# Qubes and Windows 7 OEM

*https://mbrasile.com/windows-7-oem-on-qubes.html · 2016-04-07 · Qubes*

It's almost six months I've fallen in love with the wonderful [Qubes OS](https://www.qubes-os.org/) and I'm starting to feel confortable with it, organizing all my project through **AppVMs** and updating Templates.

For the records of compatible hardware, I am using one great HP [zBook 14"](http://www8.hp.com/ca/en/campaigns/workstations/zbook-14.html) (G1) with i7-i4600U and 8 **16GB** of RAM: I think that 4GB could be too few for Qubes 3 at the moment (or at least they would reduce the possibilities you have, until we could have something different like [Unikernel](http://roscidus.com/blog/blog/2016/01/01/a-unikernel-firewall-for-qubesos/)), cause for example you need at least 3GB only for Windows 7 and other 2GB for Qubes itself.

**SLIC tables**

Now I want to describe how I was able to run a **correct activation of the OEM license of Windows 7 Professional** they have sold me with the notebook (I have used only with linux till I discovered Qubes).

A little digression, [better explained here](https://techdoors.wordpress.com/2012/09/26/activating-windows-7-oem-way/): since Vista, the **activation keys** of OEM Windows were saved into the BIOS in so-called **SLIC tables**. But the virtualization system of Qubes does not (yet) implement a pass-through access to the BIOS, so the OEM version of Windows I have and legitimately want to use, is unable to reach those keys and communicated me after a month of test behaviour that is NOT original (black screen and error 0xC004F074).

A lot of googling made clear that is it possible to embed your own **SLIC 2.1 tables** in the XEN virtualizer used inside Qubes 3.0, it was just a bit tricky to put together all the pieces in the way I'll try now to resume.

**Re-compile (part of) Qubes**

First of all, you'll need to re-compile (part of) Qubes, so setup a Fedora environment with at least 30GB of space (26GB for all sources and compiled binaries and around 3GB for the final ISO) for [qubes-builder](https://www.qubes-os.org/doc/qubes-builder/). You can follow that guide and arrive till the 'make get-sources qubes' removing qubes and saving some time; while it downloads all the sources from git and add all the RPMs you can go on with this guide.

**OEM KEYS**

Together with SLIC 2.1 tables you need to have your **ACPI_OEM_ID** and **ACPI_OEM_TABLE_ID**. Together they are a decode key for SLIC table.
If you are on Windows, just google for *SLIC Toolkit* and find your info (ACPI_OEM IDs are called XSDT/RSDT, while SLIC table 2.1 are in first window).
If you are on linux/*bsd/qubes, of course it's much more easy.

**Get your own SLIC tables**

with one of the latest linux/xen kernel, you'll find the ready dump of SLIC tables in this path

**/sys/firmware/acpi/tables/SLIC**

#cat /sys/firmware/acpi/tables/SLIC > ~/SLIC.bin

but you need to rewrite this file as a byte array, so just run this command

#xxd -i ~/SLIC.bin | grep -v len | sed 's/unsigned char.*/unsigned char SLIC[] = {/' > **slic.h**

**Get your own OEM IDs**

All you need is hexdump, default in Fedora, so run

#hexdump -C ~/SLIC.bin

then you know this

**OEMID** = **6 bytes**, starting at offset 10 (decimal)

**OEM Table ID** = **8 bytes**, starting at offset 16 (decimal), so just after OEMID

insert these inside acpi2_0.h

**PATCHING QUBES**

It's long time since I used to compile the linux kernel under a Slackware, so I had to understand the making flow of the compiling of Qubes that it's full of patches that are applied at some time during the building process. So I have added my own patch that modify the OEM IDs and add slic.h in the right places.

In **qubes-builder/qubes-src/vmm-xen/series.conf** add as last line  exactly this
**patches.qubes/win7-oem-SLIC-ACPI.patch**

and copy **win7-oem-SLIC-ACPI.patch** in the folder
**qubes-builder/qubes-src/vmm-xen/patches.qubes/**

and you're done!

now if you want a full ISO, run

**#make qubes**

**#make iso**

if you just want to patch your hypervisor, run

#make vmm-xen

and when you'll going to install Windows 7 OEM it will have all the (original) activation keys it needs without any other patch.

to check the status of the activation just run this in cmd.exe
**>slmgr.vbs -dli**

---

Massimiliano Brasile — https://mbrasile.com/ — info@mbrasile.com