Change Monitor Serial

[thlmrk]

Hello friends

Today I share with you some knowledge

Today we go after perm spoofers in attemps to make them do better (because they're all **** and only use free methods to spoof your PC)

Today we look at the most common method for changing monitor serial, CRU (Custom Resolution Utility)

It's what the majority of, if not all perm spoof on the market use to spoof monitor serial.

EAC does not care about windows registry, they pull all serial (besides Windows Serial Key, and VolumeID) from WMI API using these commands "IoWMIOpenBlock"
"IoWMIQueryAllData"

Here is CRU, with a clearly changed serial number, device ID, and device ID serial number. And in the white box on the left, is my original monitor serial still being pulled from WMI.


So what does this mean for you? If your spoofer is using CRU to change your monitor serial it isn't actually being changed.
EAC for Apex Legends atleast uses a hash/token system that pulls a group of banned serials from your PC (this is the automated ban that happens in 2hrs of playtime). If enough of them are changed, you can play regular matched/ranked matches. It is only when they do a deeper check (what I like to call the ALGS check) that they actually check each individual component in your system to see if it's been flagged/banned before. And if it has, and you're being reported for cheating, you're banned.

So how do you actually change your monitor serial? You can perm flash the EDID on some monitors (Google it) but it's only on certain monitor, and I have not been able to successfully do it on mine.

Or the other option is, use a temp spoofer, since all perms on the market don't actually work for Apex Legends.

[GrawPoint]

What do you mean all perms on the market don't actually work for Apex? I've used Woofer and Sync for Apex and they worked fine.

[SauceMachine]

Originally Posted by thlmrk

Hello friends

Today I share with you some knowledge

Today we go after perm spoofers in attemps to make them do better (because they're all crap and only use free methods to spoof your PC)

Today we look at the most common method for changing monitor serial, CRU (Custom Resolution Utility)

It's what the majority of, if not all perm spoof on the market use to spoof monitor serial.

EAC does not care about windows registry, they pull all serial (besides Windows Serial Key, and VolumeID) from WMI API using these commands "IoWMIOpenBlock"
"IoWMIQueryAllData"

Here is CRU, with a clearly changed serial number, device ID, and device ID serial number. And in the white box on the left, is my original monitor serial still being pulled from WMI.


So what does this mean for you? If your spoofer is using CRU to change your monitor serial it isn't actually being changed.
EAC for Apex Legends atleast uses a hash/token system that pulls a group of banned serials from your PC (this is the automated ban that happens in 2hrs of playtime). If enough of them are changed, you can play regular matched/ranked matches. It is only when they do a deeper check (what I like to call the ALGS check) that they actually check each individual component in your system to see if it's been flagged/banned before. And if it has, and you're being reported for cheating, you're banned.

So how do you actually change your monitor serial? You can perm flash the EDID on some monitors (Google it) but it's only on certain monitor, and I have not been able to successfully do it on mine.

Or the other option is, use a temp spoofer, since all perms on the market don't actually work for Apex Legends.

Fair warning; stay clear of cru. This is edid override usermode spoofing and will be compared in kernel. It'll give you a flag at the very least. I had to counter this by writing a fixup/removal in Reported that automatically removes CRU(EDID_OVERRIDE) and TMAC bullshit because too many were using it while feeling smart

[thlmrk]

Originally Posted by SauceMachine

Fair warning; stay clear of cru. This is edid override usermode spoofing and will be compared in kernel. It'll give you a flag at the very least. I had to counter this by writing a fixup/removal in Reported that automatically removes CRU(EDID_OVERRIDE) and TMAC bullshit because too many were using it while feeling smart

My next thread will attack TMAC and all of it's glorious bullshit as soon as I figure out exactly what/how they're changing stuff.

[GrawPoint]

Wait so anticheats do actually target monitors? I thought it was a meme.

[SauceMachine]

Originally Posted by thlmrk

My next thread will attack TMAC and all of it's glorious bullshit as soon as I figure out exactly what/how they're changing stuff.

This is how it's done. It's a windows feature.
No magic involved, just a registry value.

[wilvin0]

Useless usermode stuff.

[ralosaimi]

Originally Posted by SauceMachine

Fair warning; stay clear of cru. This is edid override usermode spoofing and will be compared in kernel. It'll give you a flag at the very least. I had to counter this by writing a fixup/removal in Reported that automatically removes CRU(EDID_OVERRIDE) and TMAC bullshit because too many were using it while feeling smart

Im lost here ....so even we changed monitor serial we still getting banned ...I mean after perma spoof that i got by sync.top and still Im fine for third day ... any single report will they ban me ???

I trust report.lol for his own expeiences with these thing

[thlmrk]

Originally Posted by ralosaimi

Im lost here ....so even we changed monitor serial we still getting banned ...I mean after perma spoof that i got by sync.top and still Im fine for third day ... any single report will they ban me ???

I trust report.lol for his own expeiences with these thing

100% correct, when you are Diamond+ rank that's when the reports actually matter. So doesn't matter if it takes you 1day to reach Diamond+ or one month Diamond+. If you are perm spoofed, and they banned whatever was spoofed (mac, or monitor, or disk) and you're using a perm spoofer. I can 100% guarantee you that you will be banned for playing on banned HWID.

The ONLY things that work are temp spoofers.