HWID Spoofer for BattlEye — PUBG, R6, Tarkov, Arma 3, DayZ (2026)

The ACM MATE Workshop 2025 paper Battling The Eye became the first peer-reviewed BattlEye reverse engineering publication when it dropped — and it rewrote what serious cheat-buyers thought they knew about BattlEye's hardware fingerprint. The paper documented BEDaisy.sys reading the standard SMBIOS / disk / MAC composite, but also confirmed something most spoofer marketing never mentions: BattlEye runs a PCI configuration-space scan specifically tuned to fingerprint Xilinx 7-series FPGA chips — the silicon family that powers most consumer DMA cheat cards. The implication for HWID spoofers is direct: randomize PCI device values carelessly and you get flagged not as a HWID violator but as DMA hardware, which is a worse ban category.

This post is a cluster of the HWID Spoofer Complete 2026 Guide pillar. The pillar covered the per-AC matrix; this piece is the deep read on BattlEye specifically.

What BattlEye Reads at the Kernel Level

BEDaisy.sys is BattlEye's kernel driver. It loads alongside the protected game and operates at ring 0 with the same privilege as EAC, Vanguard, and Ricochet. The ACM MATE 2025 paper documents its hardware-read paths and the composite construction methodology.

The reads:

SMBIOS firmware tables. Same as EAC — NtQuerySystemInformation class 76 plus direct firmware-table parse. Returns Type 0 (BIOS), Type 1 (System), Type 2 (Baseboard), Type 17 (Memory Device per-DIMM, specifically for Tarkov and Arma 3 tournament integrations).

Disk serial numbers. BattlEye issues IOCTL_STORAGE_QUERY_PROPERTY with StorageDeviceProperty to each connected disk. Returns the manufacturer-provided serial string for SATA and NVMe drives. This is the standard storage-side read every modern AC uses.

MAC addresses. NDIS-level read of every connected NIC. Cross-referenced against the NetworkAddress registry value. Same dual-path approach EAC uses — discrepancy between the two paths is the detection signal.

MachineGuid + Windows install state. Standard registry reads.

GPU device ID. DXGI adapter enumeration.

PCI configuration-space scan. This is where BattlEye diverges from EAC. BEDaisy walks every PCI device on the bus and reads each device's full 256-byte configuration space — VID, DID, subsystem vendor / device, class code, BARs, and the vendor-specific extended capability blocks. This data is used for two purposes simultaneously: hardware identification (the standard HWID-composite use) and DMA-card fingerprinting (the BattlEye-specific use).

Xilinx 7-series FPGA detection. The PCI scan includes specific signature matching against the Xilinx 7-series chip family (XC7K, XC7V, XC7Z), which is the silicon underneath virtually every consumer-grade DMA cheat card on the market. The detection uses a combination of subsystem device ID, BAR configuration, and the configuration-space pattern that the Xilinx 7-series presents to the host bus.

The composite construction follows the same model as EAC: normalize, concatenate, hash. The final hash goes to BattlEye's servers for ban-list comparison. The PCI-scan results are stored separately and used for real-time DMA-card detection independent of the HWID composite.

Games Currently Covered by BattlEye

BattlEye protects a different game portfolio than EAC. The major 2026 titles:

• PUBG: Battlegrounds (Krafton — the original BattlEye flagship)
• Rainbow Six Siege (Ubisoft)
• Escape from Tarkov (Battlestate Games)
• Arma 3 (Bohemia Interactive — also covers Arma Reforger transition)
• DayZ (Bohemia — sometimes runs both BattlEye and EAC depending on server)
• Conan Exiles (Funcom)
• War Thunder (Gaijin)
• Squad (Offworld — server-side opt-in)
• Several mid-tier titles

The cross-game ban propagation for BattlEye is less aggressive than EAC's — most publishers using BattlEye treat ban lists as game-specific. A Tarkov BattlEye ban doesn't automatically lock you out of PUBG. But the same fingerprint is being read by both, so the same composite will match against both ban lists if BattlEye servers cross-reference. In practice, propagation is publisher-decided and usually limited.

Why BattlEye's PCI Scan Matters for Spoofer Design

A naive spoofer hooks PCI configuration-space reads and returns randomized VID/DID values. This breaks against BattlEye in two ways:

Failure mode 1 — DMA-flag collision. If the spoofer's randomized PCI values happen to match the Xilinx 7-series signature pattern, BattlEye flags you as DMA hardware instead of HWID. DMA flags carry harsher consequences than HWID — most publishers treat DMA detection as evidence of physical hardware cheating, which gets escalated to permanent bans plus, in tournament contexts, prize-money clawback.

Failure mode 2 — sentinel value detection. PCI scanners flag specific sentinel patterns that buggy spoofers return — all-zeros configuration space, all-FFs configuration space, the well-known invalid-device patterns. A spoofer that returns these gets caught instantly.

A working BattlEye spoofer needs to randomize PCI values WHILE avoiding both the DMA-flag space AND the sentinel space. The available randomization range is constrained by what real legitimate hardware actually presents. This is the kind of engineering detail that separates a real spoofer from a fake one.

Raw Spoofer's PCI randomization specifically dodges the DMA-collision space — we've mapped the Xilinx 7-series signature pattern from public datasheet sources plus the ACM MATE 2025 paper, and our randomization pool excludes any combination that lands inside it. This is part of the in-house engineering work we do across the lineup; vendors who buy their spoofer from upstream resellers don't have visibility into this constraint and frequently get customers DMA-flagged accidentally.

Game-Specific Quirks Under BattlEye

PUBG: Battlegrounds. Standard BattlEye integration. Ban-wave cadence is bi-weekly. Krafton historically takes BattlEye bans hard — appeals are rare to land successfully. Krafton's tournament tier (PGC, PNC) adds additional server-side telemetry. See our Raw PUBG product for PUBG-specific tuning.

Rainbow Six Siege. Ubisoft uses BattlEye as the kernel layer plus their own BattlEye-Plus extension (the same name as the AC but separate from the off-the-shelf BattlEye SDK that other publishers use). The R6 integration reads slightly more — including monitor EDID and USB controller IDs for the rank-leader tier. Ban-wave cadence is monthly with periodic mass-wave events.

Escape from Tarkov. Battlestate's anti-cheat operates on three layers: BattlEye kernel (standard), Battlestate's in-house behavioral overlay (server-side), and a periodic "wipe" ban-wave at major patch transitions. The April 2026 anti-cheat overhaul announcement included TPM 2.0 + Secure Boot requirements going forward, which adds Vanguard-tier identifier reads on top of the standard BattlEye composite. This makes Tarkov 2026+ the hardest BattlEye-protected target by a meaningful margin.

Arma 3. Bohemia's BattlEye integration is mature and stable. Standard composite. Ban-wave cadence is irregular but server-admins routinely run their own ban lists alongside the global one.

DayZ. Some servers run EAC, some run BattlEye, some run neither. Server-side enforcement varies. The hardware identifiers being read are the same as the standard BattlEye composite regardless.

Conan Exiles, War Thunder, Squad. Standard BattlEye. Cross-game ban propagation is title-publisher decided. Most don't propagate beyond their own title.

What a Working BattlEye Spoofer Needs

For 2026, the working identifier coverage against BattlEye is:

• SMBIOS Type 0, 1, 2 — UUID, motherboard serial, manufacturer, product, BIOS version. Hooked at both Windows API and direct firmware-table paths.
• SMBIOS Type 17 — RAM SPD per-DIMM serials. Specifically required for Tarkov 2026+ and Arma 3 tournament tier.
• Disk serials — IOCTL path plus registry path.
• MAC addresses — NDIS path plus registry path.
• MachineGuid — registry write.
• Windows install state — Product ID and install date.
• GPU device ID — DXGI hook.
• PCI configuration space — randomized in a DMA-flag-safe and sentinel-safe range.
• Monitor EDID — for R6 Siege rank-leader tier and Tarkov 2026+.
• USB controller IDs — for R6 Siege rank-leader tier.

Raw Spoofer covers all 10 categories. The PCI randomization is specifically engineered to dodge BattlEye's DMA-flag space; the RAM SPD coverage was added for Tarkov 2026+ compatibility ahead of Battlestate's announced TPM mandate.

TPM Coverage for Tarkov 2026+

Battlestate's April 2026 anti-cheat overhaul announcement included Secure Boot + TPM 2.0 requirements going forward. The TPM endorsement key read isn't randomizable by any commercial spoofer in 2026 (only Samuel Tulach's tpm-spoofer POC attempts it, and it's research-grade unstable). Raw Spoofer does NOT randomize TPM EK — we're explicit about this.

What we do support: the rest of the Tarkov 2026+ identifier set (SMBIOS, motherboard, disks, MACs, GPU, RAM SPD, MachineGuid, plus PCI dodging DMA flags) is fully covered. The practical implication is that Raw Spoofer gives you back the BattlEye-composite portion of the Tarkov ban after a HWID detection; the TPM-EK portion is fixed by your hardware. If you've been TPM-EK banned by Tarkov specifically, you need either hardware swap (replace the motherboard, which has the TPM chip in most consumer boards) or wait for the post-Pluton spoofer generation. We don't sell fairy tales.

What Raw Spoofer Does Against BattlEye

Sixteen identifier categories at the kernel-driver layer, of which the BattlEye-relevant subset is 10: SMBIOS (5 sub-fields), motherboard serial, all disk serials, every NIC's MAC, GPU UUID, MachineGuid, Windows Product ID + install date, RAM SPD serials, USB controller IDs, PCI device IDs (in DMA-safe range), monitor EDID.

External architecture — runs as its own process, never injects into the game or BEDaisy. In-house engineering — same SDK as our Raw PUBG product and the rest of the lineup. Cross-vendor compatibility — works on Intel and AMD CPUs, Intel/AMD/NVIDIA GPUs, Windows 10 and 11. Signed driver — Secure Boot stays enabled, which matters for Tarkov's upcoming TPM mandate.

What Raw Spoofer does NOT cover for BattlEye: TPM EK (no commercial spoofer credibly does), Pluton root of trust (not consumer-spoofable), Microsoft Remote Attestation (silicon-rooted; not currently in BattlEye scope but watch for future expansion).

Frequently Asked Questions

Does Raw Spoofer prevent DMA-detection collisions with BattlEye?

Yes. Our PCI randomization explicitly avoids the Xilinx 7-series signature space that BattlEye uses to flag DMA cards. This is an in-house engineering detail that most reseller-spoofer brands don't handle, which is why some of their customers eat DMA flags from random PCI value collisions. The deeper how HWID spoofers work cluster covers the engineering tradeoffs in this space.

Will Raw Spoofer survive Tarkov's April 2026 anti-cheat overhaul?

For the BattlEye-composite portion, yes. For the TPM-EK portion that Battlestate announced going forward, no — and we're explicit about this. No commercial spoofer credibly randomizes TPM EK in 2026. If TPM 2.0 enforcement at Tarkov reaches the level Vanguard operates at, Raw Spoofer plus a hardware-level TPM intervention will be required, and we'll communicate when that gap matters.

Are R6 Siege bans BattlEye-only or also Ubisoft?

Both. Ubisoft maintains their own account-level ban infrastructure on top of BattlEye's hardware-level enforcement. A R6 ban can be Ubisoft-account-level (fresh account fixes), BattlEye-hardware-level (Raw Spoofer fixes), or both stacked. The What Is an HWID Ban cluster has the diagnostic checklist.

Does BattlEye cross-game ban propagation work like EAC's?

Less aggressively. EAC's cross-game ban list is opt-in but most publishers opt in because it's the value proposition. BattlEye's cross-game propagation is less common — most BattlEye-publishers treat their bans as title-specific. PUBG bans don't automatically lock you out of Tarkov. The same fingerprint hash is being read across both, so the cross-reference COULD happen at BattlEye's discretion, but in practice it usually doesn't.

Can I run Raw Spoofer with Secure Boot enabled for Tarkov?

Yes. Raw Spoofer's driver is signed and works with Secure Boot ON. This is required for Tarkov's announced TPM 2.0 mandate (Secure Boot enabled is a prerequisite for TPM 2.0 enforcement) and for any future BattlEye tightening that mandates Secure Boot. Vendors that require Secure Boot OFF for their spoofer are shipping older / unsigned drivers and won't survive 2026's tighter ACs.

Is PUBG's BattlEye different from Tarkov's BattlEye?

Same underlying kernel driver (BEDaisy.sys). Different per-game configuration on top — PUBG reads the standard composite, Tarkov 2026+ extends to RAM SPD plus the upcoming TPM additions. The spoofer-relevant difference is which identifier categories you need to cover; the architectural approach is the same.

Does BattlEye ban for VPN use?

Not directly. BattlEye doesn't flag IP addresses as a HWID component. Publishers (Krafton, Battlestate, Ubisoft) may have their own anti-VPN policies at the account level, but the BattlEye fingerprint itself doesn't include IP. The deeper recovering from a hardware ban workflow cluster covers the first-session VPN hygiene step.

---

BattlEye is a different problem set than EAC. Same kernel-driver architecture, different per-AC identifier emphasis, plus the PCI DMA-flag risk that demands careful spoofer engineering. Raw Spoofer covers the full BattlEye composite at the kernel-driver layer with DMA-collision-safe PCI randomization. Pair it with Raw PUBG for PUBG specifically or any of our other game cheats for cross-title coverage.