HWID (Hardware ID) bans are the nuclear option anti-cheat companies use after a soft ban fails. Here's what they actually ban and whether you need a spoofer.
What Gets Banned
Modern anti-cheats fingerprint several hardware identifiers:
- Disk serial numbers — each drive has a unique ID readable from Windows.
- NIC MAC address — your network card's hardware address.
- SMBIOS data — motherboard manufacturer, serial, UUID.
- GPU device ID — readable via DirectX/Vulkan.
- Volume GUIDs — Windows assigns these on partition format.
After a ban, they store a hash of these values. Even a fresh game install on the same hardware will re-ban you within minutes.
How Spoofers Work
A spoofer intercepts the Windows API calls that return hardware IDs and substitutes randomised values before they reach the game or anti-cheat. Kernel-level spoofers hook at the driver layer — the game sees completely fictional hardware.
Do You Need One?
No, if you haven't been banned yet — the cheat alone is enough.
Yes, if you've already received a hardware ban and want to return to the game on the same machine.
Using a spoofer pre-emptively adds detection surface (driver signatures). Only run it when you actually need it.
Free HWID Spoofer
The spoofer on Cosmo Cheatz handles disk serials, MACs, SMBIOS, and volume GUIDs. It's free, external, and tested against Valorant Vanguard, EAC, and BattlEye. Check status before running — kernel-level tools are the most patch-sensitive.
Serial Checksums and Validation Failures
Randomising a disk serial is not as simple as writing a fresh string. Many anti-cheats, Vanguard included, validate serial formats against known vendor patterns. A Seagate drive reports a serial with a specific length and character set, and a Samsung NVMe follows a different convention entirely. Spoofers that generate purely random alphanumerics often fail these checks because the value does not resemble any real manufacturer's output. ATA identify data also carries a firmware revision string and model number that must stay internally consistent with the spoofed serial. Mismatches between a fabricated serial and an untouched firmware field are a common detection vector. Volume GUIDs introduce a separate problem: Windows regenerates them on reformat, so a spoofed GUID that duplicates one from another machine on the same network can cause collision flags. Verification means checking the new values persist across a reboot and that Windows disk management reports them without errors in Event Viewer.
What Changed with Vanguard and Faceit
Anti-cheat vendors moved from passive fingerprinting to active probing over the past two years. Vanguard now queries SMART attributes directly through the storage driver rather than relying on the Windows API, which bypasses user-mode hooks entirely. Faceit's client added SMBIOS table consistency checks that compare the baseboard serial against the chassis asset tag; manufacturers ship these as a matching pair, so a spoofed baseboard with an untouched chassis tag is an instant flag. Easy Anti-Cheat introduced a check on PCI device enumeration order, since spoofed drivers sometimes alter the sequence hardware appears in the device tree. BattlEye's kernel module now hashes driver object pointers for storage miniports. These changes mean a spoofer that worked against a 2022 build of any of these may pass a superficial test but fail a live match. Reading changelogs after each anti-cheat update is more useful than assuming a tool remains valid.
Testing Spoofs Before Launching a Game
A spoofer can report success while leaving identifiers partially exposed. Confirm results with independent tools rather than the spoofer's own status panel. PowerShell's Get-CimInstance Win32_DiskDrive returns the serial Windows exposes; check that value against what the spoofer claims. For MAC addresses, ipconfig /all shows the adapter's current hardware address, and you should verify it differs from the physical label on the NIC. SMBIOS values can be read with the wmic csproduct get uuid and wmic baseboard get serialnumber commands, though deprecated builds of wmic need enabling through the optional features panel on Windows 11. GPU identifiers require a tool such as GPU-Z, which reads the device ID straight from the PCI configuration space. Cross-reference every value before opening the game. A partial spoof, where three of five identifiers change, is worse than none because the inconsistency itself becomes the signature.