HWID / unique identifier surfaces
Research map of identifiers anti-cheats and ban systems commonly fingerprint. Operator-authorized lab use.
Common ID families
| Family | Examples | Typical APIs / sources |
|---|---|---|
| Disk | serial, model, bus path | IOCTL_STORAGE_QUERY_PROPERTY, SCSI inquiry, NVMe identify |
| Volume | vol serial | GetVolumeInformation |
| SMBIOS/DMI | UUID, serial, baseboard | GetSystemFirmwareTable('RSMB'), WMI Win32_* |
| NIC | MAC, permanent addr | GetAdaptersAddresses, OID queries |
| GPU | BIOS/serial/UUID | DXGI/setupapi, vendor IOCTLs |
| CPU | microcode/IDs (weak alone) | CPUID leaves |
| TPM | EK/AK names, PCRs | TBS/TPM2.0 capability queries |
| Windows | MachineGuid, ProductId, SQM | registry Cryptography\MachineGuid, etc. |
| Monitor/EDID | display serials | setupapi monitor |
| USB | device instance IDs | setupapi |
| EFI | variable-backed IDs | firmware vars (when accessible) |
Collection hygiene (research harness)
- Log source + raw + normalized form for each ID
- Note privilege level required (user vs admin vs kernel)
- Capture whether value survives reinstall / disk clone / VM move
- Never assume one ID is "the HWID" — ACs combine features
Ban-stack relevance
- User-mode collectors vs kernel collectors
- Remote services may hash/salt server-side
- Spoofing one field while leaving correlated fields is often fingerprinted
Pair with
tpm-attestation-research, eac-ban-stack, anti-cheat-bypass, windows-internals.
Refs (public threads / topics)
- UC: methods retrieving unique identifiers / HWIDs
- UC: serials & EAC/FN ban discussions