Introduction
This article will demonstrate how to change the drive's serial number on three different file systems: FAT, FAT32 and NTFS. The article's source code files come with a home made DiskSector read/write class for WinNt/2k/XP and Win9x system. The article also comes with a handy dialog based application that allows you change the serial number visually.
How it works
Usually, the serial number of a drive is generated every time you format your hard drive and there is no documented way to change it afterwards.
It is worthwhile noting that the serial number returned by the "dir" command or the GetVolumeInformation()
API is not the hardware serial number that comes from the manufacturer, instead this serial number is assigned and stored in the hard drive (mostly in the boot sector) by the file system and *can* be changed by software.
Knowing that the serial number is stored in the hard drive, I started looking up information about the three different file systems: FAT, FAT32, NTFS. The most relevant part to look at was the boot sector format of each of the different file systems. Usually, the bootsector holds vital data for the integrity and the operation of the file system.
Among these fields, we list this table with the fields names, file system and the corresponding offset (in hex) of the field in the boot sector:
Table 1
Field/FS | FAT | FAT32 | NTFS |
Volume Label | 0x2B | 0x47 | ? |
File system ID | 0x36 | 0x52 | 0x3 |
Serial number | 0x27 | 0x43 | 0x48 |
For example, we can read an entry of this table as: "In the FAT file system, the 'Serial Number' is stored at offset 0x27 starting from the boot sector origin". It is important to know that the boot sector starts at sector zero and is 512 bytes long. The next part will explain how the ChangeSerialNumber()
function can be written.
Explaining the code
First, I will explain the code flow:
- Open the hard drive device in order to read/write sectors.
- Read the boot sector
- Identify the file system of the drive in question
- Modify the serial number field according to the current file system (refer to table 1)
- Write back the modified boot sector
- Close the hard drive device
void CVolumeSerialDlg::ChangeSerialNumber(DWORD Drive, const DWORD newSerial)
{
const max_pbsi = 3;
struct partial_boot_sector_info
{
LPSTR Fs;
DWORD FsOffs;
DWORD SerialOffs;
};
partial_boot_sector_info pbsi[max_pbsi] =
{
{"FAT32", 0x52, 0x43},
{"FAT", 0x36, 0x27},
{"NTFS", 0x03, 0x48}
};
TCHAR szDrive[12];
char Sector[512];
DWORD i;
sprintf(szDrive, "%c:\\", Drive & 0xFF);
if (!disk.Open(szDrive))
{
ShowErrorString("Could not open disk!");
return;
}
if (!disk.ReadSector(0, Sector))
{
ShowErrorString("Could not read sector!");
return;
}
for (i=0;i<max_pbsi;i++)
{
if (strncmp(pbsi[i].Fs, Sector+pbsi[i].FsOffs, strlen(pbsi[i].Fs)) == 0)
{
break;
}
}
if (i >= max_pbsi)
{
MessageBox(_T("Cannot change serial number of this file system!"),
_T("Error"), MB_ICONERROR);
return;
}
*(PDWORD)(Sector+pbsi[i].SerialOffs) = newSerial;
if (!disk.WriteSector(0, Sector))
{
ShowErrorString("Could not write sector!");
return;
}
ShowErrorString("Volume serial number changed successfully!\r"
"You might want to restart your system for changes to take effect!");
}
The core of this function is the 'partial_boot_sector_info/pbsi' table which is built from Table 1. This table will allow us to check what file system this boot sector belongs to and then it allows us to correctly patch the serial number field. It appears that if you change the serial number of an NTFS volume, changes won't take effect until you restart your system.
Also note that changing the partition's serial number will render some licensed programs useless, therefore write down the original serial number before attempting to changing it, just in case you wanted to restore it back.
Reference
Updates
- v1.0
- Initial version: only WinNT support
- v1.2
- Win9x and WinNT support added
- Documented updated
Elias (aka lallousx86, @0xeb) has always been interested in the making of things and their inner workings.
His computer interests include system programming, reverse engineering, writing libraries, tutorials and articles.
In his free time, and apart from researching, his favorite reading topics include: dreams, metaphysics, philosophy, psychology and any other human/mystical science.
Former employee of Microsoft and Hex-Rays (the creators of IDA Pro), was responsible about many debugger plugins, IDAPython project ownership and what not.
Elias currently works as an Anticheat engineer in Blizzard Entertainment.
Elias co-authored 2 books and authored one book:
- Practical Reverse Engineering
- The Antivirus Hacker's Handbook
- The Art of Batch Files Programming