A hardware ban (HWID ban) records identifiers from your PC — disk serial numbers, MAC address, GPU and CPU IDs, motherboard UUID. Even if you make a new account, the game recognizes your machine and bans it again. An HWID spoofer changes those identifiers temporarily.
What Gets Spoofed
- Disk Serial: Each drive has a unique factory serial. This is the most commonly checked ID.
- MAC Address: Network adapter identifier. Easy to spoof, commonly checked.
- GPU ID / VRAM serial: Less common, but used by some anti-cheats (Vanguard).
- Motherboard UUID: Unique per board. Checked by EAC and Battleye in strict mode.
- Volume GUID: Windows-generated per-install identifier.
How to Use It
- Download the free spoofer from CosmoCheatz
- Run as Administrator before launching any game
- Create a fresh game account on a new email
- Launch the game — anti-cheat sees a "new" machine
- The spoof resets on reboot, so run it each session
Supported Games
Works with Valorant (Vanguard), CS2 (VAC), Apex Legends (EAC), Warzone, PUBG, Fortnite, Rust, and 40+ other titles.
Verifying the spoof actually took effect
A spoof that silently fails is worse than none at all, because you have burned a fresh account on a machine the anti-cheat still recognises. Check the values directly before you launch anything. Disk serials can be read with wmic diskdrive get serialnumber or, on newer Windows builds where wmic is deprecated, PowerShell's Get-PhysicalDisk | Select-Object SerialNumber. Confirm the MAC address changed via getmac /v or the adapter's properties page — a driver-level spoof should alter what ipconfig /all reports, not just the registry key. Motherboard UUID is visible under wmic csproduct get uuid. Compare against a screenshot taken before running the spoofer. If any identifier is unchanged, the tool lacked the privilege level it needed, usually because Driver Signature Enforcement blocked its kernel component. Event Viewer's System log will show a driver load failure at boot if that is the case.
Why Riot Vanguard breaks most spoofers
Vanguard runs as a kernel-mode driver loaded at boot, before user-mode processes exist, and it re-validates hardware identifiers continuously rather than only at login. A spoofer that hooks user-mode APIs will not touch what Vanguard reads. It also fingerprints the spoofing attempt itself: mismatched SMBIOS strings, a disk serial that fails its own checksum, or a MAC address in the locally-administered range (second-least-significant bit of the first octet set) are all flags. Vanguard additionally records the TPM endorsement key and Secure Boot state on Windows 11, neither of which most free tools address. In practice this means a Valorant hardware ban needs a TPM-aware spoofer or a clean TPM clear combined with the disk and SMBIOS changes. Expect this class of anti-cheat to require more than a single click each session.
Where free spoofers commonly fail
The failure modes are consistent. Attack Surface Reduction rules in Windows Defender block the unsigned drivers many free tools depend on, producing a silent no-op rather than an error. Windows 11 24H2 tightened driver blocklisting, so tools built for 22H2 often refuse to load without a manual test-signing boot, which itself is detectable. Some spoofers change the disk serial in the registry only; games reading the drive directly via IOCTL_STORAGE_QUERY_PROPERTY see the real value. Others randomise the volume GUID but leave the volume serial number intact, and EAC reads both. A reboot restoring original values catches people who launch the game from a desktop shortcut without rerunning the tool, particularly with Fast Startup enabled, which does not fully reinitialise drivers. Disable Fast Startup in the power settings if the spoof appears to persist incorrectly or fail after a shutdown.