Matching an OEM certificate (*.xrm-ms) with a SLIC 2.x table

Here I write how to verify a Windows OEM certificate (*.xrm-ms) against the SLIC 2.x signature embedded in the BIOS ACPI table. Part of the information herein is taken from this thread in My Digital Life forums. If your BIOS has embedded SLIC 2.x signature in its ACPI table, view it with SLIC Dump ToolKit.






Open your OEM certificate (*.xrm-ms) in your favorite text editor, for example, WordPad. Otherwise, double-click on the OEM certificate and it will be displayed in Internet Explorer.






Find the line that contains a long string beginning with kgAAAAAAA. Highlight the part from kgAAAAAAA to the next equal sign =. Copy the highlighted section.
Find a way to convert the string from a Base 64 format to a binary format. I used an online base64 convertor at motobit.com which provides a way to save to a binary file. You can search Yahoo! using the search keywords “base64 binary converter” to find some useful online base64 converters.



Open the resulting binary file in a Hex editor, for example, XVI32. Compare the SLIC content (in SLIC dump toolkit) with the binary OEM certificate (in XVI32).






To learn how to compare the SLIC data with OEM certificate, read this forum thread.

Sample OEM Certificate / SLIC Matching

BLUE - OEM ID

RED - RSA module

ORANGE - RSA public exponent

Always: 01 00 01 00

GREEN - Windows marker version

Always: 00 00 20 00

PURPLE - Size of the OEM Certificate's licensing data

Always: 92 00 00 00 (146 bytes)