Skip to content

Instantly share code, notes, and snippets.

@MurylloEx
Created February 4, 2025 00:26
Show Gist options
  • Save MurylloEx/5e2b75a935be227a4aeb76f7f8abdd20 to your computer and use it in GitHub Desktop.
Save MurylloEx/5e2b75a935be227a4aeb76f7f8abdd20 to your computer and use it in GitHub Desktop.
Update volume identifier (Windows Sysinternals VolumeId64.exe)
__int64 sub_140003100()
{
HANDLE FileA; // rax
void *v1; // rbx
DWORD LastError; // eax
DWORD v3; // eax
DWORD v4; // eax
CHAR Buffer[8]; // [rsp+40h] [rbp-C0h] BYREF
DWORD NumberOfBytesRead; // [rsp+48h] [rbp-B8h] BYREF
char v8[3]; // [rsp+50h] [rbp-B0h] BYREF
char Str1[36]; // [rsp+53h] [rbp-ADh] BYREF
int v10; // [rsp+77h] [rbp-89h]
char v11[13]; // [rsp+86h] [rbp-7Ah] BYREF
int v12; // [rsp+93h] [rbp-6Dh]
int v13; // [rsp+98h] [rbp-68h]
char v14[430]; // [rsp+A2h] [rbp-5Eh] BYREF
CHAR FileName[256]; // [rsp+250h] [rbp+150h] BYREF
sprintf(FileName, "\\\\.\\%c:", (unsigned int)byte_140025AF4);
FileA = CreateFileA(FileName, 0xC0000000, 3u, 0LL, 3u, 0, 0LL);
v1 = FileA;
if ( FileA == (HANDLE)-1LL )
{
LastError = GetLastError();
FormatMessageA(0x1100u, 0LL, LastError, 0x400u, Buffer, 0, 0LL);
sub_140002700("Error opening drive", *(_QWORD *)Buffer);
LocalFree(*(HLOCAL *)Buffer);
}
else if ( ReadFile(FileA, v8, 0x200u, &NumberOfBytesRead, 0LL) )
{
if ( !strncmp(Str1, "NTFS", 4uLL) )
{
v13 = dword_140025AF0;
}
else if ( !strncmp(v14, "FAT32", 5uLL) )
{
v12 = dword_140025AF0;
}
else
{
if ( strncmp(v11, "FAT", 3uLL) )
{
printf("\n\nUnrecognized drive type\n");
return 0LL;
}
v10 = dword_140025AF0;
}
SetFilePointer(v1, 0, 0LL, 0);
NumberOfBytesRead = 512;
if ( WriteFile(v1, v8, 0x200u, &NumberOfBytesRead, 0LL) )
{
CloseHandle(v1);
printf(
"Volume ID for drive %C: updated to %04x-%04x\n",
byte_140025AF4,
HIWORD(dword_140025AF0),
(unsigned __int16)dword_140025AF0);
return 1LL;
}
v4 = GetLastError();
FormatMessageA(0x1100u, 0LL, v4, 0x400u, Buffer, 0, 0LL);
sub_140002700("Error writing volume id", *(_QWORD *)Buffer);
LocalFree(*(HLOCAL *)Buffer);
}
else
{
v3 = GetLastError();
FormatMessageA(0x1100u, 0LL, v3, 0x400u, Buffer, 0, 0LL);
sub_140002700("Error reading drive", *(_QWORD *)Buffer);
LocalFree(*(HLOCAL *)Buffer);
}
return 0LL;
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment