This page documents the Ohook activation method, which provides permanent Office activation through DLL hook injection. Ohook targets the Office Software Protection Platform (OSPP) by intercepting licensing verification calls with a custom hook library.
Scope: This page covers Office activation only. For Windows activation, see page 2.1 (HWID Activation) or page 2.4 (TSforge Activation). For combined Windows and Office activation with periodic renewal, see page 2.3 (Online KMS Activation).
Ohook is a permanent activation method specifically designed for Microsoft Office products. Unlike KMS-based methods that require 180-day renewal cycles, Ohook provides a one-time activation that persists indefinitely. The method works by injecting a custom sppc.dll library that intercepts Office licensing verification calls and returns successful activation status.
| Characteristic | Value |
|---|---|
| Target Products | Microsoft Office 2010–2024 and Microsoft 365 Apps |
| Activation Type | Permanent (no renewal required) |
| Technique | VFS DLL replacement + symlink (sppc.dll / OSPPC.DLL) |
| Supported Deployments | MSI (Office 2010–2016), Click-to-Run C2R (Office 2013–2024, M365) |
| Internet Required | No |
| Reactivation After Updates | Not required (persistent) |
Sources: MAS/All-In-One-Version-KL/MAS_AIO.cmd437-446 MAS/Separate-Files-Version/Activators/Ohook_Activation_AIO.cmd510-576
The following diagram maps the main activation subroutines in Ohook_Activation_AIO.cmd to the steps they perform.
Diagram: Ohook_Activation_AIO.cmd — Main Activation Flow
Sources: MAS/Separate-Files-Version/Activators/Ohook_Activation_AIO.cmd617-790
The custom hook DLL intercepts licensing verification calls by replacing the DLL that Office loads. There are two distinct paths depending on the install type and Windows version.
Diagram: oh_hookinstall vs oh_hookinstall_ospp — Code Paths
Sources: MAS/Separate-Files-Version/Activators/Ohook_Activation_AIO.cmd1125-1305
When Office loads sppc.dll from its VFS directory, it loads the custom hook. The custom hook can delegate real calls to sppcs.dll (the genuine system sppc.dll), while returning successful activation status for licensing checks.
For MSI installs on Windows 7 (or Office 2010 MSI on any Windows), osppsvc loads OSPPC.DLL directly from %CommonProgramFiles%\Microsoft Shared\OfficeSoftwareProtectionPlatform\. The same replacement approach is used there.
Ohook supports the following Office installs, detected by the oh_getpath subroutine via registry and file-system checks:
| Variable | Registry Path Checked | Office Version | Install Type |
|---|---|---|---|
o16c2r | HKLM\SOFTWARE\Microsoft\Office\ClickToRun | 2016, 2019, 2021, 2024, M365 | Click-to-Run |
o15c2r | HKLM\SOFTWARE\Microsoft\Office\15.0\ClickToRun | 2013 | Click-to-Run |
o16msi | HKLM\SOFTWARE\Microsoft\Office\16.0\Common\InstallRoot | 2016 | MSI |
o15msi | HKLM\SOFTWARE\Microsoft\Office\15.0\Common\InstallRoot | 2013 | MSI |
o14msi | HKLM\SOFTWARE\Microsoft\Office\14.0\Common\InstallRoot | 2010 | MSI |
Both 32-bit (Wow6432Node) and 64-bit registry paths are checked for each.
Unsupported installs (detected and reported, but Ohook cannot activate them):
| Condition | Variable | Redirect |
|---|---|---|
| Office 2010 Click-to-Run | o14c2r | Unsupported |
| Office UWP (Windows Store) | o16uwp | Use TSforge (page 2.4) |
Sources: MAS/Separate-Files-Version/Activators/Ohook_Activation_AIO.cmd955-973 MAS/Separate-Files-Version/Activators/Ohook_Activation_AIO.cmd515-527
The script determines Ohook availability based on Windows version and configuration:
Diagram: Ohook Availability Decision Tree
Sources: MAS/All-In-One-Version-KL/MAS_AIO.cmd437-446
Microsoft 365 (O365) Exception: Even on otherwise restricted Windows editions (Server, Evaluation, LTSC), Ohook availability is re-enabled if Microsoft 365 Apps are detected. Both 32-bit and 64-bit registry paths are checked:
HKLM\SOFTWARE\Microsoft\Office\ClickToRun\Configuration /v ProductReleaseIds containing "O365"HKLM\SOFTWARE\Wow6432Node\Microsoft\Office\ClickToRun\Configuration /v ProductReleaseIds containing "O365"Sources: MAS/All-In-One-Version-KL/MAS_AIO.cmd442-444
On Windows 11 22H2+ (build ≥ 22621), the script checks the VerifiedAndReputablePolicyState registry value. If Smart App Control is enabled (0x1) or in evaluation mode (0x2), a warning is shown because it may block the custom sppc.dll from loading.
Sources: MAS/Separate-Files-Version/Activators/Ohook_Activation_AIO.cmd596-611
oh_setspp)Before any WMI licensing queries, the oh_setspp subroutine sets the spp and sps variables to control which WMI namespace is used:
| Condition | spp (product class) | sps (service class) | isOspp |
|---|---|---|---|
| Windows 8+ (build ≥ 9200), Office 15/16 | SoftwareLicensingProduct | SoftwareLicensingService | not set |
| Windows 7 or earlier (build < 9200) | OfficeSoftwareProtectionProduct | OfficeSoftwareProtectionService | 1 |
| Office 14.0 MSI (any Windows) | OfficeSoftwareProtectionProduct | OfficeSoftwareProtectionService | 1 |
When isOspp is set, the oh_hookinstall_ospp path is used for hook deployment instead of oh_hookinstall.
Sources: MAS/Separate-Files-Version/Activators/Ohook_Activation_AIO.cmd1309-1325
| Component | Role |
|---|---|
osppsvc | Office Software Protection service (Windows 7 and Office 2010) |
sppsvc | Windows Software Protection service (Windows 8+, handles all licensing) |
SoftwareLicensingProduct | WMI class for Office license queries (Windows 8+) |
OfficeSoftwareProtectionProduct | WMI class for Office license queries (Windows 7 / Office 14) |
OSPPC.DLL | Office SPP client DLL, replaced by hook on MSI installs with OSPP |
sppc.dll | Windows SPP client DLL, replaced by hook on C2R installs |
Sources: MAS/Separate-Files-Version/Activators/Ohook_Activation_AIO.cmd1309-1325 MAS/Separate-Files-Version/Activators/Ohook_Activation_AIO.cmd999-1039
Every Office product installed on the system has one or more activation IDs (product SKU GUIDs) registered in the Software Protection Platform. Ohook must install the correct product key and license file for each.
Two application ID GUIDs partition Office products in the SPP database:
| Application ID | Office Version |
|---|---|
0ff1ce15-a989-479d-af46-f275c6370663 | Office 15.0 and 16.0 (2013–2024, M365) |
59a52881-a989-479d-af46-f275c6370663 | Office 14.0 (2010) |
For each detected install, oh_process iterates through product IDs in _oIds. For each:
ohookdata getinfo <_prod> retrieves the embedded product key (key), activation ID (_actid), and license name (_lic) from a data table in the script.dk_actids 0ff1ce15-a989-479d-af46-f275c6370663 queries SoftwareLicensingProduct for all registered activation IDs. If _actid is not yet registered, oh_installlic installs the matching .xrm-ms license files from the Office license directory (_oLPath).dk_inskey calls SoftwareLicensingService.InstallProductKey to install the product key.Sources: MAS/Separate-Files-Version/Activators/Ohook_Activation_AIO.cmd1329-1370 MAS/Separate-Files-Version/Activators/Ohook_Activation_AIO.cmd1073-1121
Two sets of registry entries are written to suppress activation-related notifications.
Applied when volume products are detected (_oIds contains "Volume"):
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\0ff1ce15-a989-479d-af46-f275c6370663KeyManagementServiceName = 10.0.0.10/reg:32 (32-bit) registry views.This prevents the "Office license is not genuine" banner, which can appear when a Volume product key is installed but no KMS server is configured.
Sources: MAS/Separate-Files-Version/Activators/Ohook_Activation_AIO.cmd744-756
Applied for Office 16.0 C2R installs:
HKU\{SID}\Software\Microsoft\Office\16.0\Common\Licensing\ResiliencyTimeOfLastHeartbeatFailure = 2040-01-01T00:00:00ZThis prevents retail Office 16.0 products from displaying a "There was a problem checking this device's license status" banner by making Office believe its last heartbeat check occurred far in the future.
Sources: MAS/Separate-Files-Version/Activators/Ohook_Activation_AIO.cmd1566-1583
oh_clearblock)Before writing the above keys, oh_clearblock removes existing license tokens that would override Ohook activation:
| What is removed | Location |
|---|---|
| vNext / user license tokens | %ProgramData%\Microsoft\Office\Licenses\ |
| User license cache | %AppData%\Local\Microsoft\Office\Licenses\ |
| User licensing registry | HKU\{SID}\Software\Microsoft\Office\{15,16}.0\Common\Licensing |
| Shared computer licensing value | HKLM\...\Office\ClickToRun\Configuration\SharedComputerLicensing |
| Device-based licensing values | HKLM\...\Office\ClickToRun\Configuration\*.DeviceBasedLicensing |
| OEM registry key | HKLM\SOFTWARE\Microsoft\Office\{15,16}.0\Common\OEM |
Sources: MAS/Separate-Files-Version/Activators/Ohook_Activation_AIO.cmd1432-1593
When executed from the All-in-One menu, option [2] calls OhookActivation (in MAS_AIO.cmd) or goes to oh_menu → oh_menu2 (in Ohook_Activation_AIO.cmd).
The _ohookgo flag controls whether the menu option is highlighted green (recommended) or shown in plain white. It is set based on Windows edition checks at MAS/All-In-One-Version-KL/MAS_AIO.cmd437-446
Unattended execution via:
MAS_AIO.cmd /Ohook
MAS_AIO.cmd /Ohook /S
Ohook_Activation_AIO.cmd /Ohook
Ohook_Activation_AIO.cmd /Ohook-Uninstall
| Parameter | Effect |
|---|---|
/Ohook | Sets _act=1, runs install in unattended mode |
/Ohook-Uninstall | Sets _rem=1, jumps to oh_uninstall |
/S | Sets _silent=%nul%, suppresses output |
Sources: MAS/All-In-One-Version-KL/MAS_AIO.cmd390-396 MAS/Separate-Files-Version/Activators/Ohook_Activation_AIO.cmd152-160
The oh_uninstall subroutine reverses all changes made during activation.
For C2R installs, sppc*.dll files are deleted from:
{o16c2r_root}\vfs\System\{o16c2r_root}\vfs\SystemX86\{o15c2r_root}\vfs\System\{o15c2r_root}\vfs\SystemX86\For MSI installs, sppc*.dll files are deleted from the Office install root directories (Office14, Office15, Office16).
For OSPP installs (Office 14 MSI / Windows 7): small-size OSPPC.DLL or sppcs.dll files at the OSPP platform path are deleted, and any sppcs.dll that is ≥ 100,000 bytes is renamed back to OSPPC.DLL.
Files that cannot be deleted (because Office is running) are moved to %TEMP%\needsToBeDeleted{random} as a fallback. If that also fails, _unerror is set and the user is prompted to close Office apps and retry or reboot.
HKU\{SID}\Software\Microsoft\Office\16.0\Common\Licensing\Resiliency from all user hives (including loaded NTUSER.DAT files).HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\0ff1ce15-a989-479d-af46-f275c6370663 (both native and /reg:32 views).Sources: MAS/Separate-Files-Version/Activators/Ohook_Activation_AIO.cmd792-923
Ohook can be packaged for automated deployment during Windows installation using the $OEM$ folder structure. This is managed through the Extract $OEM$ Folder utility.
From the Extract $OEM$ menu, Ohook appears in these combinations:
| Menu Option | Components | Parameters | Use Case |
|---|---|---|---|
| [2] | Ohook only | /Ohook | Office-only activation |
| [5] | HWID + Ohook | /HWID /Ohook | Windows + Office activation |
| [6] | HWID + Ohook + TSforge ESU | /HWID /Ohook /Z-ESU | Windows + Office + ESU |
| [7] | TSforge + Ohook | /Z-Windows /Z-ESU /Ohook | Windows (TSforge) + Office |
Sources: MAS/All-In-One-Version-KL/MAS_AIO.cmd577 MAS/All-In-One-Version-KL/MAS_AIO.cmd581-583
When extracted, the package creates:
Desktop\
└── $OEM$\
└── $$\
└── Setup\
└── Scripts\
├── MAS_AIO.cmd (with random GUID prefix)
└── SetupComplete.cmd (calls MAS with /Ohook parameter)
The SetupComplete.cmd script automatically executes during Windows setup's final phase:
Sources: MAS/All-In-One-Version-KL/MAS_AIO.cmd615-621
Diagram: Activation Method Product Coverage Comparison
| Requirement | Recommended Method | Reason |
|---|---|---|
| Office activation only | Ohook | Permanent, no renewal, no internet |
| Windows activation only | HWID (page 2.1) | Digital license tied to hardware |
| Both Windows + Office | Online KMS (page 2.3) or TSforge (page 2.4) | Multiple products supported |
| Office on Server/Eval/LTSC without O365 | TSforge (page 2.4) | Ohook unavailable on these editions |
| Office with Microsoft 365 Apps | Ohook | Works even on restricted editions |
| Office 2010 C2R or Office UWP | TSforge (page 2.4) | These are unsupported by Ohook |
| Deployment automation | Ohook (via $OEM$) | Set-and-forget permanent activation |
Sources: MAS/All-In-One-Version-KL/MAS_AIO.cmd437-446 MAS/Separate-Files-Version/Activators/Ohook_Activation_AIO.cmd515-527
If Ohook appears in white (not highlighted green) or activation fails:
Diagnostic Steps:
Check Windows Version Compatibility
Check Edition Restrictions
Check for Microsoft 365 Apps (may override restrictions)
Sources: MAS/All-In-One-Version-KL/MAS_AIO.cmd427-429 MAS/All-In-One-Version-KL/MAS_AIO.cmd437-446
If the script cannot detect installed Office:
Verify Office Installation
HKLM\SOFTWARE\Microsoft\Office\ClickToRun\ConfigurationHKLM\SOFTWARE\Microsoft\OfficeRun Activation Status Check
Check Office Software Protection Service
Should show RUNNING or be startable
For broader issues affecting Office activation:
Use Troubleshoot Utility - Main menu option [8]
Check System Requirements - See System Requirements
Review Error Checking - See Error Handling and Diagnostics
dk_errorcheck routine validates system health before activationSources: MAS/All-In-One-Version-KL/MAS_AIO.cmd496-499 Referenced in high-level diagnostics architecture
✓ Recommended for:
✗ Not recommended for:
For enterprise or automated deployment:
Sources: MAS/All-In-One-Version-KL/MAS_AIO.cmd548-641
Document Version: Aligned with MAS version 3.9
Last Technical Reference: MAS/All-In-One-Version-KL/MAS_AIO.cmd1-2
Refresh this wiki
This wiki was recently refreshed. Please wait 4 days to refresh again.