Getting Hard disk drive info with DeviceIOControl

It’s a pretty popular question on forums – how do I get the serial number for a hard disk drive. The serial number is then used for some form of homebrew security. The consensus amongst those who’ve been programming a while is that it is a waste of time and effort, unreliable and not particularly good at securing your programs…

Anyway, as a fun challenge I had a go at getting the serial number from my laptops ATA-attached drive, by using DeviceIOControl to send the IDENTIFY DEVICE ATA command, as defined in the ATA spec. This won’t work on SCSI drives, or raid or …,… ,…, so it’s not reliable and isn’t the answer for those of you looking for a unique id (there isn’t a reliable unique id).

Imports System.Runtime.InteropServices

Imports Microsoft.Win32.SafeHandles

Imports System.Security

Imports System.ComponentModel

Imports System.Text

Module Module1

    <SuppressUnmanagedCodeSecurity()> _

    Private Class NativeMethods

        <DllImport("kernel32", SetLastError:=True)> _

        Public Shared Function CreateFile( _

         ByVal FileName As String, _

         ByVal DesiredAccess As Integer, _

         ByVal ShareMode As Integer, _

         ByVal SecurityAttributes As IntPtr, _

         ByVal CreationDisposition As Integer, _

         ByVal FlagsAndAttributes As Integer, _

         ByVal hTemplateFile As IntPtr) As SafeFileHandle

        End Function

        <DllImport("kernel32.dll", SetLastError:=True)> _

        Friend Shared Function DeviceIoControl( _

            ByVal deviceHandle As SafeFileHandle, _

            ByVal controlCode As Integer, _

            ByRef inBuffer As ATA_PASS_THROUGH_EX_WITH_BUFFERS, _

            ByVal inBufferSize As Integer, _

            ByRef outBuffer As ATA_PASS_THROUGH_EX_WITH_BUFFERS, _

            ByVal outBufferSize As Integer, _

            ByRef bytesReturned As Integer, _

            ByVal overlapped1 As IntPtr) As Boolean

        End Function

    End Class

    <StructLayout(LayoutKind.Sequential)> _

    Private Structure ATA_PASS_THROUGH_EX

        Public Length As Short

        Public AtaFlags As Short

        Public PathId As Byte

        Public TargetId As Byte

        Public Lun As Byte

        Public ReservedAsUchar As Byte

        Public DataTransferLength As Integer

        Public TimeOutValue As Integer

        Public ReservedAsUlong As Integer

        Public DataBufferOffset As IntPtr

        <MarshalAs(UnmanagedType.ByValArray, sizeconst:=8)> _

        Public PreviousTaskFile() As Byte

        <MarshalAs(UnmanagedType.ByValArray, sizeconst:=8)> _

        Public CurrentTaskFile() As Byte

    End Structure

    <StructLayout(LayoutKind.Sequential)> _

    Private Structure ATA_PASS_THROUGH_EX_WITH_BUFFERS

        Public Apt As ATA_PASS_THROUGH_EX

        <MarshalAs(UnmanagedType.ByValArray, sizeconst:=512)> _

        Public Data() As Byte

    End Structure

    Sub Main()

        Console.WriteLine("Enter a drive letter")

        Dim letter As Char = Console.ReadKey.KeyChar

        Console.WriteLine()

        Const GenericRead As Integer = &H80000000

        Const GenericWrite As Integer = &H40000000

        Const FileShareRead As Integer = 1

        Const FileShareWrite As Integer = 2

        Const OpenExisting As Integer = 3

        Dim drivePath As String = String.Concat("\\.\" & letter & ":")

        Console.WriteLine("Trying path: " & drivePath)

        Using driveHandle As SafeFileHandle = NativeMethods.CreateFile( _

         drivePath, _

         GenericRead Or GenericWrite, _

         FileShareRead Or FileShareWrite, _

         IntPtr.Zero, _

         OpenExisting, _

         0, _

         IntPtr.Zero)

            If driveHandle.IsInvalid Then

                Console.WriteLine("CreateFile ERROR: " & (New Win32Exception).Message)

                Console.ReadKey()

                Return

            End If

            Dim apex As New ATA_PASS_THROUGH_EX

            apex.Length = Marshal.SizeOf(apex)

            apex.AtaFlags = 2 ' ATA_FLAGS_DATA_IN

            apex.DataTransferLength = 512 ' The command returns a 512 byte package of info.

            apex.TimeOutValue = 10 ' 10 second timeout.

            apex.DataBufferOffset = Marshal.OffsetOf(GetType(ATA_PASS_THROUGH_EX_WITH_BUFFERS), "Data")

            apex.CurrentTaskFile = New Byte(7) {} ' This contains the command we are requesting.

            apex.CurrentTaskFile(6) = &HEC        ' <-- the command "IDENTIFY DEVICE"

            Dim apexb As New ATA_PASS_THROUGH_EX_WITH_BUFFERS

            apexb.Apt = apex

            Dim inBufferSize As Integer = Marshal.SizeOf(GetType(ATA_PASS_THROUGH_EX_WITH_BUFFERS))

            Dim bytesReturned As Integer

            Const IOCTL_ATA_PASS_THROUGH As Integer = &H4D02C

            Dim result As Boolean = NativeMethods.DeviceIoControl(driveHandle, IOCTL_ATA_PASS_THROUGH, _

                apexb, inBufferSize, apexb, inBufferSize, bytesReturned, IntPtr.Zero)

            If result = False Then

                Console.WriteLine("DeviceIOControl ERROR: " & (New Win32Exception).Message)

                Console.ReadKey()

                Return

            End If

            DumpString("S/N: ", apexb.Data, 20, 20)

            DumpString("Firmware: ", apexb.Data, 46, 8)

            DumpString("Model: ", apexb.Data, 54, 40)

            Console.WriteLine("Press any key")

            Console.ReadKey()

        End Using

    End Sub

    Private Sub DumpString(msg As String, bytes() As Byte, offset As Integer, length As Integer)

        ' The strings are slightly weird - endianness? If you use ASCII.GetBytes then each character 

        ' pair is reversed.

        Dim sb As New StringBuilder(msg & " '")

        For i As Integer = offset To offset + length - 1 Step 2

            sb.Append(Chr(bytes(i + 1)))

            sb.Append(Chr(bytes(i)))

        Next

        sb.Append("'"c)

        Console.WriteLine(sb.ToString)

    End Sub

End Module

Output on my laptop:

Enter a drive letter
c
Trying path: \\.\c:
S/N:  '            5TG077W9'
Firmware:  'DE14    '
Model:  'ST9160411ASG                            '
Press any key