Qubes and Windows 7 OEM

It’s almost six months I’ve fallen in love with the wonderful Qubes OS and I’m starting to feel confortable with it, organizing all my project through AppVMs and updating Templates.

For the records of compatible hardware, I am using one great HP zBook 14″ (G1) with i7-i4600U and 8 16GB of RAM: I think that 4GB could be too few for Qubes 3 at the moment (or at least they would reduce the possibilities you have, until we could have something different like Unikernel), cause for example you need at least 3GB only for Windows 7 and other 2GB for Qubes itself.

SLIC tables

Now I want to describe how I was able to run a correct activation of the OEM license of Windows 7 Professional they have sold me with the notebook (I have used only with linux till I discovered Qubes).

A little digression, better explained here: since Vista, the activation keys of OEM Windows were saved into the BIOS in so-called SLIC tables. But the virtualization system of Qubes does not (yet) implement a pass-through access to the BIOS, so the OEM version of Windows I have and legitimately want to use, is unable to reach those keys and communicated me after a month of test behaviour that is NOT original (black screen and error 0xC004F074).

A lot of googling made clear that is it possible to embed your own SLIC 2.1 tables in the XEN virtualizer used inside Qubes 3.0, it was just a bit tricky to put together all the pieces in the way I’ll try now to resume.

Re-compile (part of) Qubes

First of all, you’ll need to re-compile (part of) Qubes, so setup a Fedora environment with at least 30GB of space (26GB for all sources and compiled binaries and around 3GB for the final ISO) for qubes-builder. You can follow that guide and arrive till the ‘make get-sources qubes’ removing qubes and saving some time; while it downloads all the sources from git and add all the RPMs you can go on with this guide.

OEM KEYS

Together with SLIC 2.1 tables you need to have your ACPI_OEM_ID and ACPI_OEM_TABLE_ID. Together they are a decode key for SLIC table.
If you are on Windows, just google for SLIC Toolkit and find your info (ACPI_OEM IDs are called XSDT/RSDT, while SLIC table 2.1 are in first window).
If you are on linux/*bsd/qubes, of course it’s much more easy.

Get your own SLIC tables

with one of the latest linux/xen kernel, you’ll find the ready dump of SLIC tables in this path

/sys/firmware/acpi/tables/SLIC

#cat /sys/firmware/acpi/tables/SLIC > ~/SLIC.bin

but you need to rewrite this file as a byte array, so just run this command

#xxd -i ~/SLIC.bin | grep -v len | sed ‘s/unsigned char.*/unsigned char SLIC[] = {/’ > slic.h

Get your own OEM IDs

All you need is hexdump, default in Fedora, so run

#hexdump -C ~/SLIC.bin

then you know this

OEMID = 6 bytes, starting at offset 10 (decimal)

OEM Table ID = 8 bytes, starting at offset 16 (decimal), so just after OEMID

insert these inside acpi2_0.h

PATCHING QUBES

It’s long time since I used to compile the linux kernel under a Slackware, so I had to understand the making flow of the compiling of Qubes that it’s full of patches that are applied at some time during the building process. So I have added my own patch that modify the OEM IDs and add slic.h in the right places.

In qubes-builder/qubes-src/vmm-xen/series.conf add as last line  exactly this

patches.qubes/win7-oem-SLIC-ACPI.patch

and copy win7-oem-SLIC-ACPI.patch in the folder

qubes-builder/qubes-src/vmm-xen/patches.qubes/

and you’re done!

now if you want a full ISO, run

#make qubes

#make iso

if you just want to patch your hypervisor, run

#make vmm-xen

and when you’ll going to install Windows 7 OEM it will have all the (original) activation keys it needs without any other patch.

to check the status of the activation just run this in cmd.exe

>slmgr.vbs -dli