There are a lot of difference between the KMS simulator and the genuine Microsoft KMS server, and the KMS simulator will return any activation request to the client. And genuine only part of the product can only be authorized to return to activate the success of the response.

The simulated client used in this paper is vlmcs

Vlmcs command sample

-v -l W7 kms.aliyun-inc.com vlmcs

-v display details

W7 said that the request to send win7 activation messages, more parameters can be viewed through the -x vlmcs

First, the original server message

The response message of the original server is as follows

V4 version of the response message vista, win7, 2008, 2008R2

From KMS server Response
Economy

Of KMS Response Size: 158 (0x9e)
Version Protocol: 4
Host extended PID KMS: 05426-00206-271-665255-03-1033-9200.0000-2522014
Machine ID Client: 763d81a6-5f80-45da-b47a-15e6858b2018
Request timestamp Client (UTC): 03:32:28 2015-12-19
Host current active clients KMS: 50
Interval policy Renewal: 21600
Interval policy Activation: 1440

V5 version of the response message win8, 2012

From KMS server Response
Economy

Of KMS Response Size: 212 (0xd4)
Version Protocol: 5
Host extended PID KMS: 05426-00206-271-665255-03-1033-9200.0000-2522014
Machine ID Client: 0c23445d-5557-49a7-953b-20d920472e76
Request timestamp Client (UTC): 03:33:36 2015-12-19
Host current active clients KMS: 50
Interval policy Renewal: 21600
Interval policy Activation: 1440

V6 version of the response message win8.1, 2012r2

From KMS server Response
Economy

Of KMS Response Size: 260 (0x104)
Version Protocol: 6
Host extended PID KMS: 05426-00206-271-665255-03-1033-9200.0000-2522014
Host Hardware ID KMS: 25C00AA00034ECF0
Machine ID Client: e934f0d7-ddb7-4d47-bc85-18244aa7c52d
Request timestamp Client (UTC): 03:30:29 2015-12-19
Host current active clients KMS: 50
Interval policy Renewal: 21600
Interval policy Activation: 1440

From KMS server Response
Economy

Of KMS Response Size: 260 (0x104)
Version Protocol: 6
Host extended PID KMS: 55041-00206-271-265694-03-2052-7601.0000-2162015
Host Hardware ID KMS: 14F008300058607A
Machine ID Client: 88c9e6d0-bd5d-48b1-bf47-84459cbe80e6
Request timestamp Client (UTC): 10:47:01 2015-12-19
Host current active clients KMS: 50
Interval policy Renewal: 10080
Interval policy Activation: 120

V6 version of the response message also includes win10, 2016

V4 and V5 content look no difference, V5 KMS PID extended PID PID V6 (host KMS ID ID Hardware V4 V6 KMS V5 KMS KMS host host PID the host key is to rely on this KMS host expansion but the back of the KMS activation tools become more intelligent began to use the random KMS host.

Under normal circumstances: genuine KMS hostFor server products KMS threshold of 5, the maximum count of 50 (here is more special, not two times)For the desktop version of the product KMS threshold of 25, the maximum count of 50 (here is two times), for the KMS product office threshold of 5, the maximum count of 10 (here is two times the relationship), after reaching the maximum count is no longer growth, but the KMS simulator is not the same, and some have been retained in the 26. Some have been retained in the 10.

Genuine server requirements for activation time: the UTC time for client to in the UTC time server before and after 4 hours, namely: UTC time server UTC time 4 h < = client UTC time < = server + 4 hours, if the time is not right "slui.exe 0x2a 0xC004F06C" error

Genuine server may be unable to activate the product may be reported to the following two kinds of errors

0xC004F042 while sending request 1.Error 1 of 9 The refused server to activate the requested product
Do not support the product, the KMS server does not include the license to change the product / version

0x8007000D while sending request 2.Error 1 of 9 The didn't server understand the request

Does not support a high version of the activation protocol
Current activation protocol is divided into v4v5v6
V4 includes vista/win7/win2008/win2008r2/office2010
V5 includes win8/win2012
V6 includes win8.1/win10/win2012r2/office2013/office2016

Two, the common characteristics of the KMS simulator

1.py-kms simulator

This simulator in response to the V4 message, the message size is not set properly, but still can return to the normal activation results and the successful activation of the client

Normal V4 message prompt:

RPC bind Performing...
... NDR64... BTFN... NDR32... Successful...
Activation request Sending (V4 KMS) 1 of 1

But the message returned by the py-kms simulator is a hint.

RPC bind Performing...
... NDR32... BTFN... Successful
Activation request Sending (V4 KMS)
RPC stub size is Warning: 172, be should 176 (incorrect padding probably)
1 of 1

Py-kms simulator using the KMS host expansion PID for: 06401-00206-271-276225-03-1033-9600.0000-1662015 and other random changes, KMS host hardware ID:364F463A8863D35F does not change, the current number of active clients is always 26, does not increase with the client.

2.vlmcsd simulator

The simulator is very similar to the message and the normal packet, but the activation threshold is 5 of the product, the number of the current client does not distinguish between the server and office is always 10, for the activation threshold is 25 of the product, the number of the current return of the client is always 50

Vlmcsd simulator using the KMS host to extend PID for: 03612-00206-176-313789-03-5130-10240.0000-2362015 does not change, restart the vlmcsd process after the PID change, KMS host hardware ID:364F463A8863D35F does not change

3 vision users KMS Server Client.zip Pale_Cheung simulator

This simulator simulates the message similar to vlmcsd, but the activation threshold is 5 of the product, the number of the current client does not distinguish between the server and the office is always 10, for the activation threshold is 25 of the product, the number of the current return of the client is always 50

The simulator uses the KMS host to extend the PID: 03612-00206-181-972612-03-10249-10240.0000-2832015 and other random changes, KMS host hardware ID:364F463A8863D35F does not change

Four, server type test

2015-12-19 test effective KMS server, if there is infringement, you can tell the author removed
effective

122.226.152.230 does not support office2016, does not support win10, win8.1, count correctly, suspected genuine server
Vlmcsd 45.78.3.223 simulator 364F463A8863D35F 03612-00206-155-789653-03-1032-10240.0000-2062015
Vlmcsd 54.223.212.31 simulator 364F463A8863D35F 05426-00206-187-556825-03-1078-9200.0000-2012015
Vlmcsd 110.noip.me simulator 364F463A8863D35F 03612-00206-178-653897-03-5127-10240.0000-2032015
Vlmcsd 3rss.vicp.net:20439 simulator 364F463A8863D35F 55041-00206-165-570952-03-1061-7601.0000-0672014
Vlmcsd mhd.kmdns.net simulator 364F463A8863D35F 05426-00206-177-889713-03-1027-9200.0000-3192015
Vlmcsd xykz.f3322.org simulator 364F463A8863D35F 05426-00168-152-564055-03-1049-9200.0000-0912013
Vlmcsd kms.chinancce.com simulator 364F463A8863D35F 03612-00206-167-660553-03-1097-10240.0000-2162015
Vlmcsd skms.ddns.net simulator 364F463A8863D35F 03612-00206-178-653897-03-5127-10240.0000-2032015
Vlmcsd zh.us.to simulator two modified 06401-00206-271-392041-03-1033-9600.0000-3622014 0102030405060708
Vlmcsd kms.lotro.cc simulator 364F463A8863D35F 03612-00206-171-303903-03-1087-10240.0000-2602015
Vlmcsd www.zgbs.cc simulator 364F463A8863D35F 03612-00206-171-303903-03-1087-10240.0000-2602015
Vlmcsd franklv.ddns.net simulator 364F463A8863D35F 06401-00206-273-766251-03-3079-9600.0000-2162015
Vlmcsd cy2617.jios.org simulator 364F463A8863D35F 03612-00206-190-248585-03-1071-10240.0000-2582015
M.zpale.com mvg.zpale.com k.zpale.com vision users KMS_2013.rar Pale_Cheung two times to modify the 5FD363883A464F36
Kms.landian.news prospective users KMS Server Client.zip 364F463A8863D35F Pale_Cheung