Click here to Skip to main content
15,868,014 members
Articles / Programming Languages / C++
Article

Changing volume's serial number

Rate me:
Please Sign up or sign in to vote.
4.87/5 (75 votes)
4 Mar 20043 min read 694.8K   23.5K   123   102
An article showing how to change drive's serial number

Introduction

This article will demonstrate how to change the drive's serial number on three different file systems: FAT, FAT32 and NTFS. The article's source code files come with a home made DiskSector read/write class for WinNt/2k/XP and Win9x system. The article also comes with a handy dialog based application that allows you change the serial number visually.

How it works

Usually, the serial number of a drive is generated every time you format your hard drive and there is no documented way to change it afterwards.

It is worthwhile noting that the serial number returned by the "dir" command or the GetVolumeInformation() API is not the hardware serial number that comes from the manufacturer, instead this serial number is assigned and stored in the hard drive (mostly in the boot sector) by the file system and *can* be changed by software.

Knowing that the serial number is stored in the hard drive, I started looking up information about the three different file systems: FAT, FAT32, NTFS. The most relevant part to look at was the boot sector format of each of the different file systems. Usually, the bootsector holds vital data for the integrity and the operation of the file system.

Among these fields, we list this table with the fields names, file system and the corresponding offset (in hex) of the field in the boot sector:

Table 1

Field/FSFATFAT32NTFS
Volume Label 0x2B0x47?
File system ID0x360x520x3
Serial number0x270x430x48

For example, we can read an entry of this table as: "In the FAT file system, the 'Serial Number' is stored at offset 0x27 starting from the boot sector origin". It is important to know that the boot sector starts at sector zero and is 512 bytes long. The next part will explain how the ChangeSerialNumber() function can be written.

Explaining the code

First, I will explain the code flow:

  1. Open the hard drive device in order to read/write sectors.
  2. Read the boot sector
  3. Identify the file system of the drive in question
  4. Modify the serial number field according to the current file system (refer to table 1)
  5. Write back the modified boot sector
  6. Close the hard drive device
void CVolumeSerialDlg::ChangeSerialNumber(DWORD Drive, const DWORD newSerial)
{
  const max_pbsi = 3;

  struct partial_boot_sector_info
  {
    LPSTR Fs; // file system name
    DWORD FsOffs; // offset of file system name in the boot sector
    DWORD SerialOffs; // offset of the serialnumber in the boot sector
  };

  partial_boot_sector_info pbsi[max_pbsi] =
  {
   {"FAT32", 0x52, 0x43},
   {"FAT",   0x36, 0x27},
   {"NTFS",  0x03, 0x48}
  };

  TCHAR szDrive[12];

  char Sector[512];

  DWORD i;

  sprintf(szDrive, "%c:\\", Drive & 0xFF);

  if (!disk.Open(szDrive))
  {
    ShowErrorString("Could not open disk!");
    return;
  }

  // read sector
  if (!disk.ReadSector(0, Sector))
  {
    ShowErrorString("Could not read sector!");
    return;
  }

  // try to search for a valid boot sector
  for (i=0;i<max_pbsi;i++)
  {
    if (strncmp(pbsi[i].Fs, Sector+pbsi[i].FsOffs, strlen(pbsi[i].Fs)) == 0)
    {
      // we found a valid signature
      break;
    }
  }

  if (i >= max_pbsi)
  {
    MessageBox(_T("Cannot change serial number of this file system!"),
       _T("Error"), MB_ICONERROR);
    return;
  }
  
  // patch serial number
  *(PDWORD)(Sector+pbsi[i].SerialOffs) = newSerial;

  // write boot sector
  if (!disk.WriteSector(0, Sector))
  {
    ShowErrorString("Could not write sector!");
    return;
  }

  ShowErrorString("Volume serial number changed successfully!\r"
        "You might want to restart your system for changes to take effect!");
}

The core of this function is the 'partial_boot_sector_info/pbsi' table which is built from Table 1. This table will allow us to check what file system this boot sector belongs to and then it allows us to correctly patch the serial number field. It appears that if you change the serial number of an NTFS volume, changes won't take effect until you restart your system.

Also note that changing the partition's serial number will render some licensed programs useless, therefore write down the original serial number before attempting to changing it, just in case you wanted to restore it back.

Reference

Updates

  • v1.0
    • Initial version: only WinNT support
  • v1.2
    • Win9x and WinNT support added
    • Documented updated

License

This article has no explicit license attached to it but may contain usage terms in the article text or the download files themselves. If in doubt please contact the author via the discussion board below.

A list of licenses authors might use can be found here


Written By
Web Developer
United States United States
Elias (aka lallousx86, @0xeb) has always been interested in the making of things and their inner workings.

His computer interests include system programming, reverse engineering, writing libraries, tutorials and articles.

In his free time, and apart from researching, his favorite reading topics include: dreams, metaphysics, philosophy, psychology and any other human/mystical science.

Former employee of Microsoft and Hex-Rays (the creators of IDA Pro), was responsible about many debugger plugins, IDAPython project ownership and what not.

Elias currently works as an Anticheat engineer in Blizzard Entertainment.

Elias co-authored 2 books and authored one book:

- Practical Reverse Engineering
- The Antivirus Hacker's Handbook
- The Art of Batch Files Programming

Comments and Discussions

 
GeneralRe: HDD Manufacturer Serial Number Pin
Anonymous5-Mar-04 2:18
Anonymous5-Mar-04 2:18 
GeneralTitle Pin
leppie12-Jan-04 8:20
leppie12-Jan-04 8:20 
GeneralRe: Title Pin
JoeSox12-Jan-04 11:03
JoeSox12-Jan-04 11:03 
GeneralReboot required for NTFS because... Pin
Andrew Allen12-Jan-04 6:49
Andrew Allen12-Jan-04 6:49 
GeneralHere's why Pin
KevinHall12-Jan-04 5:17
KevinHall12-Jan-04 5:17 
GeneralRe: Here's why Pin
John M. Drescher12-Jan-04 6:08
John M. Drescher12-Jan-04 6:08 
GeneralRe: Here's why Pin
KevinHall12-Jan-04 6:13
KevinHall12-Jan-04 6:13 
GeneralRe: Here's why Pin
Codlia20-Jan-04 21:42
Codlia20-Jan-04 21:42 
Or more likely, the manufacturer declares the software's "product lifecycle" has ended and declares "Support has been retired".


GeneralRe: Here's why Pin
AlinuS12311-Oct-11 0:07
AlinuS12311-Oct-11 0:07 
QuestionGood article, but why? Pin
Gerard Nicol12-Jan-04 4:17
Gerard Nicol12-Jan-04 4:17 
AnswerRe: Good article, but why? Pin
Ed Preston13-Jan-04 2:36
Ed Preston13-Jan-04 2:36 
GeneralRe: Good article, but why? Pin
Gerard Nicol13-Jan-04 11:03
Gerard Nicol13-Jan-04 11:03 
GeneralRe: Good article, but why? Pin
bryce13-Jan-04 15:22
bryce13-Jan-04 15:22 
AnswerRe: Good article, but why? Pin
Elias Bachaalany13-Jan-04 20:46
Elias Bachaalany13-Jan-04 20:46 

General General    News News    Suggestion Suggestion    Question Question    Bug Bug    Answer Answer    Joke Joke    Praise Praise    Rant Rant    Admin Admin   

Use Ctrl+Left/Right to switch messages, Ctrl+Up/Down to switch threads, Ctrl+Shift+Left/Right to switch pages.