Inside Windows Product Activation

Hardware modifications

When looking at the effects of hardware modifications on an already activated installation of Windows XP, the file wpa.dbl in the system32-directory plays a central role. It is a simple RC4-encrypted database that stores, among other things like expiration information and the Confirmation ID of an activated installation,

  • a) the bit-field values representing the current hardware configuration

  • b) the bit-field values representing the hardware configuration at the time of product activation.

While a) is automatically updated each time the hardware configuration is modified in order to reflect the changes, b) remains fixed. Hence, b) can be thought of as a snapshot of the hardware configuration at the time of product activation.

This snapshot does not exist in the database before product activation and if we compare the size of 'wpa.dbl' before and after activation, we will notice an increased file size. This is because the snapshot is added to the database.

When judging whether re-activation is necessary, the bit-field values of a) are compared to the bit-field values of b), i.e. the current hardware configuration is compared to the hardware configuration at the time of activation.

Non-dockable computer

Typically all bit-fields with the exception of the unused field and the 'dockable' field are compared. If more than three of these ten bit-fields have changed in a) since product activation, re-activation is required.

This means, for example, that in our above real-world example, we could replace the harddrive and the CD-ROM drive and substantially upgrade our RAM without having to re-activate our Windows XP installation.

However, if we completely re-installed Windows XP, the information in b) would be lost and we would have to re-activate our installation, even if we had not changed our hardware.

Dockable computer

If bit 31 of H2 indicates that our computer supports a docking station, however, only seven of the ten bit-fields mentioned above are compared. The bit-fields corresponding to the SCSI host adapter, the IDE controller, and the graphics board are omitted. But again, of these remaining seven bit-fields, only up to three may change without requiring re-activation.