From 2684c4b02e7aac8b6ce92cf3382ccdd2a77d1565 Mon Sep 17 00:00:00 2001
From: David Heinemeier Hansson <david@hey.com>
Date: Wed, 19 Aug 2026 13:59:25 +0200
Subject: [PATCH] Print the OEM Windows product key from firmware (#7480)

* Print the OEM Windows product key from firmware

Machines that shipped with Windows keep the OEM key in the ACPI MSDM
table. `omarchy windows license key` reads it with strings, then cat.

* Rename the firmware key command to omarchy-windows-key
---
 bin/omarchy-windows-key          | 41 ++++++++++++++++++++
 manual/28-windows-vm.md          |  2 +
 test/shell.d/windows-key-test.sh | 65 ++++++++++++++++++++++++++++++++
 3 files changed, 108 insertions(+)
 create mode 100755 bin/omarchy-windows-key
 create mode 100755 test/shell.d/windows-key-test.sh

diff --git a/bin/omarchy-windows-key b/bin/omarchy-windows-key
new file mode 100755
index 00000000..92ba396b
--- /dev/null
+++ b/bin/omarchy-windows-key
@@ -0,0 +1,41 @@
+#!/bin/bash
+
+# omarchy:summary=Print the OEM Windows product key stored in firmware
+# omarchy:requires-sudo=true
+
+set -euo pipefail
+
+MSDM=${OMARCHY_MSDM_PATH:-/sys/firmware/acpi/tables/MSDM}
+
+if [[ ! -e $MSDM ]]; then
+  echo "No Windows license key found in firmware." >&2
+  exit 1
+fi
+
+read_msdm() {
+  if [[ -r $MSDM ]]; then
+    "$@" "$MSDM"
+  else
+    sudo "$@" "$MSDM"
+  fi
+}
+
+extract_key() {
+  grep -aoEm1 '[A-Z0-9]{5}(-[A-Z0-9]{5}){4}'
+}
+
+key=""
+if omarchy-cmd-present strings; then
+  key=$(read_msdm strings | extract_key) || true
+fi
+
+if [[ -z $key ]]; then
+  key=$(read_msdm cat | extract_key) || true
+fi
+
+if [[ -z $key ]]; then
+  echo "Firmware license table found, but no Windows product key could be extracted." >&2
+  exit 1
+fi
+
+printf '%s\n' "$key"
diff --git a/manual/28-windows-vm.md b/manual/28-windows-vm.md
index c7b534c6..128f0e16 100644
--- a/manual/28-windows-vm.md
+++ b/manual/28-windows-vm.md
@@ -36,6 +36,8 @@ There's no GPU passthrough with this setup, so it's not suitable for gaming or v
 
 The version installed is Windows 11 Pro, unactivated. You'll need your own license key to use the gated features.
 
+If this computer shipped with Windows, the OEM key is still in firmware even after installing Omarchy. Print it with `omarchy windows key`. That key is bound to this machine — it will activate Windows reinstalled on this hardware, but it usually will not activate the VM.
+
 You can change the resource allocation later by editing `~/.config/windows/docker-compose.yml`, which is also where you'd mount a USB device. See all the options on [the Dockur Windows project](https://github.com/dockur/windows).
 
 To get rid of the whole thing, use _Remove > Windows_ from the Omarchy menu. That deletes the VM's disk and all its data, so make sure anything you care about is out of `~/Windows` first.
diff --git a/test/shell.d/windows-key-test.sh b/test/shell.d/windows-key-test.sh
new file mode 100755
index 00000000..01f7d1f1
--- /dev/null
+++ b/test/shell.d/windows-key-test.sh
@@ -0,0 +1,65 @@
+#!/bin/bash
+
+set -euo pipefail
+
+source "$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)/base-test.sh"
+
+command="$ROOT/bin/omarchy-windows-key"
+tmp=$(mktemp -d)
+trap 'rm -rf "$tmp"' EXIT
+
+rg -q '/sys/firmware/acpi/tables/MSDM' "$command" ||
+  fail "windows key helper reads the ACPI MSDM table"
+pass "windows key helper reads the ACPI MSDM table"
+
+rg -q 'read_msdm strings' "$command" ||
+  fail "windows key helper tries strings first"
+pass "windows key helper tries strings first"
+
+rg -q 'read_msdm cat' "$command" ||
+  fail "windows key helper falls back to cat"
+pass "windows key helper falls back to cat"
+
+write_msdm() {
+  local path=$1
+  local payload=$2
+
+  python3 -c 'import pathlib, sys
+pathlib.Path(sys.argv[1]).write_bytes(b"MSDM" + b"\x00" * 52 + sys.argv[2].encode())
+' "$path" "$payload"
+}
+
+run_helper() {
+  OMARCHY_MSDM_PATH=$1 PATH="$ROOT/bin:$PATH" "$command"
+}
+
+key="XXXXX-XXXXX-XXXXX-XXXXX-XXXXX"
+write_msdm "$tmp/msdm" "$key"
+output=$(run_helper "$tmp/msdm")
+[[ $output == "$key" ]] || fail "windows key helper prints the firmware key" "actual: $output"
+pass "windows key helper prints the firmware key"
+
+mkdir -p "$tmp/bin"
+cat >"$tmp/bin/strings" <<'EOF'
+#!/bin/bash
+exit 0
+EOF
+chmod +x "$tmp/bin/strings"
+output=$(PATH="$tmp/bin:$ROOT/bin:$PATH" OMARCHY_MSDM_PATH="$tmp/msdm" "$command")
+[[ $output == "$key" ]] || fail "windows key helper falls back to cat when strings finds nothing" "actual: $output"
+pass "windows key helper falls back to cat when strings finds nothing"
+
+write_msdm "$tmp/empty" "no-product-key-here"
+if OMARCHY_MSDM_PATH="$tmp/empty" PATH="$ROOT/bin:$PATH" "$command" >"$tmp/out" 2>"$tmp/err"; then
+  fail "windows key helper fails when the table has no key"
+fi
+[[ $(<"$tmp/err") == "Firmware license table found, but no Windows product key could be extracted." ]] ||
+  fail "windows key helper reports a missing key" "actual: $(<"$tmp/err")"
+pass "windows key helper reports a missing key"
+
+if OMARCHY_MSDM_PATH="$tmp/missing" PATH="$ROOT/bin:$PATH" "$command" >"$tmp/out" 2>"$tmp/err"; then
+  fail "windows key helper fails when firmware has no MSDM table"
+fi
+[[ $(<"$tmp/err") == "No Windows license key found in firmware." ]] ||
+  fail "windows key helper reports missing firmware table" "actual: $(<"$tmp/err")"
+pass "windows key helper reports missing firmware table"