I think direct read of the ramdisk first sector is going to be the only way. I need to just get the bytes into the correct format.
I need something that will work on a ramdrive and not a 'proper' disk though...
The Volume serial number is *something* attached to the volume (i.e. the whatever you access with a drive letter under windows), it does not make any difference whether it is a Ramdisk or not and if it is an Imdisk ramdisk or not, as long as it is formatted to NTFS, you just need to reverse the order.
Now, imagine
that you are using grub4dos, as an example:
uuid (hd1,0)
uuid (hd1,0) : UUID is CEC0A632C0A62127
Filesystem type is ntfs, partition type is 0x07
cat --hex --skip=0x48 --length=8 (hd1,0)0+1
00000048: 27 21 A6 C0 32 A6 C0 CE
This might do:
@ECHO OFF
SETLOCAL ENABLEEXTENSIONS
IF %1.==. ECHO Missing drive letter&GOTO :EOF
FOR /F "tokens=10,11,12,13,14,15,16,17 delims=- " %%A IN ('secinspect -dsec \\.\%1 0 1 ^| FIND "0x0040"') DO (
FOR %%? IN (%%H %%G %%F %%E %%D %%C %%B %%A) DO CALL :do_hex 0x%%?
)
VOL %1
SET Serial= Real volume serial: %Serial%
ECHO %Serial%
GOTO :EOF
:do_hex
SET /A dec=%1
CMD /C EXIT /B %dec%
SET "Serial=%Serial%%=ExitCode:~-2%"
GOTO :EOF
(making use of MS own SECINSPECT.EXE):
http://thestarman.pc...efs.htm#SecInspScript is made complex because the tool uses small letters instead of capitals in hex numbers (talking of "standards"
)
Wonko