On Tue, 13 Nov 2018 19:38:05 -0800 (PST), Davej
wrote:

On Tuesday, November 13, 2018 at 4:48:51 PM UTC-6, Paul wrote:
Percival P. Cassidy wrote:
Are you sure that only the MAC address is used?

I was attempting to use the hardware identifier with
the most weight, as a simplified example of how it
works.

The alternate term I use "hardware hash", I'm not
even sure of the mechanical details, and how
big of a packet or table is sent.

See now, that only makes sense to identify an exact
configuration. That is part of what has had me confused. A
hash is not the correct thing to use in this situation,
because a hash changes dramatically if even one bit of
the input changes.

Agreed, they almost certainly do NOT use a hash, in the common meaning
of that word. They have the disk space to be able to store the actual
values that they collect**, and by having the actual values versus a
hash, they can then see when some things remain the same even while
other things have changed. As you say above, a hash would be limited to
a boolean decision - the hash either matches or it doesn't. By
collecting and storing the individual data elements, they can be
properly weighted so that, perhaps, more weight is given to the NIC MAC.
Obviously, they can't use only the NIC MAC or we'd all simply clone that
MAC address and get free activation.

**Regarding what specific info that they collect, I've never seen an
authoritative answer to that question, but I agree with Paul that it's
most likely things like NIC MAC, CPU ID, HDD SN, etc.

To get an idea of what all they can collect, take a look at the file
gatherNetworkInfo.vbs in System32. That script is an example of how to
collect WAY more than just network info. I'm not saying they use that
exact script, but probably something similar. For fun, copy that script
to a new folder and run it, then check the output. There's lots of good
info in there.