top of page
Search
kirollik5saliy

Volume Serial Number Editor 29: A Simple and Fast Solution for Modifying Your Volume ID



HIV Surveillance Technical Reports are based on non-CDC data, i.e., data that are not collected or managed by CDC. These reports also appear intermittently. Prior to volume 2, the report was referred to as the HIV/AIDS Surveillance Technical Report.


where last long number (3035323042363237423436304335393820202020) it's serial number in Hex.After you getting this number, try to use this program or python-script to view correct SN.Thanks.




volume serial number editor 29



The Partition Boot Sector contains information that the file system uses to access the volume. On x86-based computers, the Master Boot Record use the Partition Boot Sector on the system partition to load the operating system kernel files.


The software activations are locked to the virtual machine using the serial number of the hard drive. You can also choose to lock it to the MAC address of the virtual machine. Are either of these two things something that can be customized and edited using VMWare? Will they automatically change if I host the virtual machine using a different Virtual Server?


I've looked inside the .vmx files (currently using a mix of VMWare Workstation 7 and VMware ESXi 4.1) and I didn't see anything in either of the files that looked like a MAC addresss or a Hard Disk serial number.


I am also dealing with AssetCentre which we have virtualized in VMware and have bound to the disk serial number. I've been trying to figure out how to display the disk serial number. Thanks for the information on how to do that within FactoryTalk. I also finally found that just doing a DIR in a command prompt in any folder on that drive shows it at the top.


I just cloned our server to another Cluster and it appears that the disk serial number stayed the same. Also, Microsoft Sysinternals provides a free tool VolumeID to change the disk serial number -us/sysinternals/bb897436.aspx. I tested it and it did successfully change the serial number which FactoryTalk noticed after rebooting. Based on my testing of the clone I don't think that I will need it, but I wanted to see if it worked.


So I found out that VMware changes Hard Disk serial number (8 character Alpha-Numeric code somehow bound to a Hard Drive or Volume) when you make a clone, and I haven't found a way to manually change it back. So... using the "DISK_SERIAL_NUM" for the Host ID is a bad idea for Rockwell products running on VMware (even though they will still recommend it).


This article will demonstrate how to change the drive's serial number on three different file systems: FAT, FAT32 and NTFS. The article's source code files come with a home made DiskSector read/write class for WinNt/2k/XP and Win9x system. The article also comes with a handy dialog based application that allows you change the serial number visually.


It is worthwhile noting that the serial number returned by the "dir" command or the GetVolumeInformation() API is not the hardware serial number that comes from the manufacturer, instead this serial number is assigned and stored in the hard drive (mostly in the boot sector) by the file system and *can* be changed by software.


Knowing that the serial number is stored in the hard drive, I started looking up information about the three different file systems: FAT, FAT32, NTFS. The most relevant part to look at was the boot sector format of each of the different file systems. Usually, the bootsector holds vital data for the integrity and the operation of the file system.


The core of this function is the 'partial_boot_sector_info/pbsi' table which is built from Table 1. This table will allow us to check what file system this boot sector belongs to and then it allows us to correctly patch the serial number field. It appears that if you change the serial number of an NTFS volume, changes won't take effect until you restart your system.Also note that changing the partition's serial number will render some licensed programs useless, therefore write down the original serial number before attempting to changing it, just in case you wanted to restore it back.


First, that registry entry is a model number, not a serial number. There are presumably hundreds of thousands of any one model in existence. Secondly, a registry entry could presumably be easily spoofed.


Please note that hackers and reverse-engineering programmers know how to detect hard-drive serial numbers as well. Once they detect that such is the basis of your license security, it becomes a simple procedure to write a keygen program for your app. Again.. whatever licensing procedure you use, you MUST encrypt the executable code that generates/validates the license.


The sample then determines its own module name, appends the extension mui to it and attempts to decrypt the file using RC5 encryption. This effectively decrypts the file the malware just downloaded and stored encrypted on the system previously. As the file has been encrypted with a key based on the volume serial number it can only be executed on the system it was downloaded on or a system that has the same volume serial number, which would be a remarkable coincidence.


Without the correct volume serial number nor any knowledge about the plaintext there is no efficient way to decrypt the payload e58d4072c56a5dd3cc5cf768b8f37e5e with just the knowledge of the current sample.


With this knowledge we decided to take a reference implementation of RC5 and add a main function that accounts for the key derivation algorithm used by the malware samples (see Figure 5). Brute forcing is possible as the key is derived from a single DWORD; even though the final key length might be 28 bytes, there are only 4294967296 possible keys. The code shown in Figure 5 generates all possible volume serial numbers, derives the key from them and tries to decrypt 51 36 94 A4 26 5B 0F 19 to 00 00 00 00 00 00 00 00. Running the RC5 brute forcer for a couple of minutes shows the correct volume serial number for the sample, which is 0xc25cff4c.


Applying these constraints to our brute forcer and trying to decrypt mui file (e58d4072c56a5dd3cc5cf768b8f37e5e) once more resulted in a low number of successful hits which we could then manually check. The correct volume serial number for the encrypted mui is 0x243e2562. Analysis determined the decrypted file is XMRig miner. This also explains why the dropper downloads two files. The first, .mui is the crypto miner, and the second C:\Windows\System32\wcnapi.mui, is the configuration. The decrypted mui contains another layer of obfuscation and is eventually executed with the command x -c wcnapi.mui. An explanation on how the command was obtained and the additional layer of obfuscation is given in the next part of the blog post.


The interesting parts are shown in Figure 6. PortReuse describes the general idea behind the backdoor, to operate on a well-known port. The paths also contain version numbers 2.5 and v1.3-53. IIS_Share is used for the HTTP variant and describes the targeted application, DeviceIOContrl-Hook is used for the TCP variant.


Rectangular block which is red in color is MBR (Master Boot Record). If we count sectors from red block till the last green block then we can see that they are 63 in number. This area is reserved for MBR. After sixty third sector is the volume boot record. Volume Boot Record is again 512 bytes in size and stores a lot of information. Volume Boot Record has its mirror copy at sector number 6 keeping in mind that we are giving number 0 to master Volume Boot Record.


Offsets from 3-10 contains OEM id. OEM id is basically a string of characters that identifies the name and version number of the operating system that formatted the volume. Some examples of OEM id for different OS versions are:-


Number of FAT tables present. In FAT32 file system this is 2, with FAT1 and FAT2. FAT2 is exact replica of fat1 and is used when fat1 is corrupted or some error occurs while reading FAT1. Figure5 given belows shows the number of FAT present.


This field is a 16 bit integer describing the number of sectors in the partition. If the value at these offset is 0 then it means the value of number of sectors is greater than 65,536. If this is the case then look the values of 32-35 which is a 32-bit integer describing the number of sectors in a partition. This is explained in detail in figure6 below.


These offsets store the value of the cluster number where the root directory begins which is usually 2.Cluster 2 starts immediately after mirror copy of FAT1 i.e. FAT2 ends. Figure12 explains in clearer way.


Some publishers title each volume of a multivolume work. In this case, include the volume number within the title when constructing your reference instead of citing it parenthetically. Here is an example reference to a volume with its own title (see also Example 24 on page 204 in the sixth edition of Publication Manual):


FindLinksv1.1 (July 4, 2016)FindLinks reports the file index and any hard links (alternate filepaths on the same volume.md) that exist for the specified file. A file'sdata remains allocated so long as at it has at least one file namereferencing it.


NTFSInfov1.2 (July 4, 2016)Use NTFSInfo to see detailed information about NTFS volumes, includingthe size and location of the Master File Table (MFT) and MFT-zone, aswell as the sizes of the NTFS meta-data files.


PortMonv3.03 (January 12, 2012)Monitor serial and parallel port activity with this advanced monitoringtool. It knows about all standard serial and parallel IOCTLs and evenshows you a portion of the data being sent and received. Version 3.x haspowerful new UI enhancements and advanced filtering capabilities. 2ff7e9595c


0 views0 comments

Recent Posts

See All

Comments


bottom of page