The serial number is stored at the beginning of the SD card.
Code:
# hexdump -C /dev/mmcblk0 | less
...
00000200 53 4e 2d 4e 32 35 30 34 39 31 30 30 32 37 34 31 |SN-N250491002741|
...
So hexedit the card at offset 512 bytes. or if you have telnet on the device itself (in my case H2O, your model number will be different), or the SD card on a Linux box:
Code:
# echo -n SN-xxxxyyzdddddd | dd bs=1 seek=512 count=16 of=/dev/mmcblk0
xxxx = Model (in my case N250)
yy = country code (in my case 49 for Germany)
z = revision? (in my case 1)
dddddd = Nth device produced for xxx/yy/z (in my case 002741).
Wrong model in that string and the device might not boot up proper anymore (don't make a HD boot believing it's an old Glo or sommat).
Might need a factory reset afterwards as the SN also makes it into other files during setting up the device for the first time.