What Hardware Identifiers Do Anti-Cheats Track?
Modern anti-cheats fingerprint a composite of 16+ identifiers: SMBIOS UUID, motherboard serial, all disk serials (SATA + NVMe), every NIC''s MAC address, GPU UUID, MachineGuid (Windows registry), Windows Product ID, Windows install date, RAM SPD strings, USB controller IDs, PCI device IDs, monitor EDID, BIOS strings, TPM 2.0 endorsement key (unspoofable from user-mode), CPU ID, and Microsoft Remote Attestation. Raw Spoofer randomizes 13 of these; TPM EK and Pluton are firmware-baked and out of reach.
Anti-cheat hardware fingerprinting in 2026 is a composite system — no single identifier carries the ban, and matching multiple identifiers in combination is what flags a banned machine. Understanding which identifiers are tracked and which are spoofable is the foundation of HWID defense.
The 16-identifier composite
Modern kernel anti-cheats (EAC, BattlEye, Vanguard, NeacSafe, Activision Ricochet) read most of the following:
Firmware-rooted (hard to spoof):
- TPM 2.0 endorsement key (EK) — burned into the TPM chip at manufacture. Unspoofable from user-mode. Anti-cheats can use it as a unique machine ID via TBS APIs.
- Microsoft Pluton key — burned into the Pluton security processor (newer AMD CPUs). Same status as TPM EK — unspoofable.
- CPU ID via Ring 0 — kernel anti-cheats can read CPU identifiers that aren't accessible from Ring 3.
- Microsoft Remote Attestation — a cryptographic chain proving the boot environment is genuine. Doesn't give a unique ID but binds to the TPM EK.
Firmware-readable but spoofable in user-mode: 5. SMBIOS UUID — written to firmware at manufacture, readable via WMI. Spoofable. 6. SMBIOS serial number — same source. Spoofable. 7. Motherboard serial number — separate from SMBIOS, separate WMI table. Spoofable. 8. BIOS strings (vendor, version, release date) — readable via WMI. Spoofable. 9. Disk serial numbers — readable via direct ATA queries to each drive. Spoofable per drive (SATA and NVMe both). 10. MAC addresses — readable via NDIS, one per physical NIC. Spoofable. 11. GPU UUID — readable via NVAPI (NVIDIA) or AGS (AMD) or DXGI. Spoofable. 12. MachineGuid — HKLM\SOFTWARE\Microsoft\Cryptography\MachineGuid. Spoofable. 13. Windows Product ID — registry-stored. Spoofable. 14. Windows install date — registry-stored timestamp. Spoofable. 15. RAM SPD — each RAM stick has SPD strings (manufacturer, serial, part number) readable via SMBus. Spoofable. 16. USB controller IDs — PnP enumeration via SetupAPI. Spoofable. 17. PCI device IDs — PnP enumeration of every PCI device including chipset components. Spoofable. 18. Monitor EDID — VESA Extended Display Identification Data per monitor, readable via EDIDDDC. Spoofable.
What Raw Spoofer covers
Raw Spoofer randomizes 13-16 of the user-mode-spoofable identifiers per cold boot:
- SMBIOS UUID/Serial/Manufacturer/Product/BIOS
- Motherboard serial
- All disk serials
- GPT/MBR partition signatures
- Every NIC's MAC
- GPU UUID
- MachineGuid
- Windows Product ID + install date
- RAM SPD
- USB controller IDs
- PCI device IDs
- Monitor EDID strings
What Raw Spoofer doesn't cover (and intentionally so):
- TPM 2.0 endorsement key (unspoofable, touching it produces detection patterns worse than the original)
- Microsoft Pluton (unspoofable)
- Ring-3 CPU ID (the user-mode CPU ID is a fixed CPUID instruction result; randomizing it requires kernel-mode or hypervisor)
- Microsoft Remote Attestation chains (bound to TPM, unspoofable)
Why composite matching matters
A single matched identifier doesn't ban you. Anti-cheats compute a similarity score across the composite — typically requiring 5-8 out of 16 to match for hardware-ban confirmation. This means:
- Single component swaps (new motherboard alone) rarely fix HWID bans — see will a new motherboard fix my HWID ban
- Spoofing 13+ identifiers gives high coverage — the remaining unspoofed identifiers (TPM, Pluton) are typically not yet used as composite anchors
- Single-component spoofers (volume serial only, MAC only) provide minimal protection
How anti-cheats read these
EAC reads identifiers via standard Windows APIs (WMI, SetupAPI, NDIS) plus their kernel driver for Ring-0 reads. BattlEye takes a similar approach. Vanguard runs from boot via ELAM and has the earliest access to identifier reads. NeacSafe and Activision Ricochet are similar architecture. All five read most of the 16 above.
What's coming
The forward-looking concern: TPM 2.0 EK and Microsoft Pluton becoming primary fingerprint anchors. If anti-cheats shift to TPM-based hardware bans (technically feasible today, not standard practice in 2026), user-mode spoofers lose effectiveness. The mitigation paths are hypervisor-based spoofing (kernel-level, harder to detect), physical TPM replacement (modular TPM chips on some motherboards), or hardware swap.
What this means practically
For 2026 workflow:
- Raw Spoofer's coverage of 13+ identifiers handles the current threat model
- Cold boot before every session ensures identifiers are randomized fresh
- The unspoofable identifiers (TPM EK, Pluton) are not yet ban anchors — that may change in 2027+
- Single-component "spoofers" sold by sketchy vendors are insufficient
For the full HWID picture see the HWID spoofer pillar. For what Raw Spoofer specifically does see what is Raw Spoofer and how do I install Raw Spoofer.
Related Pages
Sources
- TPM 2.0 Overview — Microsoft
- Microsoft Pluton Security Processor — Microsoft
- About Easy Anti-Cheat — Epic Games
Related Questions
Run Raw Spoofer on cold boot before every cheat session to randomize 16 hardware identifiers (SMBIOS, motherboard serial, disk serials, MAC addresses, GPU UUID, MachineGuid, RAM SPD, monitor EDID). Use a paid cheat (free cheats trigger detections faster). Configure aimbot and ESP with humanizer settings — aggressive tuning gets accounts flagged which can escalate to hardware bans. Don''t run the cheat without the spoofer. The 4 seconds per session is the difference between recoverable and permanent damage.
Cold boot Windows before launching anything, right-click the Raw Spoofer binary and select Run as administrator, paste your spoofer license into the activation field, and click Spoof. The tool randomizes 16 hardware identifiers including SMBIOS UUID, motherboard serial, disk serials, MAC addresses, GPU UUID, MachineGuid, RAM SPD, and monitor EDID in about 4 seconds. Reboot is not required. Launch your cheat loader and game afterward.
Yes, every session if you have ever been hardware-flagged, and as cheap insurance even if you haven''t. Cold boot Windows, run Raw Spoofer as administrator before opening Steam, Epic, Battle.net, or NetEase. The spoof persists until reboot. Skipping the spoofer means one signature detection bans your hardware permanently across every account on that machine. The 4-second spoof time per session is the cheapest insurance in the cheat workflow.
No. A Windows format and reinstall clears the OS but leaves firmware-rooted hardware identifiers (SMBIOS UUID, motherboard serial, disk serials, MAC addresses, GPU UUID, TPM endorsement key) untouched. The anti-cheat reads these from the hardware, not from Windows. Fresh Windows install presents the exact same fingerprint to the anti-cheat. The real fix is an HWID spoofer (Raw Spoofer randomizes 16 identifiers in 4 seconds) or physical hardware replacement.
Rarely on its own. A new motherboard changes SMBIOS UUID, motherboard serial, and BIOS strings — but disk serials, MAC addresses on USB and discrete NICs, GPU UUID, RAM SPD, monitor EDID, TPM EK, and MachineGuid all carry over. Anti-cheats fingerprint composite matching across 16+ identifiers, requiring 5-8 matches to flag — single-component swap usually leaves enough matching identifiers to re-ban. Full hardware swap or an HWID spoofer is needed.
