webinar

Security researchers from MASSGRAVE have developed TSforge, a tool that exploits vulnerabilities in Microsoft’s Software Protection Platform (SPP) to activate all Windows versions from Windows 7 onward, as well as various Office suites. This marks the first successful attack on SPP’s cryptographic defenses since its introduction in Windows Vista. The exploit involves manipulating encrypted “trusted stores” used by SPP to validate software activation. Researchers reverse-engineered SPP’s private key infrastructure, using leaked Windows 8 beta builds, to forge activation data and deceive SPP into accepting permanent licenses. The process includes extracting SPP’s RSA private key, simulating ExecCodes to derive the private exponent, and decrypting the AES key that protects activation data. TSforge can inject zeroed hardware ID hashes, precomputed product key blobs, and timestamped license metadata with validity windows of over 4000 years. The tool is compatible with different Windows versions, affecting both Windows 7 and Windows 10. Microsoft has not commented on the exploit, but enterprise clients using KMS should check their activation logs for spoofed status codes. Although TSforge is not publicly available, it reveals significant vulnerabilities in SPP’s security model, which may impact enterprise licensing strategies as the end-of-life for Windows 10 approaches in 2025.