Keyfilegenerator.cmd

Many on-premise software vendors use a keyfilegenerator.cmd on an internal activation server. The script generates a machine-specific keyfile based on a hardware ID hash, which customers drop into their installation directory.

@echo off
title Key File Generator v1.0
color 0A
setlocal enabledelayedexpansion
REM -------------------------------
REM Configuration
REM -------------------------------
set KEY_PATH=%CD%
set KEY_NAME=product.lic
set SECRET=MySuperSecretKey123!
set LOG_FILE=keygen.log
REM -------------------------------
REM Check Administrator Rights (optional)
REM -------------------------------
net session >nul 2>&1
if %errorLevel% neq 0 (
echo [WARNING] Running without admin rights. Some HW info may be missing.
)
REM -------------------------------
REM Generate Unique Machine ID
REM -------------------------------
echo [%DATE% %TIME%] Starting key generation >> %LOG_FILE% keyfilegenerator.cmd
REM Get MAC address (first active adapter)
for /f "tokens=2 delims==" %%a in ('wmic nic where "NetEnabled=true" get MACAddress /value 2^>nul') do (
set "MAC=%%a"
goto :mac_found
)
:mac_found
if "%MAC%"=="" set "MAC=UNKNOWN_MAC"
REM Get Volume Serial Number of C: drive
for /f "tokens=5" %%i in ('dir C:\ 2^>nul ^| find "bytes"') do set "VOLSER=%%i"
REM -------------------------------
REM Create the Key String
REM -------------------------------
set "RAW_KEY=%MAC%|%VOLSER%|%COMPUTERNAME%|%SECRET%"
echo [DEBUG] Raw data: %RAW_KEY% >> %LOG_FILE% Many on-premise software vendors use a  keyfilegenerator
REM -------------------------------
REM Hash the key (using CertUtil)
REM -------------------------------
echo %RAW_KEY% > raw.txt
certutil -hashfile raw.txt SHA256 > hash.txt
REM Extract only the hash line (skip the first line)
for /f "skip=1 tokens=*" %%h in (hash.txt) do (
set "FINAL_KEY=%%h"
goto :key_extracted
)
:key_extracted
REM -------------------------------
REM Write the Key File
REM -------------------------------
echo %FINAL_KEY% > "%KEY_PATH%%KEY_NAME%"
echo [SUCCESS] Key file created: %KEY_PATH%%KEY_NAME% >> %LOG_FILE%
echo.
echo ===========================================
echo  Key File Generated Successfully
echo ===========================================
echo  Location: %KEY_PATH%%KEY_NAME%
echo  Key Hash: %FINAL_KEY%
echo =========================================== If your key file embeds a timestamp, an
REM -------------------------------
REM Cleanup
REM -------------------------------
del raw.txt hash.txt 2>nul
exit /b 0

If your key file embeds a timestamp, an attacker can simply change the system clock. Advanced scripts should additionally check against an NTP server or use secure timestamping.