Reverse-Engineering Windows' Undocumented Offline Device ID API
A reverse-engineering deep dive into Windows' undocumented GetOfflineDeviceUniqueID function, tracing its RPC path from clipc.dll to clipsvc.dll.
The undocumented clipc!GetOfflineDeviceUniqueID function in clipc.dll returns a 32-byte, salt-scoped SHA-256 device identifier consumed by Windows licensing and device-identification components. With no public PDB symbols for clipc.dll or clipsvc.dll, the function's prototype, internal data structures, and RPC call chain were manually reconstructed via IDA.
The analysis traces the call from clipc.dll through NdrClientCall3 into clipsvc.dll, pinpointing proc 2 / command 13 as the operation dispatcher, and documents the supported retrieval methods — TPM endorsement key, UEFI variables (OfflineUniqueIDEKPub, OfflineUniqueIDRandomSeed), and a registry-based fallback. It also covers broken behavior in the function's optional CRC outputs and the RPC security descriptor that permits AppContainer/UWP callers.
The investigation was prompted by observing commercial anti-cheat software invoking this API alongside its own hardware-fingerprinting routines. Understanding exactly which machine-specific value Windows relies on — and how it's transformed into the final device ID — offers a useful reference for security researchers and low-level Windows developers working with device fingerprinting or licensing internals.