Disk serial number is one of the most reliable fingerprinting points. Unlike MAC or volume ID, the serial is set at the factory and never changes through normal operation.
On NVMe drives the serial is read via the Identify Controller command. Windows pulls it through StorPort and exposes via WMI as Win32_DiskDrive.SerialNumber. Most anti-cheats use exactly this path.
On SATA drives there's an analogous IDENTIFY DEVICE command. The result lands in the same WMI field. From the anti-cheat's perspective the two are interchangeable.
True serial spoofing requires firmware-level intervention, which is risky and vendor-specific. Our changer takes a safer approach — rewrites the WMI cache and intercepts requests at the StorPort level, so the anti-cheat sees the new value while the disk remains physically untouched.
Important: volume ID (the ID of the partition, set by the file system at format) and disk serial number are different things. Both should be changed for full coverage.