@echo off
setlocal EnableExtensions
title Windows License Audit

set "AUDIT_SELF=%~f0"
set "AUDIT_PS=%TEMP%\windows-license-audit-%RANDOM%-%RANDOM%.ps1"

powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "$ErrorActionPreference='Stop'; $marker='### POWERSHELL_SCRIPT_BELOW ###'; $self=$env:AUDIT_SELF; $out=$env:AUDIT_PS; $text=[IO.File]::ReadAllText($self); $idx=$text.LastIndexOf($marker); if($idx -lt 0){ throw 'Embedded PowerShell marker not found.' }; $script=$text.Substring($idx + $marker.Length).TrimStart([char]13,[char]10); [IO.File]::WriteAllText($out, $script, [Text.Encoding]::UTF8)"
if errorlevel 1 (
  echo Failed to extract audit script.
  pause
  exit /b 1
)

powershell.exe -NoProfile -ExecutionPolicy Bypass -File "%AUDIT_PS%"
set "AUDIT_EXIT=%ERRORLEVEL%"
del "%AUDIT_PS%" >nul 2>&1
pause
exit /b %AUDIT_EXIT%

### POWERSHELL_SCRIPT_BELOW ###
$ErrorActionPreference = 'SilentlyContinue'

function Write-Section([string]$Text) {
    Write-Host ''
    Write-Host ('[{0}]' -f $Text) -ForegroundColor Cyan
}

function Write-Item([string]$Name, [string]$Value, [string]$State = 'Info') {
    $color = switch ($State) {
        'OK' { 'Green' }
        'WARN' { 'Yellow' }
        'BAD' { 'Red' }
        default { 'Gray' }
    }
    Write-Host ('{0,-34}: {1}' -f $Name, $Value) -ForegroundColor $color
}

function Get-LicenseStatusName($Code) {
    switch ([int]$Code) {
        0 { 'Unlicensed' }
        1 { 'Licensed' }
        2 { 'OOB grace' }
        3 { 'OOT grace' }
        4 { 'Non-genuine grace' }
        5 { 'Notification' }
        6 { 'Extended grace' }
        default { "Unknown ($Code)" }
    }
}

function Format-HResult($Value) {
    if ($null -eq $Value) { return '' }
    try {
        $i = [int64]$Value
        if ($i -lt 0) { return ('0x{0:X8}' -f [BitConverter]::ToUInt32([BitConverter]::GetBytes([int32]$i), 0)) }
        return ('0x{0:X8}' -f [uint32]$i)
    } catch { return [string]$Value }
}

function Test-RegValue([string]$Path, [string]$Name) {
    try {
        $item = Get-ItemProperty -Path $Path -ErrorAction Stop
        return ($item.PSObject.Properties.Name -contains $Name)
    } catch { return $false }
}

function Find-Tasks([string[]]$Needles) {
    $raw = schtasks.exe /query /fo LIST /v 2>$null
    if (-not $raw) { return @() }
    $hits = New-Object System.Collections.Generic.List[string]
    foreach ($line in $raw) {
        foreach ($needle in $Needles) {
            if ($line -match [regex]::Escape($needle)) {
                $hits.Add($line.Trim())
            }
        }
    }
    return @($hits | Select-Object -Unique)
}

function Find-Paths([string[]]$Paths) {
    $hits = New-Object System.Collections.Generic.List[string]
    foreach ($p in $Paths) {
        if (Test-Path $p) { $hits.Add($p) }
    }
    return $hits.ToArray()
}

Write-Host '============================================================' -ForegroundColor Cyan
Write-Host 'WINDOWS / OFFICE LICENSE AUDIT - READ ONLY' -ForegroundColor Cyan
Write-Host '============================================================' -ForegroundColor Cyan

$winAppId = '55c92734-d682-4d71-983e-d6ec3f16059f'
$os = Get-CimInstance Win32_OperatingSystem
$cv = Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion'
$svc = Get-CimInstance SoftwareLicensingService
$products = @(Get-CimInstance SoftwareLicensingProduct -Filter "ApplicationID='$winAppId'" | Where-Object { $_.Name -like 'Windows*' })
$license = @($products | Where-Object { $_.PartialProductKey -and $_.LicenseStatus -eq 1 } | Select-Object -First 1)
if (-not $license) { $license = @($products | Where-Object { $_.PartialProductKey } | Select-Object -First 1) }
if (-not $license) { $license = @($products | Select-Object -First 1) }

Write-Section 'THONG TIN WINDOWS'
Write-Item 'Windows' ("{0} | Build {1}.{2}" -f $os.Caption, $cv.CurrentBuild, $cv.UBR) 'Info'
Write-Item 'EditionID' ([string]$cv.EditionID) 'Info'
Write-Item 'Ngay gio cai dat' ($os.InstallDate.ToString('dd/MM/yyyy HH:mm:ss')) 'Info'
if ($license) {
    $status = Get-LicenseStatusName $license.LicenseStatus
    $state = if ($license.LicenseStatus -eq 1) { 'OK' } else { 'WARN' }
    Write-Item 'Trang thai WMI' $status $state
    Write-Item 'Kenh / mo ta' ([string]$license.Description) 'Info'
    Write-Item 'Partial key' ([string]$license.PartialProductKey) 'Info'
    Write-Item 'License reason' (Format-HResult $license.LicenseStatusReason) 'Info'
    Write-Item 'Grace minutes' ([string]$license.GracePeriodRemaining) 'Info'
} else {
    Write-Item 'Trang thai WMI' 'Khong tim thay SoftwareLicensingProduct cua Windows' 'BAD'
}

$oa3 = ''
try { $oa3 = [string]$svc.OA3xOriginalProductKey } catch {}
Write-Item 'BIOS OEM key' ($(if ([string]::IsNullOrWhiteSpace($oa3)) { 'Khong co / khong doc duoc' } else { 'Co key OEM trong BIOS' })) ($(if ([string]::IsNullOrWhiteSpace($oa3)) { 'WARN' } else { 'OK' }))

Write-Section 'PHAN TICH - DAU VET CRACK'

$desc = if ($license) { [string]$license.Description } else { '' }
$kmsName = ''
$kmsPort = ''
try {
    $kmsName = [string]$svc.KeyManagementServiceMachine
    $kmsPort = [string]$svc.KeyManagementServicePort
} catch {}

$isKmsClient = ($desc -match 'VOLUME_KMSCLIENT|KMSCLIENT')
if ($isKmsClient -or -not [string]::IsNullOrWhiteSpace($kmsName)) {
    $detail = if ($kmsName) { "KMS client/server configured: $kmsName`:$kmsPort" } else { 'Windows channel la Volume KMS Client.' }
    Write-Item '[1] KMS Crack / KMS channel' $detail 'WARN'
} else {
    Write-Item '[1] KMS Crack / KMS channel' 'Khong phat hien cau hinh may chu KMS.' 'OK'
}

$spp = 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform'
$noGen = Test-RegValue $spp 'NoGenTicket'
if ($noGen) {
    Write-Item '[2] MAS / HWID' "PHAT HIEN khoa NoGenTicket trong SoftwareProtectionPlatform." 'BAD'
} else {
    Write-Item '[2] MAS / HWID' 'Khong thay khoa NoGenTicket o vi tri pho bien.' 'OK'
}

$kms38 = $false
if ($license -and $isKmsClient -and [int64]$license.GracePeriodRemaining -gt 400000) { $kms38 = $true }
$hookDll = Test-Path "$env:windir\System32\SppExtComObjHook.dll"
if ($kms38 -or $hookDll) {
    $detail = @()
    if ($kms38) { $detail += "GracePeriodRemaining bat thuong: $($license.GracePeriodRemaining) phut" }
    if ($hookDll) { $detail += 'Co SppExtComObjHook.dll' }
    Write-Item '[3] KMS38 Hook' ($detail -join '; ') 'BAD'
} else {
    Write-Item '[3] KMS38 Hook' 'Khong phat hien dau hieu KMS38 hook pho bien.' 'OK'
}

if ($license) {
    $logicState = 'OK'
    $logicText = 'Doi chieu kenh cap phep va BIOS hop ly.'
    if ($isKmsClient -and -not [string]::IsNullOrWhiteSpace($oa3)) {
        $logicState = 'WARN'
        $logicText = 'May co OEM BIOS key nhung Windows dang o kenh KMS Client. Can kiem tra nguon license.'
    }
    Write-Item '[4] Logic ban quyen' $logicText $logicState
}

$toolHits = Find-Paths @(
    "$env:SystemDrive\Program Files\KMSpico",
    "$env:SystemDrive\Program Files (x86)\KMSpico",
    "$env:ProgramData\KMSAuto",
    "$env:ProgramData\KMS_VL_ALL",
    "$env:ProgramData\Online_KMS_Activation",
    "$env:ProgramData\MAS_Logs",
    "$env:windir\AutoKMS",
    "$env:windir\System32\SppExtComObjHook.dll"
)
if ($toolHits.Count -gt 0) {
    Write-Item '[5] Thu muc / file tool lau' ($toolHits -join '; ') 'BAD'
} else {
    Write-Item '[5] Thu muc / file tool lau' 'Khong phat hien thu muc/file pho bien.' 'OK'
}

$taskHits = Find-Tasks @('KMS','AutoKMS','KMSAuto','KMSpico','AutoPico','SppExtComObj','MAS','HWID','KMS_VL_ALL','Online_KMS')
if ($taskHits.Count -gt 0) {
    Write-Item '[6] Tac vu an (Task)' (($taskHits | Select-Object -First 8) -join '; ') 'BAD'
} else {
    Write-Item '[6] Tac vu an (Task)' 'Khong phat hien task gia han KMS pho bien.' 'OK'
}

if ($noGen) {
    Write-Item '[7] Can thiep Registry' "PHAT HIEN khoa NoGenTicket." 'BAD'
} else {
    Write-Item '[7] Can thiep Registry' 'Khong phat hien NoGenTicket.' 'OK'
}

Write-Section 'OFFICE / OSPP.VBS'
$osppPaths = @(
    "$env:ProgramFiles\Microsoft Office\Office16\ospp.vbs",
    "$env:ProgramFiles(x86)\Microsoft Office\Office16\ospp.vbs",
    "$env:ProgramFiles\Microsoft Office\Office15\ospp.vbs",
    "$env:ProgramFiles(x86)\Microsoft Office\Office15\ospp.vbs"
) | Where-Object { Test-Path $_ }
if ($osppPaths.Count -eq 0) {
    Write-Item 'ospp.vbs' 'Khong tim thay Office ospp.vbs o duong dan pho bien.' 'WARN'
} else {
    foreach ($ospp in $osppPaths) {
        Write-Item 'ospp.vbs' $ospp 'Info'
        $out = cscript.exe //nologo $ospp /dstatus 2>$null
        $lines = @($out | Where-Object { $_ -match 'LICENSE STATUS|LICENSE NAME|LICENSE DESCRIPTION|Last 5 characters|KMS machine name|KMS host caching|ERROR CODE' })
        foreach ($line in $lines) {
            $state = if ($line -match 'KMS machine name|ERROR CODE') { 'WARN' } elseif ($line -match '---LICENSED---') { 'OK' } else { 'Info' }
            Write-Item 'Office' $line.Trim() $state
        }
    }
}

Write-Section 'KET LUAN DANH GIA WINDOWS'
$bad = 0
$warn = 0
if ($noGen) { $bad++ }
if ($hookDll -or $kms38) { $bad++ }
if ($toolHits.Count -gt 0) { $bad++ }
if ($taskHits.Count -gt 0) { $bad++ }
if ($isKmsClient -or -not [string]::IsNullOrWhiteSpace($kmsName)) { $warn++ }
if ($license -and $license.LicenseStatus -ne 1) { $bad++ }

if ($bad -gt 0) {
    Write-Host 'CANH BAO: Phat hien dau vet crack/KMS/script hoac can thiep license. Nen kiem tra nguon key va cai lai/active bang license hop le.' -ForegroundColor Red
} elseif ($warn -gt 0) {
    Write-Host 'LUU Y: Co dau hieu kenh KMS/Volume. Neu day la may cong ty thi co the hop le; neu may ca nhan thi can kiem tra nguon license.' -ForegroundColor Yellow
} else {
    Write-Host 'OK: Chua phat hien dau vet crack pho bien trong cac diem quet read-only.' -ForegroundColor Green
}

Write-Host ''
Write-Host 'Audit hoan tat. Script chi doc thong tin, khong sua he thong.' -ForegroundColor Gray