Whats the Difference Between Volume Serial and SMBIOS Spoofing?
Volume serial is a 32-bit number Windows generates per-partition at format time and stores in the disk's filesystem metadata — randomized via registry hooks or filesystem driver writes. SMBIOS is the firmware-baked identifier table (UUID, motherboard serial, BIOS strings) read via NtQuerySystemInformation class 76. Volume serial is trivially spoofable from user mode; SMBIOS requires a kernel driver hook. Anti-cheats read both — a spoofer that handles only volume serial is incomplete.
This question matters because most cheap or free "HWID spoofers" only randomize volume serial — and call themselves complete spoofers in marketing copy. They are not. Anti-cheats read 16+ identifiers and volume serial is one of the easier ones; coverage of only that single value leaves the other 15 exposed. Here is the technical breakdown.
What volume serial actually is
Windows generates a volume serial number when a partition is formatted with NTFS, FAT32, exFAT, or ReFS. It is a 32-bit pseudo-random value derived from the system clock at format time, written into the filesystem header on disk, and exposed to user mode via GetVolumeInformation or by parsing the boot sector directly. It is not a hardware identifier — it is a software identifier baked into the filesystem at format. If you reformat a partition, the volume serial changes. If you clone a disk via dd, the volume serial copies. There is nothing physical about it.
Why anti-cheats read it
Volume serial is one signal in the broader fingerprint composite. EAC reads it via standard Windows API calls, BattlEye reads it via the filesystem driver path, NeacSafe reads it via the same APIs. Per the documented EAC research on adrianyy/EACReversing, volume serial is hashed alongside SMBIOS, motherboard, disk physical serial, MAC, and other values into the composite. Spoofing only the volume serial changes one number in the hash input — the other 15+ values remain unchanged and the composite hash still correlates strongly with the original identity.
What SMBIOS actually is
SMBIOS — System Management BIOS — is a firmware-published table of hardware information. The BIOS writes the SMBIOS table into memory at boot, populated from values baked into the motherboard's firmware at manufacture (UUID, serial, manufacturer, product) plus values read from the running hardware (BIOS version, BIOS release date, RAM module identities from SPD chips, etc.). Windows exposes the SMBIOS table via NtQuerySystemInformation class 76 (SystemFirmwareTableInformation) — a kernel-level API. The 16-byte SMBIOS UUID is the single most-tracked hardware identifier on a Windows PC, read by every kernel anti-cheat.
Why SMBIOS spoofing needs a kernel driver
The SMBIOS table sits in protected memory and is read via a kernel-mode API. Modifying the values returned to a caller requires a kernel driver that hooks NtQuerySystemInformation and substitutes spoofed values for the SMBIOS class. A user-mode spoofer cannot do this — it can only modify user-mode-visible registry values that mirror SMBIOS (which exist for legacy compatibility) but anti-cheats read the kernel API directly and ignore the user-mode registry copy. A real SMBIOS spoof requires a Windows Hardware Quality Labs signed driver, the same architecture as a legitimate kernel security tool.
The "spoofer" that only handles volume serial
A common pattern in the cheap-spoofer market: ship a small user-mode utility that rewrites the volume serial via a filesystem write, restart the user's PC, and call the job done. The utility costs $5-15 because it is trivial to write. The user runs it, sees the volume serial change, and assumes they are protected. They are not. The anti-cheat reads SMBIOS, motherboard, disk physical serial, MAC, GPU UUID, MachineGuid, RAM SPD, USB/PCI — every one of those identifiers is unchanged. The composite hash is essentially identical to the pre-spoof value. The spoof does not work. Many of the negative Trustpilot reviews on cheap spoofer brands trace to this pattern: customer paid, ran the tool, got banned anyway because only one identifier changed.
What complete spoofing requires
Per the ACM MATE 2025 BattlEye paper on BEDaisy.sys and the EAC research above, a complete spoof randomizes 16 categories at the kernel driver layer: SMBIOS (6 fields), motherboard serial, all disk physical serials, GPT/MBR layout, every MAC, GPU UUID, MachineGuid, Windows Product ID + install date, RAM SPD, USB controller IDs, PCI device IDs, monitor EDID. Volume serial is bundled within the disk-related coverage but is just one number among many. A spoofer that lists "volume serial randomization" as the headline feature is selling a fraction of what is needed.
How Raw Spoofer handles both
Raw Spoofer randomizes volume serial as part of the filesystem-level identifier sweep, alongside the SMBIOS kernel-driver hooks for the firmware-baked identifiers. The 16-category coverage list documented on the Raw Spoofer product page is the complete spoofable surface at the kernel-driver layer. A spoofer that handles SMBIOS without handling the smaller identifiers leaves gaps; a spoofer that handles only the smaller identifiers without SMBIOS is essentially non-functional.
Practical buying advice
When evaluating any spoofer, ask: does this product hook at the kernel driver layer? Does it specifically randomize SMBIOS UUID and serial? If the answer to either is no, the product is not a complete spoofer. Volume serial alone is the kindergarten level of HWID spoofing and any vendor selling that as the headline capability is shipping a product that will get you banned on first detection. The HWID Spoofer Complete 2026 Guide walks through the 16-identifier matrix and which anti-cheats read which values.
For the deeper architectural comparison, see How HWID spoofers work — driver, UEFI, and TPM techniques.
Related Pages
Sources
- EAC reverse-engineering repository — adrianyy / Adrian Yarygin
- Battling The Eye — BattlEye reverse-engineering — ACM MATE Workshop 2025
- Windows Storage Driver Reference — Microsoft
- GetVolumeInformation Win32 API — Microsoft
Related Questions
A 2026 kernel-driver HWID spoofer randomizes 16 categories: SMBIOS (UUID, serial, manufacturer, product, BIOS version, BIOS date), motherboard serial, all SATA + NVMe disk serials, GPT/MBR partition layout, every NIC MAC, GPU UUID and adapter LUID, MachineGuid, Windows Product ID + install date, RAM SPD serials, USB controller IDs, PCI device IDs, and monitor EDID. It cannot randomize TPM endorsement keys, Pluton attestation, or CPU ID via Ring-3.
An HWID spoofer loads a signed kernel driver before the anti-cheat does, then hooks the Windows kernel functions and IOCTLs anti-cheats use to read hardware identifiers — SMBIOS via NtQuerySystemInformation, disk serials via IOCTL_STORAGE_QUERY_PROPERTY, MACs via NDIS, MachineGuid from the registry. When the anti-cheat queries, it gets back randomized values instead of your real hardware. Real values restore on reboot.
Free HWID spoofers in 2026 are mostly infostealer malware — Lumma, Vidar 2.0, RedLine, StealC — disguised as spoofers. Microsoft's Digital Crimes Unit seized 2,300 Lumma distribution domains in May 2025, many hosting fake spoofer installers. Payloads exfiltrate Steam tokens, Discord tokens, browser passwords, crypto wallet keys. Average loss exceeds the cost of a year of paid spoofer. Getting banned in your game is the least bad outcome.
Raw Spoofer is RawCheats's in-house HWID spoofer — a signed kernel driver that randomizes 16 hardware identifier categories per session against EAC, BattlEye, NeacSafe, Warden, and Ricochet. It runs as an external process (not injected into the game), supports Windows 10 + 11 on Intel and AMD, and costs $4.99 per month. It does not spoof TPM EK, Pluton, or beat Vanguard — and we say so explicitly.
