Guide [Source] Windows HWID — Undocumented SpacePort Disk Method

[byte_corvus]

Ever wondered how some anti-cheats still flag your hardware after a \"perfect\" disk spoof?

Most of you are just hitting the standard storage class drivers and calling it a day, but Windows has plenty of dark corners that leak your real identity. While digging through some undocumented device handles, I came across a vector involving the SpacePort driver that most public spoofers completely ignore. If you handle this correctly in your kernel driver, you can stop relying on messy workarounds like Reset-PhysicalDisk.

The Logic
By communicating with \\.\\spaceport, an AC can query a full list of drive GUIDs and detailed information that persists even after typical serial spoofing. This is why you might catch a delayed ban even when your disk serials look \"clean\" in standard checkers. If you spoof these IOCTL returns, you won't need to perform a physical disk reset anymore.

Technical Breakdown

1. Target Device: \\.\\spaceport
2. IOCTL_SPACEPORT_GET_DRIVES (0xE70404): Retrieves the list of drive GUIDs.
3. IOCTL_SPACEPORT_GET_DRIVE_INFO (0xE70408): Dumps specific metadata for each GUID.

SpacePort Drive Logger (Checker Source)
Use this snippet to check what your own system is leaking. It opens a handle to the spaceport device and dumps every string and GUID it finds via DeviceIoControl.

#define IOCTL_SPACEPORT_GET_DRIVES     0xE70404
#define IOCTL_SPACEPORT_GET_DRIVE_INFO 0xE70408
 
void ExtractWideStrings(const BYTE* data, DWORD size)
{
    for (DWORD i = 0; i + 1 < size; i += 2)
    {
        const WCHAR* wstr = (const WCHAR*)(data + i);
        DWORD len = 0;
        while (i + (len + 1) * 2 <= size && wstr[len] >= 0x20 && wstr[len] <= 0x7E)
            len++;
 
        if (len >= 4)
        {
            printf("  [0x%04X] \"", i);
            for (DWORD j = 0; j < len; j++)
                printf("%c", (char)wstr[j]);
            printf("\"\n");
            i += len * 2 - 2;
        }
    }
}
 
void PrintGUID(const GUID* g)
{
    printf("{%08lX-%04X-%04X-%02X%02X-%02X%02X%02X%02X%02X%02X}",
        g->Data1, g->Data2, g->Data3,
        g->Data4[0], g->Data4[1], g->Data4[2], g->Data4[3],
        g->Data4[4], g->Data4[5], g->Data4[6], g->Data4[7]);
}
 
int main()
{
    printf("=== SpfChecker: SpacePort Drive Logger ===\n\n");
 
    HANDLE hDevice = CreateFileW(L"\\\\.\\spaceport",
        GENERIC_READ | GENERIC_WRITE, FILE_SHARE_READ | FILE_SHARE_WRITE,
        NULL, OPEN_EXISTING, 0, NULL);
 
    if (hDevice == INVALID_HANDLE_VALUE)
    {
        printf("[!] Failed to open \\\\.\\spaceport (error %lu)\n", GetLastError());
        system("pause");
        return 1;
    }
 
    printf("[+] Opened \\\\.\\spaceport\n\n");
 
    BYTE getDrivesIn[64] = {};
    *(DWORD*)getDrivesIn = 64;
 
    DWORD outSize = 65536;
    BYTE* outBuf = (BYTE*)calloc(1, outSize);
    DWORD ret = 0;
 
    BOOL ok = DeviceIoControl(hDevice, IOCTL_SPACEPORT_GET_DRIVES,
        getDrivesIn, sizeof(getDrivesIn), outBuf, outSize, &ret, NULL);
 
    if (!ok)
    {
        printf("[!] GetDrives failed (error %lu)\n", GetLastError());
        getDrivesIn[20] = 1;
        ok = DeviceIoControl(hDevice, IOCTL_SPACEPORT_GET_DRIVES,
            getDrivesIn, sizeof(getDrivesIn), outBuf, outSize, &ret, NULL);
 
        if (!ok)
            printf("[!] Still failed (error %lu)\n\n", GetLastError());
    }
 
    GUID driveGuids[64] = {};
    int driveCount = 0;
 
    if (ok && ret >= 4)
    {
        DWORD count = *(DWORD*)outBuf;
        printf("[+] GetDrives returned %lu bytes, %lu drives\n\n", ret, count);
 
        ExtractWideStrings(outBuf, ret);
        printf("\n");
 
        DWORD pos = 4;
        for (DWORD d = 0; d < count && d < 64 && pos + 16 <= ret; d++)
        {
            GUID* g = (GUID*)(outBuf + pos);
            if (g->Data1 != 0 || g->Data2 != 0 || g->Data3 != 0)
            {
                driveGuids[driveCount] = *g;
                printf("  Drive %d GUID: ", driveCount);
                PrintGUID(g);
                printf("\n");
                driveCount++;
            }
            pos += 16;
        }
        printf("\n");
    }
 
    if (driveCount > 0)
    {
        DWORD infoOutSize = 0x2000;
        BYTE* infoOut = (BYTE*)calloc(1, infoOutSize);
 
        for (int d = 0; d < driveCount; d++)
        {
            printf("--- Drive %d ---\n", d);
            printf("  GUID: ");
            PrintGUID(&driveGuids[d]);
            printf("\n");
 
            BYTE in[40] = {};
            *(DWORD*)in = 40;
            memcpy(in + 20, &driveGuids[d], sizeof(GUID));
 
            memset(infoOut, 0, infoOutSize);
            ret = 0;
 
            ok = DeviceIoControl(hDevice, IOCTL_SPACEPORT_GET_DRIVE_INFO,
                in, sizeof(in), infoOut, infoOutSize, &ret, NULL);
 
            if (!ok)
            {
                memset(in, 0, sizeof(in));
                *(DWORD*)in = 40;
                memcpy(in + 4, &driveGuids[d], sizeof(GUID));
 
                ok = DeviceIoControl(hDevice, IOCTL_SPACEPORT_GET_DRIVE_INFO,
                    in, sizeof(in), infoOut, infoOutSize, &ret, NULL);
 
                if (!ok)
                {
                    printf("  [!] Failed (error %lu)\n\n", GetLastError());
                    continue;
                }
            }
 
            printf("  [+] %lu bytes\n", ret);
            ExtractWideStrings(infoOut, ret);
            printf("\n");
        }
 
        free(infoOut);
    }
    else
    {
        DWORD infoOutSize = 0x2000;
        BYTE* infoOut = (BYTE*)calloc(1, infoOutSize);
 
        BYTE in[40] = {};
        *(DWORD*)in = 40;
        ret = 0;
 
        ok = DeviceIoControl(hDevice, IOCTL_SPACEPORT_GET_DRIVE_INFO,
            in, sizeof(in), infoOut, infoOutSize, &ret, NULL);
 
        if (ok && ret > 0)
        {
            printf("[+] GetDriveInfo(NULL) returned %lu bytes\n", ret);
            ExtractWideStrings(infoOut, ret);
        }
        else
            printf("[!] GetDriveInfo(NULL) failed (error %lu)\n", GetLastError());
 
        free(infoOut);
    }
 
    free(outBuf);
    CloseHandle(hDevice);
 
    printf("\n=== Done ===\n");
    system("pause");
    return 0;
}

Spoiler: Implementation Notes

When implementing a bypass, you'll need to hook the dispatch routine for the SpacePort driver or use a mid-function hook where the buffer is filled. The data is returned as a list of GUIDs followed by wide string metadata. Simply zeroing it out might cause stability issues, so proper spoofing with consistent fake GUIDs is recommended for staying undetected (UD).

This method is particularly effective for those struggling with EAC or BattlEye hardware tracking that seems to persist across re-imaging. By intercepting these requests, you close one more leak that keeps your main account at risk.

Who's already implemented a hook for this in their driver?