Patch to properly decode the Office 2010 key from the DigitalProductID registry value. The location of the key in the ID has changed.
Someone besides me should test this.
[code]Index: audit.vbs =================================================================== --- audit.vbs (revision 1251) +++ audit.vbs (working copy) @@ -3296,7 +3296,7 @@ oReg.GetBinaryValue HKEY_LOCAL_MACHINE,path,subKey,key if IsNull(key) then else - strOffXPRUKey=GetKey(key) + strOffXPRUKey=GetKey(key,1) form_input = "ms_keys^^^" & name_2007 & "^^^" _ & strOffXPRUKey & "^^^" _ & release_type & "^^^" _ @@ -3325,7 +3325,7 @@ oReg.GetBinaryValue HKEY_LOCAL_MACHINE,path,subKey,key if IsNull(key) then else - strOffXPRUKey=GetKey(key) + strOffXPRUKey=GetKey(key,2) form_input = "ms_keys^^^" & name_2010 & "^^^" _ & strOffXPRUKey & "^^^" _ & release_type & "^^^" _ @@ -3355,7 +3355,7 @@ oReg.GetBinaryValue HKEY_LOCAL_MACHINE,path,subKey,key if IsNull(key) then else - strOffXPRUKey=GetKey(key) + strOffXPRUKey=GetKey(key,1) form_input = "ms_keys^^^" & name_2003 & "^^^" _ & strOffXPRUKey & "^^^" _ & release_type & "^^^" _ @@ -3384,7 +3384,7 @@ oReg.GetBinaryValue HKEY_LOCAL_MACHINE,path,subKey,key if IsNull(key) then else - strOffXPRUKey=GetKey(key) + strOffXPRUKey=GetKey(key,1) form_input = "ms_keys^^^" & name_xp & "^^^" _ & strOffXPRUKey & "^^^" _ & release_type & "^^^" _ @@ -3413,7 +3413,7 @@ path = "SOFTWARE\Microsoft\Windows NT\CurrentVersion" subKey = "DigitalProductId" oReg.GetBinaryValue HKEY_LOCAL_MACHINE,path,subKey,key - strXPKey=GetKey(key) + strXPKey=GetKey(key,1) if IsNull(strXPKey) then else form_input = "ms_keys^^^" & OSName & "^^^" _ @@ -4549,8 +4549,16 @@ -Function GetKey(rpk) -Const rpkOffset=52:i=28 +Function GetKey(rpk,ver) +' location of key in DigitalProductID changed in +' Office 2010. +' http://code.google.com/p/msoffice-product-key-decoder/ +if ver = "1" then + rpkOffset=52 +else + rpkOffset=808 +end if +i=28 szPossibleChars="BCDFGHJKMPQRTVWXY2346789" Do 'Rep1 dwAccumulator=0 : j=14 [/code]
|