Sign Tools 4 Serial Number
for added context, on your binary file, you should see the following data in the same area (i left out the binary because the location of the keys and data is always the same, and the same values too):
iserialnumber: the unique serial number assigned by the manufacturer.
imanufacturer: the manufacturer’s id.
iproducttype: some unique identifier assigned by the manufacturer.
sdisplayname: the name assigned by the manufacturer.
dwosversion: the operating system version.
ihardwaretype: the type of hardware in the device.
isystem: the system name. this includes the name of the physical system, and the name of the virtual machine.
iuniqueid: for the most part, this is a unique id that is assigned by the system. if it is blank, it means that it is not available and the value is left blank. there is a chance that this value would be the same as the iserialnumber. the documentation for this variable says that this value is unique across all devices.
in my experience, the iserialnumber and isystem are the only two values that are reliable. the value of the rest changes on a regular basis and is usually a good indicator that the device has been reinstalled. the iserialnumber value is usually a number, and the isystem is usually a name. sometimes, the name is available, and the serial number is blank. most of the time, however, the serial number is available and the name is blank. i have yet to see a case where the serial number and the name are the same.
the way to determine the value of a serial number is by reviewing a file that contains a serial number. for example, this is from a file that was automatically generated by the system. note the unique value assigned to this file.
the other value that appears to be a serial number is the value in the bios. this is the case for the sign tools 4 that shipped with the laptop. note that the serial number in the bios is also a tracking id value. the good news is that there are no other instances of this in the system. this makes for a clean extract.
as you can see, the device id is not very useful in the specific scenario that we are investigating. in fact, i could not find any instances of device id that appeared to be a serial number. that does not mean it does not exist. it just means i did not find it. in the case of windows devices, if you know the device id, you can use it to locate the appropriate values. in the case of sign tools 4, the device id value is almost always incorrect. the good news is that it is the only value of interest in this case. unfortunately, that does not mean the device id is not correct in other cases.
in the case of sign tools 4, all the tracking id values are correct and only the device id is incorrect. this gives us a good starting point, but unfortunately, the device id is also the only thing we have to work with in the case of sign tools 4. the good news is that we know that the device id is a unique value assigned by the computer at the time of manufacture, so this should be all we need. in the case of windows systems, the device id is rarely correct and there are multiple values in the system.