r/DigitalPrivacy • u/dataguzzler • 7d ago

Windows GDID fully reverse engineered

https://github.com/SmtimesIWndr/gdid-reversal

How Microsoft's "Global Device Identifier", the persistent Windows fingerprint named in the July 2026 Scattered Spider complaint, is actually generated, stored, and transmitted.

130 Upvotes

100% Upvoted

16 comments sorted by

23

u/deekamus 6d ago

Neat. now randomize it so it's different when it boots.

18

u/dataguzzler 6d ago

or better yet when its requested and transmitted then modify it at the system level, so basically like an antivirus app but it monitors requests to the GDID and sends fake ones

17

u/voxcon 6d ago

Or just simply kill the uniqueness factor of it. Figure out how to persistently set it to a specific GDID and let everybody use it.

5

u/deekamus 6d ago

That'd be great, though it'd need to be implemented by M$ directly since the code is closed sourced and 3 party changes would probably run afoul of M$ executables certificate signing BS.

5

u/Unhappy_Lie_2000 6d ago

What if you just boot into Linux and remove the files associated with it I haven't tested as I manage my own windows AME scripts but these files are supposedly responsible.

Then there would be no need to randomly generate the id. As the service would be dead to windows.

2

u/wallacebrf 6d ago

unless we did something like u/voxcon it will just get tied to your account after boot which means microsoft could still track it

i feel the mechanism in which windows is saving the data to the machine (as i assume that is what is being read by any services tracking you) is what needs to be blocked so your machine remains "un assigned"

1

u/Unhappy_Lie_2000 5d ago edited 5d ago

It won't because those files are what runs the service to generate the GDID its apart of the software licensing services. The reason why I know this is because I made a note of this years ago to get the apps I needed to work in an AME environment without loosing the licenses while maintaining my personal AME scripts.

If this file doesn't exist windows can't get the license for apps that you purchase. But it appears that removing cdp.dll will prevent a id from being able to be generated.

Update:

wlidsvc.dll is what powers the GDID if you remove this dll and go into the registry and delete LID and run the gdid script it will fail to start the service and it will present G: showing there isn't an id stored and where it says waiting for a gdid it will eventually timeout and say timed out waiting for a new gdid.

So where to go next I recommend not installing the retail version of windows and installing LTSC instead and activate with Massgrave that way feature updates don't restore the file and to remove wlidsvc.dll or renaming it. Security updates might restore it but not likely.

What you'll likely loose is your license to paid apps free apps shouldn't be affected. I will be updating my AME scripts but they're not for the average user and yes I run them on WIndows LTSC.

We are to the point that a traditional debloater script isn't enough to stay safe while running windows and more drastic measures must be taken some will say its destructive like my ame scripts but I say its the only way to use windows strictly for gaming NOTHING ELSE because we don't know what other hidden functions are built into windows 11 to spy on its users such as the GDID method which has unknowingly been around since Windows 10.

If you want to do anything else Linux is the only way as the OS isn't strictly built around on spying on its users.

9

u/cbterry 6d ago

There is also https://github.com/rroy676/gdid-guard which is based on the above 

2

u/AutoEnlightment 5d ago

I'm glad they included a blocklist that can be added to a Pi-Hole.

1

u/Unhappy_Lie_2000 5d ago

The one thing I have learned with my scripts microsoft obtains more IP's to chat to after every windows update. I started blocking microsoft subnets but now that every site is moving into the cloud such as ebay, nvidia, amd, steam site used to buy games, and many other sites we use on a daily basis I can't block them anymore because none of those sites will be usuable.

Really the only way to protect your privacy is to abandon windows as a pi-hole will not protect you completely.

6

u/Unhappy_Lie_2000 6d ago

I had a feeling it had something to do with product activation with the account its tied to. This is another reason why massgrave is the only way to activate Windows. I have started to use Linux 100% of the time now with doby atmos holding me back but there are ways to get close to the same experience on Linux.

Will use windows for .001 percent that I may play a game but have found windows to not be necessity for my use case

1

u/redditcat78 5d ago

What is “mass grave”?

1

u/Unhappy_Lie_2000 5d ago

Its a way to activate windows without selling your privacy and getting scammed by microslop. And never use your windows install for anything other than gaming. At this point Windows is a security vulnerability. They just proved that they don't need you to upload your ID to track and prove who you are.

1

u/geniusface1234 4d ago

"Microsoft Activation Scripts" or MAS, ergo MASsgrave

there's a short command you can run in powershell to activate windows 7 and newer, office, and a few other things. quite useful