OEM Windows Activation Slic 2.1

[Ralf Coenen]

My Windows7 is bound to a Asus PC, so I'm not able to activate it in XEN. I found an artice http://pastebin.com/4peR72vg that describes a possible way to implement a SLIC table to the bios. As I'm a noob as a code hacker I don't see a way to do that in the enviroment of Qubes Has someone tried to patch the bios with success in the described or may another way?

Any hint would be very helpfull.

And by the way, thank you so much for your efforts on working for a secure OS

Ralf

[Joanna Rutkowska]

On 02/03/13 12:07, Ralf Coenen wrote:
> My Windows7 is bound to a Asus PC, so I'm not able to activate it in XEN. I
> found an artice http://pastebin.com/4peR72vg that describes a possible way
> to implement a SLIC table to the bios. As I'm a noob as a code hacker I
> don't see a way to do that in the enviroment of Qubes Has someone tried to
> patch the bios with success in the described or may another way?
> Any hint would be very helpfull.
>

You can try to clone our Xen source and try to patch it manually:

http://git.qubes-os.org/?p=mainstream/xen.git;a=summary

... but I would be surprised if this patch worked out of the box.

Perhaps would be easier (and more legal ;) to just buy a normal Win7
license?

> And by the way, thank you so much for your efforts on working for a secure
> OS
>

You're welcome :)

joanna.

[Ralf Coenen]

I will give it a try anyway. 

BTW and legalitywise: The Hardware is the same as the OEM version was bought with.
That must be very tricky to judge for the lawyers :-)))

Thank's for you support

[bradbury9]

If I create a win 7 HVM and activate the OEM licence, can I copy the HVM in the same host Qubes without licencing issues? can tho HVM share the same licence?

I will buy the win7 pro 64 bits OEM licence, but I am not sure if the HVM would think it is not legit because of such use case.

[Joanna Rutkowska]

On 02/03/13 19:06, bradbury9 wrote:
> If I create a win 7 HVM and activate the OEM licence, can I copy the HVM in
> the same host Qubes without licencing issues? can tho HVM share the same
> licence?
>

This is a question to lawyers...

> I will buy the win7 pro 64 bits OEM licence, but I am not sure if the HVM
> would think it is not legit because of such use case.
>

... but from the technical perspective, when you clone an installed and
activated Windows HVM, you will break the activation (i.e. the new VM
will complain about lack of activation), unless you also set (via
qvm-prefs) the MAC address for the new HVM to be identical to the
original HVM, as described in the wiki:

http://wiki.qubes-os.org/trac/wiki/HvmCreate

Again, this is probably not compliant with Windows licensing, unless you
have some kind of volume corporate license. Please consult your lawyer.

We might also introduce templates for HVMs sometime in Beta 3 perhaps,
but it's also not clear whether this would be compliant with standard
consumer Windows licenses. Any lawyers on the list?

joanna.

[Ralf Coenen]

AFAIK it depends on the local laws. I think in Germany the MS OEM license is by law not bound to a pc. 
But I'm not an expert.

Sorry

[Franz]

On Mon, Feb 4, 2013 at 12:37 PM, Ralf Coenen <ralf.co...@gmail.com> wrote:

AFAIK it depends on the local laws. I think in Germany the MS OEM license is by law not bound to a pc. 
But I'm not an expert.

I have been a European Patent Attorney for more than 20 years. What I can tell is that  yes it depends on the country. Also it is complicated because it depends on eventual previous decisions on similar issues by national courts which I do not know. Possibly a specialized copyright lawyer may have some ideas. But generally, to be on the safe side, it should be better and enough to comply with what Microsoft dictates. After all we are using Windows under a license contract that is written by Microsoft and that we cannot modify. So standard Microsoft policy should apply.  

It should be possible to ask Microsoft directly. Regarding standard Microsoft policy I found the following a vmware website:

The type of license you have for your Windows operating system can affect how you activate Windows after you start to use it in a VMware Fusion virtual machine.
■
   

With an OEM license, Windows is tied directly to the hardware on which it was loaded by the manufacturer. Most pre-installed versions of Windows have OEM licenses. OEM licenses generally cannot be transferred to another computer, or to a virtual machine. If you use the VMware Fusion Migrate Your PC feature to migrate one of these types of systems to a virtual machine, you might be required to purchase a second license (or product key) from Microsoft. If a second product key is required, you can get that through the Microsoft representative when you call Microsoft Support to activate the operating system now residing in the virtual machine.
■
   

With a retail license, when you buy Windows from a vendor, the license enables you to change platforms as often as you want. In this case, you can reactivate Windows over the Internet, or by phone with Microsoft Support.
■
   

With an enterprise license, you can move the operating system around freely.


Regarding producing Qubes beta3 with a Windows template. Does it means it should include a Windows OS already installed as is Fedora 17 template? If this is your idea it should be negotiated with Microsoft to get a written detailed permission  to do it.

Best
Franz

[Joanna Rutkowska]

On 02/04/13 22:23, Franz wrote:
> Regarding producing Qubes beta3 with a Windows template. Does it means it
> should include a Windows OS already installed as is Fedora 17 template? If
> this is your idea it should be negotiated with Microsoft to get a written
> detailed permission to do it.

No the idea with the templates is that when one installs Windows (or
other OS) in an HVM, this HVM can be later used as a template for
creation of other AppVMs. So, you create an HVM, install Windows there
(using your installation media, your product key, your license), active
it, and then you shut this VM off. Now you can use it as a template to
create and run other AppVMs. The point here is that the other AppVMs do
not have their own copy of the Windows filesystem (C:\Windows,
C:\Program Files) -- this is only on the template VM's image -- they
only contain user's home folder.

The argument that this scheme doesn't require separate licenses for each
of the AppVMs is that the user installs (and activates) Windows only
once (in the template). There is no copy operation involved, only
sharing of the filesystem blocks between the template and the AppVMs.

How does that sound?

joanna.

[bradbury9]

If I have understood all right, it depends on the licence bought.

OEM licence: Windows does not want them installed in VM's but, and this is just my opinion, if if is not installed in the host machine there could be used in a VM.
Retail licence: It could be used in any way we want, but it is hard to reactivate as it involves calling microsoft, etc.
Enterprise licence: It could be used in any way we want, no problems with reactivation.

That being said, IMHO it seems reasonable the windows templateVM, no problems with retail or enterprise but could be tricky with OEM. As long as is the end user the one that chooses which licence he/she buys, Qubes should not be involved in licensing issues.

a) If the end users wants to use an OEM in a laptop that had windows and has been reinstalled with Qubes, the user should change the HVM MAC so it matches the real physical MAC address to make it work, but this reuse of the licence would be considered illegal.
b) If the end user want to use an OEM in a laptop that has NOT had windows, it would be legal, but most probably a) case will happen more offen, many computers come with windows preinstalled.


As a side note: I am buying a desktop computer with a OEM licence and I can choose whenever I want it preinstalled or not, so I will choose not to get it installed so I will not have to do the MAC trickery and, IMHO, the OEM licence would be legal.

[Joanna Rutkowska]

[Added qubes-devel]

On 02/05/13 03:46, Franz wrote:

> This is a borderline case and am pretty sure that nobody can give a final
> and safe answer. Also it is difficult or impossible to see how Microsoft
> may react. These huge companies slowly degenerate into bureaucratic
> monsters and their decisions are often motivated by bureaucratic reasons
> and laziness. So it is probable that when faced with this problem,
> Microsoft will try to simplify it, standardize it and fit it into its
> existing policy that may be something similar to the quote I already posted
> above. Microsoft lawyers may not be willing to dwell into Qubes specific
> technical HVM details that they do not fully understand because this
> involve a risk. The risk to be wrong on something they do not fully master.
> Being wrong is the capital sin for an employee of an huge company. Doing
> nothing is much safer than being wrong in this environment.
>
> Also they will think that each Qubes VM perfom all the same tasks and
> aims that are performed by each VMware VM with something more (added
> security) but not something less.
>
> So the most probable is that they will treat Qubes as VMware or any other
> virtualization environment and pretend that Qubes must follow the same
> policy, considering each virtual machine in the same way.
>
> You may try to challenge Microsoft in court, and you may even win, but
> Microsoft can simply change its License Agreement with specific details for
> the Qubes case. So even if you win with reference to the existing license
> agreement, the future will always be in Microsoft's hands.
>
> But this should not be a problem. If you sell Qubes to the corporate
> environment, they already have the corporate licence and are already used
> to it. If you sell Qubes to individuals most of them will use the OEM
> license to activate the template and then make VMs without paying
> additional licenses. In this respect it may be safer for you to prepare a
> screen that appears when one tries to create a VM from the template. The
> screen may report:
> "Please note that in your country you may be required to buy a specific
> Microsoft License to create this Virtual Machine."
> However, for the United States, it would be safer to ask for a specific
> wording and advise to a local copyright lawyer.
> Best
> Franz
>

Thanks for your insight Franz.

BTW, anybody knows how Bromium solved the licensing problem? They boast
that they create a new "micro" VM for each new user "task", which I
understand to mean every new web browser tab opened, or every document
opened. However micro-ish their "micor VMs" might be, they still must be
Windows VMs in order to allow Windows apps to run inside (e.g. they must
provide the whole userland APIs). Perhaps they require the user to
already have some corporate volume license for Windows?

joanna.

[Joanna Rutkowska]

On 02/05/13 00:40, bradbury9 wrote:
> If I have understood all right, it depends on the licence bought.
>
> OEM licence: Windows does not want them installed in VM's but, and this is
> just my opinion, if if is not installed in the host machine there could be
> used in a VM.
> Retail licence: It could be used in any way we want, but it is hard to
> reactivate as it involves calling microsoft, etc.
> Enterprise licence: It could be used in any way we want, no problems with
> reactivation.
>
> That being said, IMHO it seems reasonable the windows templateVM, no
> problems with retail or enterprise but could be tricky with OEM. As long as
> is the end user the one that chooses which licence he/she buys, Qubes
> should not be involved in licensing issues.
>
> a) If the end users wants to use an OEM in a laptop that had windows and
> has been reinstalled with Qubes, the user should change the HVM MAC so it
> matches the real physical MAC address to make it work, but this reuse of
> the licence would be considered illegal.
> b) If the end user want to use an OEM in a laptop that has NOT had windows,
> it would be legal, but most probably a) case will happen more offen, many
> computers come with windows preinstalled.
>
>
> As a side note: I am buying a desktop computer with a OEM licence and I can
> choose whenever I want it preinstalled or not, so I will choose not to get
> it installed so I will not have to do the MAC trickery and, IMHO, the OEM
> licence would be legal.
>

The "MAC trickery" as you call it, is needed for HVM cloning, not for
simultaneously installing Windows on the host (dual boot?) and in the
VM? In that case the hardware differences would be way too big, and one
would need to re-activate it anyway.

j.