What is a HWID Spoofer?
A HWID spoofer is a software tool that randomizes or replaces a Windows system's hardware identifiers — including disk volume serials, SMBIOS data, MAC addresses, motherboard UUIDs, and CPU/GPU identifiers — so that anti-cheat hardware fingerprinting reads a different machine than the one actually present. HWID spoofers are used by gamers who have received hardware-level bans to restore game access without buying new physical hardware. Modern spoofers operate primarily at the kernel level to reach identifiers that user-mode tools cannot reach.
A HWID spoofer is the engineering response to the modern hardware ban. When Riot Vanguard, Easy Anti-Cheat, BattlEye, or Activision Ricochet detect a cheater, they don't just ban the account — they record a fingerprint of the underlying machine and ban that fingerprint at the platform level, blocking the player from creating new accounts on the same hardware. A HWID spoofer's job is to change every identifier in that fingerprint so the next account creation reads as a different machine entirely.
What identifiers a HWID spoofer touches
A complete 2026 spoofer randomizes the following surface:
- SMBIOS data — manufacturer name, product name, BIOS version, serial number, system UUID, baseboard manufacturer/product/serial, chassis serial. Read via WMI
Win32_BIOS,Win32_BaseBoard,Win32_ComputerSystemProduct. - Disk identifiers — volume serial numbers, disk drive serial numbers, partition GUIDs. Read via
IOCTL_STORAGE_QUERY_PROPERTY,DeviceIoControl, NTFS volume metadata. - Network identifiers — MAC addresses on all physical and virtual adapters, NIC GUIDs.
- CPU identifiers — CPUID brand string, hypervisor present flag, microcode revision.
- GPU identifiers — adapter LUID, GPU device ID, driver registry serial.
- Display identifiers — EDID monitor serial, monitor manufacturer codes.
- TPM 2.0 / Pluton — endorsement key hash, attestation identity (the highest-difficulty target; covered in can a spoofer beat TPM 2)
How HWID spoofers work
The simplest spoofers patch user-mode WMI query results — they intercept the call site where anti-cheats fetch identifiers and return modified values. This approach is trivially detectable because the actual identifiers in memory and on disk remain unchanged. Modern spoofers run a signed kernel driver that intercepts identifier-fetching operations at the IRP level, modifying IOCTL_STORAGE_QUERY_PROPERTY responses, IOCTL_DISK_GET_DRIVE_LAYOUT_EX responses, and ACPI table reads for SMBIOS. The kernel driver runs before the anti-cheat scanner so the anti-cheat sees the spoofed values rather than the originals. Many spoofers also persist randomized values into bootloader registers or use ACPI table overlays to survive a reboot. We cover the full architecture in our HWID spoofer pillar.
Why HWID spoofers exist
Hardware bans are now standard. Riot reported 2.3 million HWID bans across Valorant and League of Legends in 2025; a five-day wave in January 2026 produced 340,000 additional Valorant HWID bans. Activision Ricochet, BattlEye, and Easy Anti-Cheat all implement equivalent hardware-level ban lists. Without a spoofer, a banned user has two options: buy a new motherboard plus a new GPU (the two highest-weighted fingerprint sources), or stop playing. A working HWID spoofer is cheaper than a new motherboard and resets the fingerprint in software.
Limitations and detection
HWID spoofers fail in three ways. First, signature-based detection: anti-cheats reverse-engineer popular spoofer drivers and add their signatures to scan lists, burning specific spoofer products. Second, TPM 2.0 attestation: the TPM signs a hardware identity at the chip level and a software spoofer cannot forge a TPM-signed report. Microsoft Pluton extends this. Third, hypervisor-level identifier read: an anti-cheat that runs above the operating system in a hypervisor (the direction Vanguard is moving) reads identifiers before the spoofer driver can intercept. For more on the TPM problem see what is TPM 2 and how does it affect cheating.
RawCheats positioning
Raw Spoofer is RawCheats' dedicated HWID spoofer product, kept current against the major kernel anti-cheats listed above. See Raw Spoofer for the product page and our HWID spoofer pillar for the architecture deep-dive.
Sources
- Working with Storage IOCTLs — Microsoft Learn
- TPM 2.0 Overview — Microsoft Learn
- Riot Competitive Integrity Update — Riot Games
Related Questions
The best HWID spoofer in 2026 is one that hooks at the kernel-driver layer, randomizes 16+ hardware identifiers per session, names the anti-cheats it covers (EAC, BattlEye, NeacSafe, Warden, Ricochet) and explicitly disclaims the ones it does not (Riot Vanguard, Microsoft Pluton, TPM endorsement keys). Raw Spoofer fits that profile at $4.99 and ships from the same in-house engineering team behind the six RawCheats game products.
An HWID spoofer loads a signed kernel driver before the anti-cheat does, then hooks the Windows kernel functions and IOCTLs anti-cheats use to read hardware identifiers — SMBIOS via NtQuerySystemInformation, disk serials via IOCTL_STORAGE_QUERY_PROPERTY, MACs via NDIS, MachineGuid from the registry. When the anti-cheat queries, it gets back randomized values instead of your real hardware. Real values restore on reboot.
Raw Spoofer is RawCheats's in-house HWID spoofer — a signed kernel driver that randomizes 16 hardware identifier categories per session against EAC, BattlEye, NeacSafe, Warden, and Ricochet. It runs as an external process (not injected into the game), supports Windows 10 + 11 on Intel and AMD, and costs $4.99 per month. It does not spoof TPM EK, Pluton, or beat Vanguard — and we say so explicitly.
An account ban suspends a specific game account — your Steam, Epic, Battle.net, or Riot login. Create a new account, you''re playing again. A hardware ban (HWID ban) blacklists your machine''s hardware identifiers — SMBIOS UUID, motherboard serial, disk serials, MAC addresses, GPU UUID, TPM endorsement key. Fresh accounts created on banned hardware get auto-banned within minutes. Hardware bans require either an HWID spoofer (Raw Spoofer randomizes 16 identifiers) or a different physical machine.
No. TPM 2.0 endorsement keys are signed by the TPM chip manufacturer at production and stored inside the chip itself — they cannot be rewritten from software. Anti-cheats that read TPM EK and PCR values (Vanguard, COD: Black Ops 7 via Remote Attestation, FACEIT, Fortnite tournaments) get a cryptographic identity no commercial spoofer can fake. The only public TPM-spoof attempt — Samuel Tulach's tpm-spoofer POC — is unstable research code.
