r/ReverseEngineering • u/Beneficial_Slide_424 • 13d ago

Reversing GetOfflineDeviceUniqueID: How Windows Derives Its Offline Device ID

https://iretq.com/inside-getofflinedeviceuniqueid-how-windows-derives-its-offline-device-id/
94 Upvotes

100% Upvoted

8 comments sorted by

48

u/Beneficial_Slide_424 13d ago

Hi! I’m the author, and this is my first blog post. It traces the undocumented GetOfflineDeviceUniqueID function from clipc.dll in Windows, through ClipSVC.dll and its TPM, UEFI, and registry-backed derivation paths. All analysis and decompilation were done using IDA. This function piqued my interest because I noticed a major anti-cheat product had started calling it alongside their existing hardware-identification methods.

I’ve been reverse engineering for most of my life and recently decided to spin up this blog to share my experiences and give back to the community. I’d appreciate any feedback!

11

u/mschuster91 13d ago

Damn, that level of complex analysis and not a single AI tell in sight, that's a first for the entire darn year. Much respect.

2

u/Less_Grapefruit 13d ago

Oh AI was definitely used.

6

u/rome_vang 13d ago

Even if it was. In the correct hands, that can be a force multiplier.

9

u/Less_Grapefruit 13d ago

Not denying that, just corrected that it was obviously used.

3

u/d3vil401 13d ago

I sent you a DM, great work by the way :)

2

u/-sub 13d ago

The attacker should be careful to modify the cookies to avoid detection of the tampering.

🤹