C / C++ / MFC

BOOL CData::GetSerialNumber(BYTE* out)
{
	BOOL bRet = FALSE;
	HRESULT hr;
	hr = CoInitializeEx(0, COINIT_MULTITHREADED); 
	if (FAILED(hr)) 
	{
		cout << "Failed to initialize COM library. Error code = 0x"
		   << hex << hr << endl; 
	  return bRet;
	}
	hr =  CoInitializeSecurity(
		NULL,                      // Security descriptor    
		-1,                        // COM negotiates authentication service
		NULL,                      // Authentication services
		NULL,                      // Reserved
		RPC_C_AUTHN_LEVEL_DEFAULT, // Default authentication level for proxies
		RPC_C_IMP_LEVEL_IMPERSONATE, // Default Impersonation level for proxies
		NULL,                        // Authentication info
		EOAC_NONE,                   // Additional capabilities of the client or server
		NULL);                       // Reserved

	if (FAILED(hr))
	{
	   cout << "Failed to initialize security. Error code = 0x" 
			<< hex << hr << endl;
	   CoUninitialize();
	   return bRet;                  // Program has failed.
	}
    IWbemLocator *pLoc = 0;

    hr = CoCreateInstance(CLSID_WbemLocator, 0, 
        CLSCTX_INPROC_SERVER, IID_IWbemLocator, (LPVOID *) &pLoc);
 
    if (FAILED(hr))
    {
        cout << "Failed to create IWbemLocator object. Err code = 0x"
             << hex << hr << endl;
        CoUninitialize();
        return bRet;     // Program has failed.
    }
	IWbemServices *pSvc = 0;

    // Connect to the root\default namespace with the current user.
    hr = pLoc->ConnectServer(
            BSTR(L"ROOT\\CIMV2"), 
            NULL, NULL, 0, NULL, 0, 0, &pSvc);

    if (FAILED(hr))
    {
        cout << "Could not connect. Error code = 0x" 
             << hex << hr << endl;
        pLoc->Release();
        CoUninitialize();
        return bRet;      // Program has failed.
    }

    cout << "Connected to WMI" << endl;
    HRESULT hres;

    // Set the proxy so that impersonation of the client occurs.
    hres = CoSetProxyBlanket(pSvc,
       RPC_C_AUTHN_WINNT,
       RPC_C_AUTHZ_NONE,
       NULL,
       RPC_C_AUTHN_LEVEL_CALL,
       RPC_C_IMP_LEVEL_IMPERSONATE,
       NULL,
       EOAC_NONE
    );

    if (FAILED(hres))
    {
        cout << "Could not set proxy blanket. Error code = 0x" 
             << hex << hres << endl;
		pSvc->Release();
		pLoc->Release();
		CoUninitialize();
        return bRet;      // Program has failed.
    }
	//Now start reading...
	IEnumWbemClassObject* pObj = 0;
	IWbemClassObject* pwcObj = 0;
	hres = pSvc->ExecQuery(L"WQL",L"select * from Win32_PhysicalMedia",WBEM_FLAG_FORWARD_ONLY | WBEM_FLAG_RETURN_IMMEDIATELY,0,
		&pObj);
	char strID[20];
	VARIANT vtData;
	CIMTYPE ctType = 0;
	long lFavor = 0;
	ULONG ulRet;
	if(SUCCEEDED(hres))
	{
		hres = pObj->Next(WBEM_INFINITE,1,&pwcObj,&ulRet);
		if(SUCCEEDED(hres) && pwcObj)
		{
			ZeroMemory(strID,20);
			vtData.pbstrVal = 0;
			hres = pwcObj->Get(L"SerialNumber",0,&vtData,&ctType,&lFavor);
			if(vtData.pbstrVal)
			{
				CopyMemory(strID,vtData.pbstrVal,20);
			}
			VariantClear(&vtData);
			pwcObj->Release();
			bRet = TRUE;
			if(SUCCEEDED(hres) && out)
			{
				CopyMemory(out,strID,20);
			}
		}
		pObj->Release();
	}
	//Clean up
	pSvc->Release();
	pLoc->Release();
	CoUninitialize();
	return bRet;
}

Get(L"SerialNumber",0,&vtData,&ctType,&lFavor);

int offset = 0x804;
int address = 0x818794;
int totalhp = offset + address;
int value;
ReadProcessMemory(hProcess, (LPCVOID)totalhp, &value, sizeof(value), NULL );
std::cout << value << std::endl;