34, 238, 240, 251, 172, 34, 15, 220, 235, 77, 111, 90, 80, 223, 137, 22, 78, 180, 160, 31, 174, 236, 107, 151, 214, 37, 192
  [856-887] : Hash256                  : 23, 40, 84, 194, 87, 42, 114, 247, 183, 154, 92, 185, 106, 38, 99, 4, 16, 235, 1, 78, 145, 245, 127, 214, 123, 195, 123, 128, 115, 203, 190, 15
 [888-1015] : EditionId                : [RS3]X21-41295
[1016-1143] : KeyType                  : Retail
[1144-1271] : EULA                     : Retail

--------------------------------------------------------------------------------

Files scanned      : 3
Files with DPIDs   : 3
Total DPIDs        : 3
Time               : 0.174 s

Get Keys From Registry​

Scans the Windows registry for Digital Product ID (DPID) binary values, and decodes them to recover embedded product keys. There are three separate options depending on what you want to scan:

  • Get Windows Keys From Registry: scans HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion, HKLM\SOFTWARE\Microsoft\Internet Explorer\Registration, their WOW6432Node equivalents, and HKLM\SYSTEM\WPA on Windows XP/2003.
  • Get Office Keys From Registry: scans HKLM\SOFTWARE\Microsoft\Office and WOW6432Node equivalents (MSI-based Office installations only).
  • Get Other Product Keys From Registry: scans all remaining HKLM paths, excluding the Windows and Office paths above for products such as SQL Server.

Example​

Scanning registry for Windows product keys...

Registry Path     : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion
Value             : DigitalProductId
BlobSize          : 164
UISize            : 164
DPID Version      : 3
Product Key       : VK7JG-NPHTM-C97JM-9MPGT-3V66T
Product ID        : 00330-80000-00000-AA487
Part number       : [TH]X19-98841
License Type      : 0
Group ID          : 3308
Install Time      : 2026-06-19 01:36:34
CRC32 Check       : Pass

--------------------------------------------------------

Registry Path     : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion
Value             : DigitalProductId4
BlobSize          : 1272
UISize            : 1272
DPID Version      : 4
Product Key       : VK7JG-NPHTM-C97JM-9MPGT-3V66T
Extended PID      : 03612-03308-000-000000-00-1033-26200.0000-1692026
Activation ID     : 4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c
Edition           : Professional
Part number       : [TH]X19-98841
Key Type          : Retail
EULA              : Retail
Upgrade Key       : No
CDKeySHA256 Check : Pass
SHA256 Check      : Pass
info
  • If the product key is cleared using the slmgr /cpky command, or if a MAK (Multiple Activation Key) is installed, the CDKeyBytes array in the registry is zeroed out. This results in the placeholder key: BBBBB-BBBBB-BBBBB-BBBBB-BBBBB.
  • Because slmgr /cpky zeroes out the CDKeyBytes array, Windows updates the CRC32 (in version 3) and Hash256 (in version 4) to reflect the zeroes, but does not update the inner CDKey256Hash. As a result, the CDKey256Hash integrity check will fail on systems where the key was manually cleared.
  • Note: When a MAK key is installed for an MSI-based Office version, Office does not update the DPID in the registry at all, and will continue showing the previously installed key's details.
  • The Get Keys From Registry option skips unused fields and does not display the entire DigitalProductId.
  • To view all fields, export the registry path to a .reg file and use the Scan DPID in Files option.

Get Installed Windows/Office Keys​

Decrypts the Windows SPP and OSPP trusted store and scans it for installed product keys. Found keys are matched against the local WMI class to display the product name, description, key type, and Installation ID.

Keys no longer associated with an installed product are shown separately as Previously Installed Keys.

  • Supports Windows (Vista and later) and Office (2010 and later).
  • If the store file is locked by the Software licensing service, the script stops the service to read it. Administrator rights are required in this case.

Example​

________________________________________

Checking keys in SPP trusted store...
________________________________________

Product Name      : Office 16, Office16MondoR_OEM_Perp edition
Description       : Office 16, RETAIL channel
Key Type          : OEM:NONSLP
Installation ID   : 690018648344652347022687592328952864125851048207685809704482246
Installed Key     : KJ3DB-VNXVJ-GJG94-9RYX6-Y98Y6

Product Name      : Windows(R), Professional edition
Description       : Windows(R) Operating System, OEM_DM channel
Key Type          : OEM:DM
Installation ID   : 690018648344652347022687592328952864125851048207685809704482246
Installed Key     : B7RFY-7NXPK-Q4342-2B37J-BWRTH

Previously Installed Keys:
HFTND-W9MK4-8B7MJ-B6C4G-XQBR2
B2HTN-JPH8C-J6Y6W-8YW3B-G3BRT
VK7JG-NPHTM-C97JM-9MPGT-3V66T
________________________________________

Checking keys in OSPP trusted store...
________________________________________

Product Name      : Office 14, OfficeProPlus-KMS_Client edition
Description       : Office 14, VOLUME_KMSCLIENT channel
Installation ID   : 005811612886986190878094440950763771119326145482653636
Installed Key     : VYBBJ-TRJPB-QFQRF-QFT4D-H3GVB
tip

This option can also recover installed MAK keys and keys that have been cleared from the registry using the slmgr /cpky command.

Get MSDM (BIOS/UEFI) Key​

Retrieves the OEM product key embedded in BIOS/UEFI via the OA3 (OEM Activation 3) mechanism. Queries the SoftwareLicensingService WMI class for all OA3x properties, including the original product key stored by the manufacturer.

Get-CimInstance SoftwareLicensingService | Select OA3*
  • Requires Windows 8.1 or later.

Feedback / Troubleshooting​