Patch to properly decode the Office 2010 key from the DigitalProductID registry value. The location of the key in the ID has changed.
Someone besides me should test this.
Code:
Index: audit.vbs
===================================================================
--- audit.vbs (revision 1251)
+++ audit.vbs (working copy)
@@ -3296,7 +3296,7 @@
oReg.GetBinaryValue HKEY_LOCAL_MACHINE,path,subKey,key
if IsNull(key) then
else
- strOffXPRUKey=GetKey(key)
+ strOffXPRUKey=GetKey(key,1)
form_input = "ms_keys^^^" & name_2007 & "^^^" _
& strOffXPRUKey & "^^^" _
& release_type & "^^^" _
@@ -3325,7 +3325,7 @@
oReg.GetBinaryValue HKEY_LOCAL_MACHINE,path,subKey,key
if IsNull(key) then
else
- strOffXPRUKey=GetKey(key)
+ strOffXPRUKey=GetKey(key,2)
form_input = "ms_keys^^^" & name_2010 & "^^^" _
& strOffXPRUKey & "^^^" _
& release_type & "^^^" _
@@ -3355,7 +3355,7 @@
oReg.GetBinaryValue HKEY_LOCAL_MACHINE,path,subKey,key
if IsNull(key) then
else
- strOffXPRUKey=GetKey(key)
+ strOffXPRUKey=GetKey(key,1)
form_input = "ms_keys^^^" & name_2003 & "^^^" _
& strOffXPRUKey & "^^^" _
& release_type & "^^^" _
@@ -3384,7 +3384,7 @@
oReg.GetBinaryValue HKEY_LOCAL_MACHINE,path,subKey,key
if IsNull(key) then
else
- strOffXPRUKey=GetKey(key)
+ strOffXPRUKey=GetKey(key,1)
form_input = "ms_keys^^^" & name_xp & "^^^" _
& strOffXPRUKey & "^^^" _
& release_type & "^^^" _
@@ -3413,7 +3413,7 @@
path = "SOFTWARE\Microsoft\Windows NT\CurrentVersion"
subKey = "DigitalProductId"
oReg.GetBinaryValue HKEY_LOCAL_MACHINE,path,subKey,key
- strXPKey=GetKey(key)
+ strXPKey=GetKey(key,1)
if IsNull(strXPKey) then
else
form_input = "ms_keys^^^" & OSName & "^^^" _
@@ -4549,8 +4549,16 @@
-Function GetKey(rpk)
-Const rpkOffset=52:i=28
+Function GetKey(rpk,ver)
+' location of key in DigitalProductID changed in
+' Office 2010.
+' http://code.google.com/p/msoffice-product-key-decoder/
+if ver = "1" then
+ rpkOffset=52
+else
+ rpkOffset=808
+end if
+i=28
szPossibleChars="BCDFGHJKMPQRTVWXY2346789"
Do 'Rep1
dwAccumulator=0 : j=14