Developer knowledge network · moderated exchange

UnreliableCode 커뮤니티

개발자 연구, 리버스 엔지니어링 및 코딩 커뮤니티

Knowledge index살다
4Categories
919Threads
2.8K게시물
Guide

Handling IRP completion routines in Storage Filter Drivers for serial spoofing

kernel_komrade
Driver Dev
MEMBER
대표: 145
가입 날짜: Feb 2019
게시물: 26
감사해요: 45
1개월 전 · Jul 15, 2026 9:10 PM
#1

To spoof hard drive SMART serial numbers at the kernel level:

  1. Attach a filter driver to \Driver\Disk or \Driver\Storport.
  2. Intercept IRP_MJ_DEVICE_CONTROL requests where IoControlCode == IOCTL_STORAGE_QUERY_PROPERTY.
  3. Set an IoCompletionRoutine and pass the IRP down the driver stack.
  4. In the completion routine, when the disk controller fills the STORAGE_DEVICE_DESCRIPTOR buffer, scramble the SerialNumberOffset string with randomized alphanumeric bytes before returning to userland!
dma_ghost
DMA Guru
MEMBER
대표: 115
가입 날짜: Jan 2020
게시물: 12
감사해요: 83
1개월 전 · Jul 16, 2026 1:35 AM
#2

Disk filter driver completion routine is the cleanest way to spoof disk serials across all Windows versions.

val_driver_guy
Driver Dev
MEMBER
대표: 42
가입 날짜: May 2019
게시물: 24
감사해요: 37
1개월 전 · Jul 16, 2026 11:32 AM
#3

Completely changes what wmic diskdrive get serialnumber returns.