Mantan insinyur MS mengungkap kisah di balik kunci Windows XP 'FCKGW' yang terkenal: 'Bajak laut mulai memanggang kunci menjadi gambar atau hanya menuliskannya di CD dengan Sharpie'

Ex-Microsoft engineer David Plummer has revealed that he was the "primary author" of Windows XP's Product Activation system on the OS side, and so he's got some inside details on the workings behind the infamous "FCKGW" product key. You know, the one that seemed to be written on every pirated, home-burnt CD copy of the OS back in the day.

No clue? Me neither. I'm completely unaware of such illicit activity, and I reject any accusation otherwise. Anyway, the famous (and now defunct) key was, in its entirety, FCKGW-RHQQ2-YXRKT-8TG6W-2B7Q8—and Plummer thinks it may well have been leaked by an OEM or similar with early access to Microsoft's then-new, all-blue XP operating system.

"As you likely recall, Product Activation required that you have a key, and you’d have to activate it online or over the phone," Plummer begins. "But Microsoft had large corporate customers... and those customers did not want to have to activate every offline PC."

Said customers would be given a Volume Media disc image, which could then be unlocked with a Volume Key. To confirm the legitimacy of such an install, the product activation system would inspect the disc image to find a secret 10 MB "binary blob" which was only present on the Volume Media. As a fun aside, this data blob just happened to be an encrypted version of Microsoft Bob.

"I took their disc data and compressed and encrypted it several times," says Plummer. "Rest assured it’s encrypted and even in the AI age no one has extracted it yet. I really just needed random data, so I started with a precompressed binary image because, secretly, I was young and didn’t know if I could trust CryptGenRand."

"And so, if you ever tried the FCKGW key on a regular XP CD, it wouldn’t work," Plummer continues, "because you didn't have Bob in your bits. But if you had the means in 1995 to download large ISO binaries or copy CDs, all it took was the key and a copy of the disc."

Unfortunately for Microsoft, a piracy group called Devils0wn posted a complete Windows XP Pro Corporate ISO five weeks before the official launch, alongside the valid FCKGW key. As Windows Product Activation skipped the rest of the validation process once a mathematically valid key was combined with the Volume Media data check, ta-da, a seemingly-legitimate install of Windows XP was yours.

"Pirates then started baking the key into images or just writing it on the CD with a Sharpie," says Plummer. As for where the key itself came from, he speculates that "the most plausible source is an OEM or hardware partner that received final media early so they could ship PCs on launch day.

"Dell is the name that comes up most often; Intel has also been mentioned because of later source dumps. There were very few organizations that actually possessed a VLK [Volume License Key] that early, which is why the timing points at a partner rather than a random corporate customer."

"But I do not know," Plummer confirms. "Presumably someone does."

In the aftermath, Microsoft started blacklisting product IDs belonging to the leaked keys in Service Pack 1, while Service Pack 2 "made the check more aggressive" and started blocking updates for installs using the key. However, Plummer says that valid, un-leaked VLKs continued to work with Volume Media versions of XP for years.

"The operational failure was that the media and one of those keys left the building before the product even reached stores," Plummer concludes. "Once both pieces were public, WPA’s hardware-binding never got a chance to run."

Interestingly, Plummer says in the comments that he never came across a keygen that actually worked for Windows XP, while others in the thread have speculated that those available at the time were simply faking the generation part and randomly selecting leaked Volume Media keys from a list.

Ah, the internet really was the wild west back in those days, that's for sure. Still, now you know why that mysterious sequence of numbers and letters worked for so long, and later became ingrained in the memory of many PC users. Not me, though. First time I've ever seen it in my life, guv. Honest.