Get Physical HDD Serial Number without WMI

If you just need a HD serial for registration binding, this is a simpler and more reliable solution.

DWORD nSN;
char szSN[256];

if (!GetVolumeInformation(GetCurrentDrive(), NULL, 0, &nSN, NULL, NULL, NULL, 0))
    strcpy(szSN, "Cannot Find Serial Number");
else
    _snprintf ( szSN, sizeof(szSN)-1, "%lX", nSN );

    // szSN now holds text version of your hard drive serial #

The ONLY limitation is that it will not work on network drives under WIN95/98/ME -- However, these OS's are largely obsolete, particularly on existing networks. It will detect SN on these OS's on stand-alone PCs.

To use simply link to kernel32.lib and #include <windows.h> (If developing in MFC no need to add #include as windows.h is included by default.)

This is true... but not by the average user. If you are concerned about hacker/reverse engineering, then your solution is no more secure. Any licensing scheme can be cracked by a hacker of moderate ability if it isn't combined with code encryption.

My personal solution is to use ExeCryptor which has hardware ID detection built in, and encrypts the executable code behind the licensing scheme.

It doesn't matter what you are binding your license to... The hacker could use your publicly available code here to write a keygen program, or he could modify the executable to simply bypass registration altogether.

I'm not taking away from your code. It's very well done -- and may be useful as a basis for disk utilities, system information apps, etc... But as a basis for protecting intellectual properties via software licensing, it's no more secure than binding to a pseudo-serial.

That was my only point. But, I meant no offense. I appreciate your hard work, and I appreciate you sharing your code. It still may be useful for other purposes.

I understand that.. but it doesn't matter. You stated that this article solved a need for a "schema to protect their work" (presumably software licensing).

The "immutable" diskID doesn't make your software any more difficult to crack. The cracker isn't going to worry about changing the diskID... he's going to modify your code to read the same diskID on all systems. At some point your code returns the unencrypted value. Once the cracker gets that, he modifies your code to always arbitrarily return that value. Now, his valid license will validate correctly on any system in the world. Or worse, he could use your very class to write a keygen program mass producing illegal licenses at will.

If you are just trying to discourage illegal distribution by casual users, the system ID bound with other data is sufficient. If you are protecting against reverse engineering (crackers), both schemes are useless if the actual code that generates/validates the licenses can be deciphered and reproduced.. You need executable encryption in both static and runtime states, further protected by server-side validation (because the hacker cannot trace or disassemble server code).

The moral is that it really doesn't matter what data you use to generate the licenses... it only matters whether this method can be figured out and reproduced. And if your executable code isn't encrypted, and otherwise made inaccessible to analysis, it can be easily cracked. Whether it will be is only determined by how popular your software is.

mvendert wrote:

And the harddisk serial will survive a format/reinstall of the os. (When using this for licensing, this will result in the 'old' license still being valid on the newly installed os.)