Jump to content
SAU Community

Recommended Posts

*************************************************************

*** OEM BIOS Emulation Toolkit For Windows Vista x86 v1.0 ***

*************************************************************

What's the purpose of this release?

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Bypassing the product activation requirement of Microsoft Windows Vista x86.

How does it work?

~~~~~~~~~~~~~~~~~

Microsoft allows large hardware manufacturers (e.g. ASUS, HP, Dell) to ship their products

containing a Windows Vista installation that does NOT require any kind of product activation as

this might be considered an unnecessary inconvenience for the end-user.

Instead these so-called 'Royalty OEMs' are granted the right to embed certain license information

into their hardware products, which can be validated by Windows Vista to make obtaining further

activation information (online or by phone) obsolete.

This mechanism is commonly referred to as 'SLP 2.0' ('system-locked pre-installation 2.0') and

consists of the following three key elements:

1. The OEM's hardware-embedded BIOS ACPI_SLIC information signed by Microsoft.

2. A certificate issued by Microsoft that corresponds to the specific ACPI_SLIC information.

The certificate is an XML file found on the OEM's installation/recovery media,

ususally called something like 'oemname.xrm-ms'.

3. A special type of product key that corresponds to the installed edition of Windows Vista.

This key can usually be obtained from some installation script found on the OEM's

installation/recovery media or directly from a pre-installed OEM system.

If all three elements match Windows Vista's licensing mechansim considers the given

installation a valid system-locked pre-activated copy (that does not require any

additional product activation procedures).

So the basic concept of the tool at hand is to present any given BIOS ACPI_SLIC information to Windows

Vista's licensing mechanism by means of a device driver.

In combination with a matching product key and OEM certificate this allows for rendering any system

practically indistinguishable from a legit pre-activated system shipped by the respective OEM.

How do I use it?

~~~~~~~~~~~~~~~~

Preliminary hint:

Most operations described below require elevated privileges, so disabling UAC (Run->MSCONFIG.EXE->

Tools->Disable UAC) for the time being is recommended, Of course, it can be safely re-enabled after

all steps have been performed. Otherwise OEMTOOL.EXE and some SLMGR.VBS operations must be explicitly

run with adminstrative privileges.

1. Install the Windows Vista x86 edition of your choice without entering any product key during setup.

Basically any Windows Vista x86 installation media will do, regardless if it's MSDN/Retail/OEM/...,

MSDN/Retail are recommended though.

2. Install the emulation driver.

Run OEMTOOL.EXE, select the OEM BIOS information to emulate (ASUS might be a good choice given the

fact that it's the only OEM for which a complete set of product keys is provided :)) and hit the

'<Install Emulation Driver>' button.

Alternatively you can just right-click the ROYAL.INF file and chose 'Install' from the appearing

menu. This only allows for installing the default OEM BIOS information (ASUS) though and is strongly

discouraged unless OEMTOOL.EXE fails for some unknown reason.

When prompted about whether to install an unsigned driver, allow it.

(For some odd reason Microsoft didn't wanna sign this one...:))

3. Reboot your machine.

4. Install the OEM certificate matching your OEM selection during driver installation by running

SLMGR.VBS -ilc <OEMNAME>.XRM-MS

(e.g. "SLMGR.VBS -ilc C:\ASUS.XRM-MS" if you chose to install the default driver and extracted

the certificate file to C:\)

Note that this operation might take quite a while depending on your system, so be patient.

5. Install an OEM product key matching the installed edition of Windows Vista x86 by running

SLMGR.VBS -ipk <OEM_PRODUCT_KEY>

(e.g. "SLMGR.VBS -ipk 6F2D7-2PCG6-YQQTB-FWK9V-932CC" if you're running Windows Vista Ultimate using

the default emulation driver)

Note that this operation might take quite a while depending on your system, so be patient.

See PKEYS.TXT for a list of OEM product keys published by different OEMs.

6. Run 'SLMGR.VBS -dlv' or right-click 'Computer' and chose 'Properties' to verify your licensing status.

Due to the variety of possible combinations of different earlier Vista activation hacks we're not gonna

provide details on 'persuading' existing installations to accept this method.

During our test the general procedure depicted above worked out fine though, i.e. installing the emulation

driver, rebooting the machine and then using the officially documented ways of installing a matching OEM

certificate and product key should do the trick in all but the most messed up cases.

What's that '<Dump OEM BIOS Information>' button in OEMTOOL.EXE for?

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

It dumps the BIOS ACPI_SLIC information of any SLP 2.0-enabled OEM system.

The dump can consecutively be used to emulate ('clone') that information on any other system by specifying

the 'Custom' option.

Using this function on a system booted using the emulation driver will give a dump identical to the currently

emulated OEM BIOS information, so be sure to uninstall the driver and reboot the source machine first if you

intend to dump the actual hardware-embedded OEM BIOS data.

What are all those files for?

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

DIFXAPI.DLL - a runtime dll for Microsoft's DIFx API used by oemtool.exe

OEMTOOL.EXE - an application for installing/uninstalling the emulation driver

and dumping BIOS ACPI_SLIC information from any SLP 2.0-enabled

Windows Vista OEM system

PKEYS.TXT - contains a list of validated OEM product keys

README.TXT - this file

ROYAL.INF - driver .INF file, can be (ab)used to install the emulation driver

in case oemtool.exe fails to perform this task

ROYAL.SYS - the emulation device driver

CERTS\ACER.XRM-MS - the certificate that corresponds to the ACPI_SLIC information

emulated by the driver when 'Acer' has been selected during

driver installation

CERTS\ASUS.XRM-MS - the certificate that corresponds to the ACPI_SLIC information

emulated by the driver when 'ASUS' has been selected during

driver installation

CERTS\HEWLETT-PACKARD.XRM-MS - the certificate that corresponds to the ACPI_SLIC information

emulated by the driver when 'Hewlett-Packard' has been selected

during driver installation

CERTS\LENOVO.XRM-MS - the certificate that corresponds to the ACPI_SLIC information

emulated by the driver when 'Lenovo' has been selected during

driver installation

and yes... it does work...

Smeh, every shop and his dog has OEM copies they can load onto any computer... we keep them here in a drawer... not that it matters... All the computers we order come with Vista on it, and they come with a handy little 2CD package to change it from Vista to Xp too :)

While confusing at first, I have that method down-pat now :D

I can see vista being Win ME all over again

- Big price drops soon after release

- Suppliers giving customers CD to remove Vista and put xp back on

- Lots of shiny crap that people dont need

- Poor performance

- Low amount of hardware supported

hmmmm......

If you have XP and need to reinstall, then you can use the repair feature (all it does is remove the windows directory and installs a new one). This means all your data will be there but your programs may not work. best to backup then start from scratch to be on the safe side.

As for Vista to XP, dunno, haven't tried to do that.

on my work PC i've got Vista business and SP1...dontcha love being a microsoft partner? Apparently its meant to fix alot of speed issues etc. Can't see the difference. Plus installing the service pack took about 30-45 minutes.

At home i got XP as it seems more stable plus you don't have to go searching for vista compatible software.

agreed vista eats dik got a quad core processor and 768 3d card and half ma games shut down after 30 mins playing... pffft vista FTL :D

ROFL.. same shiit happens to me. Got a 2.4 Duo and once the cpu runs 100% for a few seconds, pc shuts down.

Going back xp sp2 very soon.

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now


  • Similar Content

  • Latest Posts

    • OK, so again it has been a bit of a break but it was around researching what had been done since I didn't have access to Neil's records and not everything is obvious without pulling stuff apart. Happily the guy who assembled the engine had kept reasonable records, so we now know the final spec is: Bottom end: Standard block and crank Ross 86.5mm forgies, 9:1 compression Spool forged rods Standard main bolts Oil pump Spool billet gears in standard housing Aeroflow extended and baffled sump Head Freshly rebuilt standard head with new 80lb valve springs Mild porting/port match Head oil feed restrictor VCT disabled Tighe 805C reground cams (255 duration, 8.93 lift)  Adjustable cam gears on inlet/exhaust Standard head bolts, gasket not confirmed but assumed MLS External 555cc Nismo injectors Z32 AFM Bosch 023 Intank fuel pump Garret 2871 (factory housings and manifold) Hypertune FFP plenum with standard throttle   Time to book in a trip to Unigroup
    • I forgot about my shiny new plates!
    • Well, apparently they do fit, however this wont be a problem if not because the car will be stationary while i do the suspension work. I was just going to use the 16's to roll the old girl around if I needed to. I just need to get the E90 back on the road first. Yes! I'm a believer! 🙌 So, I contacted them because the site kinda sucks and I was really confused about what I'd need. They put together a package for me and because I was spraying all the seat surfaces and not doing spot fixes I decided not to send them a headrest to colour match, I just used their colour on file (and it was spot on).  I got some heavy duty cleaner, 1L of colour, a small bottle of dye hardener and a small bottle of the dye top coat. I also got a spray gun as I needed a larger nozzle than the gun I had and it was only $40 extra. From memory the total was ~$450 ish. Its not cheap but the result is awesome. They did add repair bits and pieces to the quote originally and the cost came down significantly when I said I didn't need any repair products. I did it over a weekend. The only issues I had were my own; I forgot to mix the hardener into the dye two coats but I had enough dye for 2 more coats with the hardener. I also just used up all the dye because why not and i rushed the last coat which gave me some runs. Thankfully the runs are under the headrests. The gun pattern wasn't great, very round and would have been better if it was a line. It made it a little tricky to get consistent coverage and I think having done the extra coats probably helped conceal any coverage issues. I contacted them again a few months later so I could get our X5 done (who the f**k thought white leather was a good idea for a family car?!) and they said they had some training to do in Sydney and I could get a reduced rate on the leather fix in the X5 if I let them demo their product on our car. So I agreed. When I took Bec in the E39 to pick it up, I showed them the job I'd done in my car and they were all (students included) really impressed. Note that they said the runs I created could be fixed easily at the time with a brush or an air compressor gun. So, now with the two cars done I can absolutely recommend Colourlock.  I'll take pics of both interiors and create a new thread.
    • Power is fed to the ECU when the ignition switch is switched to IGN, at terminal 58. That same wire also connects to the ECCS relay to provide both the coil power and the contact side. When the ECU sees power at 58 it switches 16 to earth, which pulls the ECCS relay on, which feeds main power into the ECU and also to a bunch of other things. None of this is directly involved in the fuel pump - it just has to happen first. The ECU will pull terminal 18 to earth when it wants the fuel pump to run. This allows the fuel pump relay to pull in, which switches power on into the rest of the fuel pump control equipment. The fuel pump control regulator is controlled from terminal 104 on the ECU and is switched high or low depending on whether the ECU thinks the pump needs to run high or low. (I don't know which way around that is, and it really doesn't matter right now). The fuel pump control reg is really just a resistor that controls how the power through the pump goes to earth. Either straight to earth, or via the resistor. This part doesn't matter much to us today. The power to the fuel pump relay comes from one of the switched wires from the IGN switch and fusebox that is not shown off to the left of this page. That power runs the fuel pump relay coil and a number of other engine peripherals. Those peripherals don't really matter. All that matters is that there should be power available at the relay when the key is in the right position. At least - I think it's switched. If it's not switched, then power will be there all the time. Either way, if you don't have power there when you need it (ie, key on) then it won't work. The input-output switching side of the relay gains its power from a line similar (but not the same as) the one that feeds the ECU. SO I presume that is switched. Again, if there is not power there when you need it, then you have to look upstream. And... the upshot of all that? There is no "ground" at the fuel pump relay. Where you say: and say that pin 1 Black/Pink is ground, that is not true. The ECU trigger is AF73, is black/pink, and is the "ground". When the ECU says it is. The Blue/White wire is the "constant" 12V to power the relay's coil. And when I say "constant", I mean it may well only be on when the key is on. As I said above. So, when the ECU says not to be running the pump (which is any time after about 3s of switching on, with no crank signal or engine speed yet), then you should see 12V at both 1 and 2. Because the 12V will be all the way up to the ECU terminal 18, waiting to be switched to ground. When the ECU switches the fuel pump on, then AF73 should go to ~0V, having been switched to ground and the voltage drop now occurring over the relay coil. 3 & 5 are easy. 5 is the other "constant" 12V, that may or may not be constant but will very much want to be there when the key is on. Same as above. 3 goes to the pump. There should never be 12V visible at 3 unless the relay is pulled in. As to where the immobiliser might have been spliced into all this.... It will either have to be on wire AF70 or AF71, whichever is most accessible near the alarm. Given that all those wires run from the engine bay fusebox or the ECU, via the driver's area to the rear of the car, it could really be either. AF70 will be the same colour from the appropriate fuse all the way to the pump. If it has been cut and is dangling, you should be able to see that  in that area somewhere. Same with AF71.   You really should be able to force the pump to run. Just jump 12V onto AF72 and it should go. That will prove that the pump itself is willing to go along with you when you sort out the upstream. You really should be able to force the fuel pump relay on. Just short AF73 to earth when the key is on. If the pump runs, then the relay is fine, and all the power up to both inputs on the relay is fine. If it doesn't run (and given that you checked the relay itself actually works) then one or both of AF70 and AF71 are not bringing power to the game.
    • @PranK can you elaborate further on the Colorlock Dye? The website has a lot of options. I'm sure you've done all the research. I have old genuine leather seats that I have bought various refurbing creams and such, but never a dye. Any info on how long it lasts? Does it wash out? Is it a hassle? What product do I actually need? Am I just buying this kit and following the steps the page advises or something else? https://www.colourlockaustralia.com.au/colourlock-leather-repair-kit-dye.html
×
×
  • Create New...