Developer knowledge network · moderated exchange

مجتمع الكود غير الموثوق به

أبحاث المطورين، مجتمع الهندسة العكسية والترميز

Knowledge indexيعيش
4Categories
919Threads
2.8Kدعامات
Guide

Handling IRP completion routines in Storage Filter Drivers for serial spoofing

kernel_komrade
Driver Dev
MEMBER
مندوب: 145
تاريخ الانضمام: Feb 2019
دعامات: 26
شكرًا: 45
1 months ago · Jul 15, 2026 9:10 PM
#1

To spoof hard drive SMART serial numbers at the kernel level:

  1. Attach a filter driver to \Driver\Disk or \Driver\Storport.
  2. Intercept IRP_MJ_DEVICE_CONTROL requests where IoControlCode == IOCTL_STORAGE_QUERY_PROPERTY.
  3. Set an IoCompletionRoutine and pass the IRP down the driver stack.
  4. In the completion routine, when the disk controller fills the STORAGE_DEVICE_DESCRIPTOR buffer, scramble the SerialNumberOffset string with randomized alphanumeric bytes before returning to userland!
dma_ghost
DMA Guru
MEMBER
مندوب: 115
تاريخ الانضمام: Jan 2020
دعامات: 12
شكرًا: 83
1 months ago · Jul 16, 2026 1:35 AM
#2

Disk filter driver completion routine is the cleanest way to spoof disk serials across all Windows versions.

val_driver_guy
Driver Dev
MEMBER
مندوب: 42
تاريخ الانضمام: May 2019
دعامات: 24
شكرًا: 37
1 months ago · Jul 16, 2026 11:32 AM
#3

Completely changes what wmic diskdrive get serialnumber returns.