Retrieve HDD Information

Created the Wednesday 20 March 2024. Updated 9 months ago.

Malware can figure out if it's in a virtual environment by checking hard drive info. It looks for specific details like serial and model numbers. This is easier to spot in VirtualBox because it shows clues that it's running in a virtual space.

Malware uses this trick to avoid getting caught. It does this by using a special command in the DeviceIoControl Win32 API, called IOCTL SMART_RCV_DRIVE_DATA. But, to use this command, you need top-level access.

Technique Identifier

U1343

Technique Tags

malware-detection virtual-environment-evasion hard-drive-inspection virtualbox deviceiocontrol-api root-privileges cybersecurity-tactics evasion-techniques

Code Snippets

Description

This code retrieves and displays the serial number, model number, and firmware revision of a physical hard drive using Windows API calls.

#pragma once
#define _CRT_SECURE_NO_WARNINGS
#define no_init_all
#include <Windows.h>
#include <iostream>
#include <iomanip>	// For std::setw

#define ErrorPrint(x) \
	do { \
		std::wcerr << "Error at line " << __LINE__ << ": " << x << " (Error code: " << GetLastError() << ")" << std::endl; \
	} while (0)

#define DRIVE					0		// Drive ID
#define IDENTIFY_BUFFER_SIZE			512
#define ID_CMD					0xEC	// Returns ID sector for ATA

typedef struct _IDENTIFY_DATA
{
	USHORT GeneralConfiguration;		// 00  00
	USHORT NumberOfCylinders;		// 02  1
	USHORT Reserved1;			// 04  2
	USHORT NumberOfHeads;			// 06  3
	USHORT UnformattedBytesPerTrack;	// 08  4
	USHORT UnformattedBytesPerSector;	// 0A  5
	USHORT SectorsPerTrack;			// 0C  6
	USHORT VendorUnique1[3];		// 0E  7-9
	USHORT SerialNumber[10];		// 14  10-19
	USHORT BufferType;			// 28  20
	USHORT BufferSectorSize;		// 2A  21
	USHORT NumberOfEccBytes;		// 2C  22
	USHORT FirmwareRevision[4];		// 2E  23-26
	USHORT ModelNumber[20];			// 36  27-46
	UCHAR MaximumBlockTransfer;		// 5E  47
	UCHAR VendorUnique2;			// 5F
	USHORT DoubleWordIo;			// 60  48
	USHORT Capabilities;			// 62  49
	USHORT Reserved2;			// 64  50
	UCHAR VendorUnique3;			// 66  51
	UCHAR PioCycleTimingMode;		// 67
	UCHAR VendorUnique4;			// 68  52
	UCHAR DmaCycleTimingMode;		// 69
	USHORT TranslationFieldsValid : 1;	// 6A  53
	USHORT Reserved3 : 15;
	USHORT NumberOfCurrentCylinders;	// 6C  54
	USHORT NumberOfCurrentHeads;		// 6E  55
	USHORT CurrentSectorsPerTrack;		// 70  56
	ULONG CurrentSectorCapacity;		// 72  57-58
	USHORT CurrentMultiSectorSetting;	//     59
	ULONG UserAddressableSectors;		//     60-61
	USHORT SingleWordDMASupport : 8;	//     62
	USHORT SingleWordDMAActive : 8;
	USHORT MultiWordDMASupport : 8;		//     63
	USHORT MultiWordDMAActive : 8;
	USHORT AdvancedPIOModes : 8;		//     64
	USHORT Reserved4 : 8;
	USHORT MinimumMWXferCycleTime;		//     65
	USHORT RecommendedMWXferCycleTime;	//     66
	USHORT MinimumPIOCycleTime;		//     67
	USHORT MinimumPIOCycleTimeIORDY;	//     68
	USHORT Reserved5[2];				//     69-70
	USHORT ReleaseTimeOverlapped;		//     71
	USHORT ReleaseTimeServiceCommand;	//     72
	USHORT MajorRevision;			//     73
	USHORT MinorRevision;			//     74
	USHORT Reserved6[50];			//     75-126
	USHORT SpecialFunctionsEnabled;		//     127
	USHORT Reserved7[128];			//     128-255
} IDENTIFY_DATA, *PIDENTIFY_DATA;

void PrintDriveInfo(int iDrive, DWORD diskData[256]);
char *ConvertToString(DWORD diskData[256], int iFirstIndex, int iLastIndex, char *pcszBuf);


int main(int argc, char *argv[])
{
	char driveName[MAX_PATH];
	sprintf(driveName, "\\\\.\\PhysicalDrive%d", DRIVE);

	// Get handle of the physical drive
	HANDLE hDrive = CreateFileA(driveName, GENERIC_READ | GENERIC_WRITE, FILE_SHARE_READ, 0, OPEN_EXISTING, 0, 0);

	// Check the validity of the file handle
	if (hDrive == INVALID_HANDLE_VALUE)
	{
		ErrorPrint(L"CreateFile");
		exit(1);
	}
	
	// Prepare the command buffer
	ULONG CommandSize = sizeof(SENDCMDINPARAMS) + IDENTIFY_BUFFER_SIZE;
	PSENDCMDINPARAMS Command = (PSENDCMDINPARAMS)malloc(CommandSize);
	// Prepare the command
	Command->irDriveRegs.bCommandReg = ID_CMD;

	DWORD bytesReturned = 0;
	// Retrieve IDENTIFY data
	if (DeviceIoControl(hDrive,
		SMART_RCV_DRIVE_DATA, // 0x7C088
		Command,
		sizeof(SENDCMDINPARAMS),
		Command,
		CommandSize,
		&bytesReturned,
		NULL))
	{
		// Print the IDENTIFY data
		DWORD diskData[256]; // 256 is the IDENTIFY_DATA structure's size
		USHORT *punIdSector = (USHORT *)(PIDENTIFY_DATA)((PSENDCMDOUTPARAMS)Command)->bBuffer;
		for (int i = 0; i < 256; i++)
			diskData[i] = punIdSector[i];

		PrintDriveInfo(0, diskData);
	}
	else ErrorPrint(L"DeviceIoControl (SMART_RCV_DRIVE_DATA)");

	CloseHandle(hDrive);
}

void PrintDriveInfo(int iDrive, DWORD diskData[256])
{
	char serialNumber[1024];
	char modelNumber[1024];
	char revisionNumber[1024];

	// Copy the hard drive serial, model, and revision number to respective buffer
	ConvertToString(diskData, 10, 19, serialNumber);
	ConvertToString(diskData, 27, 46, modelNumber);
	ConvertToString(diskData, 23, 26, revisionNumber);

	std::cout << "------------------------ [Drive " << DRIVE << "] ------------------------" << std::endl;
	std::cout << std::left << std::setw(35) << "Drive Serial Number________________ : [" << serialNumber << "]\n";
	std::cout << std::left << std::setw(35) << "Drive Model Number_________________ : [" << modelNumber << "]\n";
	std::cout << std::left << std::setw(35) << "Drive Controller Revision Number___ : [" << revisionNumber << "]\n";
	
	std::cout << "Drive Type_________________________ : [";
	if (diskData[0] & 0x0080)
		std::cout << "Removable]\n";
	else if (diskData[0] & 0x0040)
		std::cout << "Fixed]\n";
	else
		std::cout << "Unknown]\n";
}

char *ConvertToString(DWORD diskData[256], int iFirstIndex, int iLastIndex, char *pcszBuf)
{
	int index = 0;
	int position = 0;

	// NOTE: each integer has two characters stored in it backwards
	for (index = iFirstIndex; index <= iLastIndex; index++)
	{
		// Get high byte for 1st character
		pcszBuf[position++] = (char)(diskData[index] / 256); // / 256 = >> 8
		// Get low byte for 2nd character
		pcszBuf[position++] = (char)(diskData[index] % 256); // ^ 256 = & 0xFF
	}

	// End the string and cut off trailing blanks
	pcszBuf[position] = '\0';
	for (index = position - 1; index > 0 && isspace(pcszBuf[index]); index--)
		pcszBuf[index] = '\0';

	return pcszBuf;
}

About Author Open Snippet

Author: HoIIovv / Target Platform: Windows

Detection Rules

rule HDDInfo_rule
{
	meta:
		description = "Detect DeviceIoControl call with Io Control Code  SMART_RCV_DRIVE_DATA (0x7C088)"
		author = "Nicola Bottura"
		date = "2024-02-17"
		reference = "https://nicolabottura.github.io/HDDInfo-Evasion-PoC.html"
		hash = "aa202ae4d12e03887bb81c3a9129f44c464f54c790990494885d29bcde0ef4c1"
	strings:
		$api = "DeviceIoControl" nocase wide ascii
		$ioctl = { 88 C0 07 }

	condition:
		all of ($*)
}

Contributor

HoIIovv

Additional Resources

External Links

The resources provided below are associated links that will give you even more detailed information and research on current evasion technique. It is important to note that, while these resources may be helpful, it is important to exercise caution when following external links. As always, be careful when clicking on links from unknown sources, as they may lead to malicious content.

Nicola Bottura

Matching Samples 10 most recent

Sample Name	Matching Techniques	First Seen	Last Seen
Microsoft Store.exe	4	2024-11-23	3 weeks, 6 days ago
765edfc0c20fa35b84f7b36bf280...87d29cdf96ac9712ee6e05f59056	6	2024-11-19	1 month ago
23b1971659b16e186f9e1b36d8bc...e512b346e78f77dc314503aac59a	13	2024-11-19	1 month ago

View All