from urllib import request
from urllib.error import HTTPError
from base64 import b64encode, b64decode
from uuid import uuid4
from json import dumps, loads
from os.path import basename
from ctypes import *
from os.path import basename
from os import makedirs, environ
from subprocess import run

class DATA_BLOB(Structure):
    _fields_ = [("cbData", c_uint32), ("pbData", c_void_p)]

class TOKEN_PRIVILEGES(Structure):
   _fields_ = [('PrivilegeCount', c_uint32), ('Privileges', c_uint32 * 3)]

def get_devid():
    devid = cast(c_void_p(cdll.msvcrt.malloc(32)), POINTER(c_uint8))
    cdata = c_uint()
    status = cdll.slc.SLGetWindowsInformation(c_wchar_p("FDE6DEB3-F790-48FF-8F27-43461944FD3E"), None, byref(cdata), byref(devid))
    
    if status < 0:
        raise Exception("Failed to get device ID")
    
    return b64encode(bytes(devid[:32])).decode("utf-8")

def pidof(pname):
    count = 1024
    pids = None
    cbret = c_uint32()
    
    while True:
        pids = (c_uint32 * count)()
        cb = sizeof(pids)
        cbret = c_uint32()
        
        if cdll.psapi.EnumProcesses(byref(pids), cb, byref(cbret)):
            if cbret.value < cb:
                break
            else:
                count *= 2
    
    for i in range(cbret.value // 4):
        pid = pids[i]
        hproc = cdll.kernel32.OpenProcess(0x1000, 0, pid)
        proc_name = (c_char * 260)()
        cdll.psapi.GetProcessImageFileNameA(hproc, proc_name, 260)
        if basename(proc_name.value.decode("utf-8")) == pname:
            return pid

def impr_winlogon():
    hToken = c_void_p()
    
    if cdll.kernel32.OpenProcessToken(c_void_p(-1), 0x28, byref(hToken)) == 0:
        raise Exception(f"Failed to get token ERR {cdll.kernel32.GetLastError()}")
    
    tp = TOKEN_PRIVILEGES(1, (20, 0, 2))
    
    if cdll.advapi32.AdjustTokenPrivileges(hToken, False, byref(tp), 0, None, None) == 0:
        raise Exception(f"Failed to get SeDebugPrivilege ERR {cdll.kernel32.GetLastError()}")
    
    h_winlogon = cdll.kernel32.OpenProcess(0x400, 1, pidof("winlogon.exe"))
    h_tok = c_void_p()
    h_duptok = c_void_p()
    
    cdll.kernel32.OpenProcessToken(h_winlogon, 0xE, byref(h_tok))
    cdll.advapi32.DuplicateTokenEx(h_tok, 0x2000000, 0, 2, 1, byref(h_duptok))
    cdll.advapi32.ImpersonateLoggedOnUser(h_duptok)

def get_devtik(user_sid, tik_id):
    try:
        impr_winlogon()
        cbdata = c_uint32()
        
        cdll.advapi32.RegGetValueW(
            0x80000003,
            c_wchar_p(rf"{user_sid}\Software\Microsoft\IdentityCRL\Immersive\production\Token\{{{tik_id}}}"),
            c_wchar_p(r"DeviceTicket"), 
            0xFFFF, None, None, byref(cbdata)
        )
        pvdata = create_string_buffer(cbdata.value)
        cdll.advapi32.RegGetValueW(
            0x80000003,
            c_wchar_p(rf"{user_sid}\Software\Microsoft\IdentityCRL\Immersive\production\Token\{{{tik_id}}}"),
            c_wchar_p(r"DeviceTicket"), 
            0xFFFF, None, pvdata, byref(cbdata)
        )
        
        tik_len = cbdata.value
        tik_in = create_string_buffer(pvdata.raw[4:], tik_len - 4)
        tik_out = DATA_BLOB(0, None)
        cdll.crypt32.CryptUnprotectData(
            byref(DATA_BLOB(tik_len - 4, cast(tik_in, c_void_p))),
            None, None, None, None, 0,
            byref(tik_out)
        )
        buf = bytes(cast(c_void_p(tik_out.pbData), POINTER(c_uint8))[:tik_out.cbData])
        return buf[buf.find(b"t\x00=\x00") + 4:buf.find(b"&\x00p\x00=\x00")].decode("utf-16le")
    except:
        return None

def post(url, payload, headers):
    req = request.Request(url, dumps(payload).encode("utf-8"), headers)
    resp = request.urlopen(req)
    return resp.read().decode("utf-8")

try:
    print("Getting device info...")

    DEVICE_ID = get_devid()
    DEVICE_TICKET = None

    for sid in ["S-1-5-18", "S-1-5-19"]:
        for client_id in ["D6D5A677-0872-4AB0-9442-BB792FCE85C5", "CA4948B9-35E5-4977-A64A-5C71AA2A26CB"]:
            DEVICE_TICKET = get_devtik(sid, client_id)
            
            if DEVICE_TICKET:
                break
        
        if DEVICE_TICKET:
            break

    if DEVICE_TICKET is None:
        raise Exception("Couldn't get device ticket.")

    headers = {
        "User-Agent": "WindowsStore/22404.1401.2.0",
        "Authorization": f"MSAHW1.0=t={DEVICE_TICKET}&p=",
        "Content-Type": "application/json; charset=utf-8"
    }

    json = {
        "clientContext": {
            "client": "Universal Store Native Client",
            "clientVersion": "22404.1401.2.0",
            "deviceFamily": "Windows.Desktop",
            "osVersion": "26100.1.amd64fre.ge_release.240331-1435.iotenterprise"
        },
        "orderState": "Purchased",
        "items": [
            {
                "skuId": "0003",
                "campaignId": "",
                "devOfferId": "",
                "productId": "BF712690PMLF",
                "quantity": 1,
                "availabilityId": "BF712690PSCP"
            }
        ],
        "orderAdditionalMetadata": "{\"callerApplicationId\":\"22404.1401.2.0\"}",
        "orderId": str(uuid4()).upper(),
        "language": "en-US",
        "market": "US"
    }

    print("Ordering unlock license...")

    post(
        "https://purchase.mp.microsoft.com/v7.0/users/me/orders",
        json,
        headers
    )

    headers = {
        "User-Agent": "LM",
        "Authorization": f"t={DEVICE_TICKET}&p=",
        "Content-Type": "application/json; charset=utf-8"
    }

    client_chall = f'<?xml version="1.0" encoding="utf-8" ?><ClientChallenge xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns="http://schemas.microsoft.com/onestore/security/mkms/LicReq/v1" Version="2"><LicenseProtocolVersion>5</LicenseProtocolVersion><SigningKeyVersion>1</SigningKeyVersion><ClientVersion>2</ClientVersion><DeviceID>{DEVICE_ID}</DeviceID><DeviceCurrentlyLocked>true</DeviceCurrentlyLocked></ClientChallenge>'

    json = {
        "clientChallenge": b64encode(client_chall.encode("utf-8")).decode("utf-8"),
        "concurrencyMode": "Rude",
        "contentId": "58d710c5-f40f-7346-5664-9162b21ef52e",
        "deviceContext": {
            "hardwareManufacturer": "Public",
            "hardwareType": "Public",
            "mobileOperator": "Public"
        },
        "licenseVersion": 4,
        "market": "US",
        "needKey": "true",
        "users": {}
    }

    print("Obtaining unlock license...")

    r = post(
        "https://licensing.mp.microsoft.com/v7.0/licenses/content",
        json,
        headers
    )

    makedirs(rf"{environ['PROGRAMDATA']}\Microsoft\Windows\ClipSVC\Install\Migration", exist_ok=True)

    with open(rf"{environ['PROGRAMDATA']}\Microsoft\Windows\ClipSVC\Install\Migration\unlock_license.xml", "wb") as f:
        f.write(b64decode(loads(r)["license"]["keys"][0]["value"]))

    print("Installing unlock license...")

    run([rf"{environ['SYSTEMROOT']}\System32\clipup.exe", "-p"])

    input("Press Enter to exit. ")
except Exception as e:
    print("Error:")
    print(e)
    input("Press Enter to exit. ")