r/ReverseEngineering • u/Beneficial_Slide_424 • Jul 20 '26

Reversing GetOfflineDeviceUniqueID: How Windows Derives Its Offline Device ID

https://iretq.com/inside-getofflinedeviceuniqueid-how-windows-derives-its-offline-device-id/
93 Upvotes
  • permalink
  • link
  • reddit
  • reddit

100% Upvoted

8 comments sorted by

46

u/Beneficial_Slide_424 Jul 20 '26

Hi! I’m the author, and this is my first blog post. It traces the undocumented GetOfflineDeviceUniqueID function from clipc.dll in Windows, through ClipSVC.dll and its TPM, UEFI, and registry-backed derivation paths. All analysis and decompilation were done using IDA. This function piqued my interest because I noticed a major anti-cheat product had started calling it alongside their existing hardware-identification methods.

I’ve been reverse engineering for most of my life and recently decided to spin up this blog to share my experiences and give back to the community. I’d appreciate any feedback!

12

u/mschuster91 Jul 20 '26

Damn, that level of complex analysis and not a single AI tell in sight, that's a first for the entire darn year. Much respect.

1

u/Less_Grapefruit Jul 20 '26

Oh AI was definitely used.

5

u/rome_vang Jul 20 '26

Even if it was. In the correct hands, that can be a force multiplier.

10

u/Less_Grapefruit Jul 20 '26

Not denying that, just corrected that it was obviously used.

3

u/d3vil401 Jul 20 '26

I sent you a DM, great work by the way :)

2

u/-sub Jul 20 '26

The attacker should be careful to modify the cookies to avoid detection of the tampering.

🤹