Developer knowledge network ยท moderated exchange

Komunitas Kode Tidak Dapat Diandalkan

Riset Pengembang, Rekayasa Terbalik & Komunitas Pengkodean

Knowledge indexHidup
4Categories
919Threads
2.8KPostingan
Guide

Handling IRP completion routines in Storage Filter Drivers for serial spoofing [v2.4 Technical Discussion]

kernel_komrade
Driver Dev
MEMBER
Reputasi: 145
Tanggal Bergabung: Feb 2019
Postingan: 26
Terima kasih: 45
1 bulan yang lalu ยท Jul 12, 2026 12:48 AM
#1

To spoof hard drive SMART serial numbers at the kernel level:

  1. Attach a filter driver to \Driver\Disk or \Driver\Storport.
  2. Intercept IRP_MJ_DEVICE_CONTROL requests where IoControlCode == IOCTL_STORAGE_QUERY_PROPERTY.
  3. Set an IoCompletionRoutine and pass the IRP down the driver stack.
  4. In the completion routine, when the disk controller fills the STORAGE_DEVICE_DESCRIPTOR buffer, scramble the SerialNumberOffset string with randomized alphanumeric bytes before returning to userland!
dma_ghost
DMA Guru
MEMBER
Reputasi: 115
Tanggal Bergabung: Jan 2020
Postingan: 12
Terima kasih: 83
1 bulan yang lalu ยท Jul 12, 2026 6:35 AM
#2

Disk filter driver completion routine is the cleanest way to spoof disk serials across all Windows versions.

val_driver_guy
Driver Dev
MEMBER
Reputasi: 42
Tanggal Bergabung: May 2019
Postingan: 24
Terima kasih: 37
1 bulan yang lalu ยท Jul 12, 2026 11:09 PM
#3

Completely changes what wmic diskdrive get serialnumber returns.