GUID (Global Unique Identifier)

Question 1

What is UUID ?

Answer 1

Universally Unique Identifier. An 128 bits number used to identify information in computer systems.

Question 2

What is GUID?

Answer 2

GUID is Microsoft implementation of UUIS.

Question 3

Where is GUID used for?

Answer 3

• Identify OS components. (Files, Pofiles, Registry)
• Identify Objects. (Interfaces, Manage Entry Points Vectors EPV’s, Class objects)

Question 4

What is Windows GUID format ?

Answer 4

Its a long sequence of digits. Written as a 32-char hex string. With a length of 16 bytes. (128 bits, 16 x 8 bits)
(4 bytes) - (3 bytes) - (3 bytes) - (3 bytes) - (6 bytes)
The first 3 groups are “little endian” and the 4th group is “big endian”
The last 6 bytes is the mac address.

Question 5

What is UUID binary encoding ?

Answer 5

The binary encoding of UUID varies between systems. Most systems encode the UUID entirely in a “big endian” format.
Windows used a mixed-endian format like the first 3 groups are “little endian” and the 4th group is “big endian”

Question 6

How many UUID version are there? And how can you determine the version ?

Answer 6

There are 5 version. Version 4 is the most common used. The version can be found in the first digit of the 3th group.

Question 7

UUID v1

Answer 7

Using a timestamp + mac address (Can be easily faked)

Question 8

UUID v2

Answer 8

Using a timestamp + mac address but first 32 bits are replaced by user’s Posix.

Question 9

UUID v3

Answer 9

MD5 Hash of namespace identifier + name