To see what's inside these HKCR\Licenses use
API Monitor v2
API-Filter find
RegQueryValueExW
^-Enable all from Advapi32.dll
CryptUnprotectData
^- Enable all from Crypt32.dll
+ Breakpoint / after Call
sample data that'll come out from CryptUnprotectData:
HKEY_CLASSES_ROOT\Licenses\4D8CFBCB-2F6A-4AD2-BABF-10E28F6F2C8F\07078 [length 0x1C6 (0454.) ]
00322-20000-00000-AA450 <- PID2
7d3cbcbb-90b1-411f-9981-6e28039a9b82 <- Ver
7C3WXN74-VRMXH-J8X3H-M8F7W-CPQB8 <- PID3
HKEY_CLASSES_ROOT\Licenses\4D8CFBCB-2F6A-4AD2-BABF-10E28F6F2C8F\0bcad [length 0xbcad (0534.) ]
0000 00000025 ffffffff 7fffffff 07064. 00000007 07078. 00000007 ffffffff
0020 7fffffff ffffffff 7fffffff ffffffff 7fffffff ffffffff 7fffffff ffffffff
0040 7fffffff ffffffff 7fffffff ffffffff 7fffffff ffffffff 7fffffff ffffffff
0060 7fffffff ffffffff 7fffffff ffffffff 7fffffff ffffffff 7fffffff ffffffff
0080 7fffffff ffffffff 7fffffff ffffffff 7fffffff ffffffff 7fffffff ffffffff
00a0 7fffffff ffffffff 7fffffff ffffffff 7fffffff ffffffff 7fffffff ffffffff
00c0 7fffffff ffffffff 7fffffff ffffffff 7fffffff ffffffff 7fffffff ffffffff
00e0 7fffffff ffffffff 7fffffff ffffffff 7fffffff ffffffff 7fffffff ffffffff
0100 7fffffff ffffffff 7fffffff ffffffff 7fffffff ffffffff 7fffffff ffffffff
0120 7fffffff ffffffff 7fffffff 10.2015. c2a6 11.
0134 ^installation date^
Useful here is maybe the Installation timestamp (11.10.2015 here )
Change this would required to call 'CryptProtectData'. Doing so needs some efforts like written a small program OR stop with ollydebug at this place and manually 'crafting' a CryptProtectData call ...
Note: In this example I'm using Microsoft® Visual Studio 2015
-> For a quick'n'dirty sneak into an expired VS I recommend to read this post. However that's just good for occasional use, till you get all the sign up and login crap properly done again ;)
Okay the real meat is here:
%LOCALAPPDATA%\Microsoft\VisualStudio\14.0\Licenses\
^- This path comes from HKCU\Software\Microsoft\VisualStudio\14.0\Licenses\715f10eb-9e99-11d2-bfc2-00c04f990235\1
1_3jdh3uyw**.crtok**
-after some Base64 decoding:
<ClientRightsContainer
xmlns="http://schemas.datacontract.org/2004/07/Microsoft.VisualStudio.Services.Licensing"
xmlns:i="http://www.w3.org/2001/XMLSchema-instance">
<CertificateBytes>
00000000 30 82 06 41 30 82 04 29 A0 03 02 01 02 02 13 5A 0‚ A0‚ ) Z
00000010 00 00 BC CB 23 AC 52 9C E8 93 F9 0A 00 01 00 00 ¼Ë#¬Rœè“ù
00000020 BC CB 30 0D 06 09 2A 86 48 86 F7 0D 01 01 0B 05 ¼Ë0 *†H†÷
00000030 00 30 81 8B 31 0B 30 09 06 03 55 04 06 13 02 55 0 ‹1 0 U U
00000040 53 31 13 30 11 06 03 55 04 08 13 0A 57 61 73 68 S1 0 U Wash
00000050 69 6E 67 74 6F 6E 31 10 30 0E 06 03 55 04 07 13 ington1 0 U
00000060 07 52 65 64 6D 6F 6E 64 31 1E 30 1C 06 03 55 04 Redmond1 0 U
00000070 0A 13 15 4D 69 63 72 6F 73 6F 66 74 20 43 6F 72 Microsoft Cor
00000080 70 6F 72 61 74 69 6F 6E 31 15 30 13 06 03 55 04 poration1 0 U
00000090 0B 13 0C 4D 69 63 72 6F 73 6F 66 74 20 49 54 31 Microsoft IT1
000000A0 1E 30 1C 06 03 55 04 03 13 15 4D 69 63 72 6F 73 0 U Micros
000000B0 6F 66 74 20 49 54 20 53 53 4C 20 53 48 41 32 30 oft IT SSL SHA20
000000C0 1E 17 0D 31 35 30 33 30 35 32 31 32 39 35 36 5A 150305212956Z
000000D0 17 0D 31 37 30 33 30 34 32 31 32 39 35 36 5A 30 170304212956Z0
000000E0 25 31 23 30 21 06 03 55 04 03 13 1A 61 70 70 2E %1#0! U app.
000000F0 76 73 73 70 73 2E 76 69 73 75 61 6C 73 74 75 64 vssps.visualstud
00000100 69 6F 2E 63 6F 6D 30 82 01 22 30 0D 06 09 2A 86 io.com0‚ "0 *†
...
000002B0 6E 86 36 68 74 74 70 3A 2F 2F 6D 73 63 72 6C 2E n†6http://mscrl.
000002C0 6D 69 63 72 6F 73 6F 66 74 2E 63 6F 6D 2F 70 6B microsoft.com/pk
000002D0 69 2F 6D 73 63 6F 72 70 2F 63 72 6C 2F 6D 73 69 i/mscorp/crl/msi
000002E0 74 77 77 77 32 2E 63 72 6C 86 34 68 74 74 70 3A twww2.crl†4http:
000002F0 2F 2F 63 72 6C 2E 6D 69 63 72 6F 73 6F 66 74 2E //crl.microsoft.
00000300 63 6F 6D 2F 70 6B 69 2F 6D 73 63 6F 72 70 2F 63 com/pki/mscorp/c
00000310 72 6C 2F 6D 73 69 74 77 77 77 32 2E 63 72 6C 30 rl/msitwww2.crl0
00000320 70 06 08 2B 06 01 05 05 07 01 01 04 64 30 62 30 p + d0b0
00000330 3C 06 08 2B 06 01 05 05 07 30 02 86 30 68 74 74 < + 0 †0htt
00000340 70 3A 2F 2F 77 77 77 2E 6D 69 63 72 6F 73 6F 66 p://www.microsof
00000350 74 2E 63 6F 6D 2F 70 6B 69 2F 6D 73 63 6F 72 70 t.com/pki/mscorp
00000360 2F 6D 73 69 74 77 77 77 32 2E 63 72 74 30 22 06 /msitwww2.crt0"
00000370 08 2B 06 01 05 05 07 30 01 86 16 68 74 74 70 3A + 0 † http:
00000380 2F 2F 6F 63 73 70 2E 6D 73 6F 63 73 70 2E 63 6F //ocsp.msocsp.co
00000390 6D 30 4E 06 03 55 1D 20 04 47 30 45 30 43 06 09 m0N U G0E0C
000003A0 2B 06 01 04 01 82 37 2A 01 30 36 30 34 06 08 2B + ‚7* 0604 +
000003B0 06 01 05 05 07 02 01 16 28 68 74 74 70 3A 2F 2F (http://
000003C0 77 77 77 2E 6D 69 63 72 6F 73 6F 66 74 2E 63 6F www.microsoft.co
000003D0 6D 2F 70 6B 69 2F 6D 73 63 6F 72 70 2F 63 70 73 m/pki/mscorp/cps
000003E0 00 30 27 06 09 2B 06 01 04 01 82 37 15 0A 04 1A 0' + ‚7
000003F0 30 18 30 0A 06 08 2B 06 01 05 05 07 03 01 30 0A 0 0 + 0
00000400 06 08 2B 06 01 05 05 07 03 02 30 25 06 03 55 1D + 0% U
00000410 11 04 1E 30 1C 82 1A 61 70 70 2E 76 73 73 70 73 0 ‚ app.vssps
00000420 2E 76 69 73 75 61 6C 73 74 75 64 69 6F 2E 63 6F .visualstudio.co
00000430 6D 30 0D 06 09 2A 86 48 86 F7 0D 01 01 0B 05 00 m0 *†H†÷
... U
</CertificateBytes>
<Token>
{
"typ":"JWT",
"alg":"RS256",
"x5t":"i7qX-NUrehXBYdQC5PSH-TdvzXA"
}
</Token>
</ClientRightsContainer>
Seems M$ is using JSON Web Token (JWT) to wrap in license data.
I guess inside CertificateBytes will be somehow the payload - you're email and other details.
So far for the rough overview what's the data inside.
For more wishes get ILSpy + Reflexil (<- to changes/correct little things!) and then 'browser&correct' files like
c:\Program Files (x86)\Microsoft Visual Studio 14.0\Common7\IDE**Microsoft.VisualStudio.Licensing.dll**
or check out 'Microsoft.VisualStudio.Services.WebApi.dll'