GDID Reversal
🎁FREEGitHub
gdid-reversal is a detailed technical write-up and reverse-engineering analysis of Microsoft’s Windows Global Device Identifier (GDID) — a persistent 64-bit device fingerprint used for telemetry and device tracking. It explains exactly how the ID is generated, stored, and transmitted, based on analysis of a real Windows 11 system and references to a 2026 U.S. federal criminal complaint involving the Scattered Spider group.
✨Key Features
- ▸What GDID really is: A 64-bit Microsoft Account “Device PUID” (Passport Unique ID), formatted as g:<decimal number>, not a 128-bit hardware hash as some viral claims suggested.
- ▸How it is created: Assigned by Microsoft’s servers (login.live.com) when a Windows installation is provisioned via the Microsoft Account service (wlidsvc).
- ▸Storage & flow: Stored in cleartext in the Windows registry → read by the Connected Devices Platform (cdp.dll / CDPSvc) → registered into Microsoft’s Device Directory Service (DDS) graph → reported via Delivery Optimization as GlobalDeviceId.
- ▸Persistence: Survives Windows updates but changes on a full reinstall.
- ▸Debunks myths: Clearly shows it is not derived from hardware serial numbers.
- ▸Practical info: Includes exact registry locations to find your own GDID and notes on reducing exposure (disabling CDP services, Activity History, etc.).
- ▸Reproducible research: Based on live ETW captures, public symbols, and static analysis of Windows binaries.
Advertisement
728 x 90 Ad Space