# Hwid Identifier Surfaces

> Methods for retrieving PC unique identifiers used by anti-cheats: disk, SMBIOS, NIC, GPU, TPM, Windows product, volume, firmware tables.

- Skill: `netvar1337/hwid-identifier-surfaces` (Agent Skill)
- Install (CLI): `npx skillmds@latest add netvar1337/hwid-identifier-surfaces`
- Raw SKILL.md: https://api.skillmd.com/api/skills/netvar1337/hwid-identifier-surfaces/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- License: GPL-3.0-or-later
- Author: netvar1337 (https://skillmd.com/u/netvar1337)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/netvar1337/hwid-identifier-surfaces

---


# HWID / unique identifier surfaces

Research map of identifiers anti-cheats and ban systems commonly fingerprint. Operator-authorized lab use.

## Common ID families
| Family | Examples | Typical APIs / sources |
|---|---|---|
| Disk | serial, model, bus path | `IOCTL_STORAGE_QUERY_PROPERTY`, SCSI inquiry, NVMe identify |
| Volume | vol serial | `GetVolumeInformation` |
| SMBIOS/DMI | UUID, serial, baseboard | `GetSystemFirmwareTable('RSMB')`, WMI `Win32_*` |
| NIC | MAC, permanent addr | `GetAdaptersAddresses`, OID queries |
| GPU | BIOS/serial/UUID | DXGI/setupapi, vendor IOCTLs |
| CPU | microcode/IDs (weak alone) | CPUID leaves |
| TPM | EK/AK names, PCRs | TBS/TPM2.0 capability queries |
| Windows | MachineGuid, ProductId, SQM | registry `Cryptography\MachineGuid`, etc. |
| Monitor/EDID | display serials | setupapi monitor |
| USB | device instance IDs | setupapi |
| EFI | variable-backed IDs | firmware vars (when accessible) |

## Collection hygiene (research harness)
- Log **source + raw + normalized** form for each ID
- Note privilege level required (user vs admin vs kernel)
- Capture whether value survives reinstall / disk clone / VM move
- Never assume one ID is "the HWID" — ACs combine features

## Ban-stack relevance
- User-mode collectors vs kernel collectors
- Remote services may hash/salt server-side
- Spoofing one field while leaving correlated fields is often fingerprinted

## Pair with
`tpm-attestation-research`, `eac-ban-stack`, `anti-cheat-bypass`, `windows-internals`.

## Refs (public threads / topics)
- UC: methods retrieving unique identifiers / HWIDs
- UC: serials & EAC/FN ban discussions