[Free Guide] Manually spoofing serials

[theminkman]

Originally Posted by gnihar

Would completely uninstalling discord and run web only version help with this.

Also, can you guys recommend a proper steam cleaner or provide a working method how to erase all steam traces from any previous accounts?

Revo uninstaller, but I dont advise playing on the same system without formatting

Originally Posted by SauceMachine

Tried telling you this time and time again and you still refused to listen. EAC does not ban or query GPU serials the way you kept claiming. Your testing is flawed, your conclusion is wrong, and you're ignoring people who actually reverse EAC and provide code-backed information rather than misinformation.

No offense but I do not take anything you say serious due to your detection history.

You have been more Detected then Undetected, even back in 2022-2023 days when all other spoofers was working such as Baunti

[ZSOFTWARE]

Originally Posted by theminkman

Revo uninstaller, but I dont advise playing on the same system without formatting



No offense but I do not take anything you say serious due to your detection history.

You have been more Detected then Undetected, even back in 2022-2023 days when all other spoofers was working such as Baunti

Great go check these IOCTLS in nvlddmkm.sys, then you will know if he is right or wrong

23201B
23241B

also TPM is being queried by EAC too, your guide should probably say it should be off in bios
also you are missing a EDID for a device that is on everyones motherboard
also are you sure the ethernet adapters mentioned on your list wont leak your ARP table?

Point here is you probably have less of a clue of what is actually being used by EAC than him, so stop **** talking

[yugorin]

nice ty bros

[theminkman]

Originally Posted by ZSOFTWARE

Great go check these IOCTLS in nvlddmkm.sys, then you will know if he is right or wrong

23201B
23241B

also TPM is being queried by EAC too, your guide should probably say it should be off in bios
also you are missing a EDID for a device that is on everyones motherboard
also are you sure the ethernet adapters mentioned on your list wont leak your ARP table?

Point here is you probably have less of a clue of what is actually being used by EAC than him, so stop **** talking

TPM is not required to be disabled, fTPM is yes.

"also you are missing a EDID for a device that is on everyones motherboard"
Are you referring to integrated graphics? that is on your CPU not motherboard on modern systems.

"also are you sure the ethernet adapters mentioned on your list wont leak your ARP table?"
I'm not worried about ARP tables but we are adding an updated guide on gitbook soon that will cover ARP table and routers that supports it

Sorry for offending the spoofer you are re-selling for 50 euro that is always detected.

LOL

Aint no way you come and talk **** to me when you dont even know EAC logs TPM

[ZSOFTWARE]

Originally Posted by theminkman

TPM is not required to be disabled, fTPM is yes.

"also you are missing a EDID for a device that is on everyones motherboard"
Are you referring to integrated graphics? that is on your CPU not motherboard on modern systems.

"also are you sure the ethernet adapters mentioned on your list wont leak your ARP table?"
I'm not worried about ARP tables but we are adding an updated guide on gitbook soon that will cover ARP table and routers that supports it

Sorry for offending the spoofer you are re-selling for 50 euro that is always detected

I am not reselling anything, I am just defending someone that has a proven track record in recent times. The point is we are sharing info that isnt based on experience, but hard evidence coming from reversing EAC. Sitting here and claiming anything without that type of evidence to back it up is stupid imo. You are spreading a mindset that is wildly misleading, all decent anti cheats build their solutions to combat bruteforcing / trial and error attempts to get around their checks. Just because something works and isn't getting you banned, does not mean it is correct. The only way to verify anything is looking at a anti cheats behavior and what they are collecting (RE). EAC does collect more then what they straight up ban for

EAC is directly querying for the ARP table, so they can use it if they want. With the mindset you have, shouldn't you be ultra worried about this?

Dont take this as a personal insult, I am just challenging you on the information you are providing, since you are so quick to do it to other people.

Edit to your update

Here is the difference mentioned before, I am actually verifiying this information instead of just looking at public knowledge. I won't make a claim that I can't back up. And yes i did have a breakpoint in the wrong place, the actual IOCTLs EAC is querying for tpm is 22C01C (tpm version) and 22C00C (get tpm)

[theminkman]

Originally Posted by ZSOFTWARE

I am not reselling anything, I am just defending someone that has a proven track record in recent times. The point is we are sharing info that isnt based on experience, but hard evidence coming from reversing EAC. Sitting here and claiming anything without that type of evidence to back it up is stupid imo. You are spreading a mindset that is wildly misleading, all decent anti cheats build their solutions to combat bruteforcing / trial and error attempts to get around their checks. Just because something works and isn't getting you banned, does not mean it is correct. The only way to verify anything is looking at a anti cheats behavior and what they are collecting (RE). EAC does collect more then what they straight up ban for

EAC is directly querying for the ARP table, so they can use it if they want. With the mindset you have, shouldn't you be ultra worried about this?

Dont take this as a personal insult, I am just challenging you on the information you are providing, since you are so quick to do it to other people.

So you are going against the spoofer "***" SauceMachine now as well?



Please just get out of my thread you are a nobody, if I can play EAC Rust without ban issues everyone can do the same using my methods, if people have ban issues we offer free help in our discord community.

You are just a clueless monkey that gather information on forums

[ZSOFTWARE]

Originally Posted by theminkman

So you are going against the spoofer *** SauceMachine now as well?



Please just get out of my thread you are a nobody, if I can play EAC Rust without ban issues everyone can do the same using my methods, if people have ban issues we offer free help in our discord community.

You are just a clueless monkey that gather information on forums

I never called him a ***, but he is at least trying to do things in a proper way, and hasn't give up like 99% of new providers do. He has been here for years, gained experience and proven he can make working products. Which demands respect, a lot more then whatever you are doing

In regards to the statement he made last year, maybe they werent querying it back then. I don't know, because I didn't work on a spoofer myself until recently. Do you know if they were? If he was wrong, so what? If nobody in this scene made mistakes, we would never have any detections. Your logic is not based in reality here

And lets say I am nobody, why does that matter in this context? I did not get this from a forum, but even if i did then why would it matter if i could back it up with RE?

[theminkman]

Originally Posted by ZSOFTWARE

I never called him a ***, but he is at least trying to do things in a proper way, and hasn't give up like 99% of new providers do. He has been here for years, gained experience and proven he can make working products. Which demands respect, a lot more then whatever you are doing

In regards to the statement he made last year, maybe they werent querying it back then. I don't know, because I didn't work on a spoofer myself until recently. Do you know if they were? If he was wrong, so what? If nobody in this scene made mistakes, we would never have any detections. Your logic is not based in reality here

And lets say I am nobody, why does that matter in this context? I did not get this from a forum, but even if i did then why would it matter if i could back it up with RE?

I just finished my reverse engineering on EasyAntiCheat and you wont believe what I found

Turns out that they are not only scanning for cheats, they are actively logging your DNA, *****, Saliva and Blood. I even traced the memory calls and they are cataloguing your genome like it is a rare Pokémon collection.

You really thought your Steam account was safe?

Your bloodstream is in the cloud now, gg bro

Oh ye btw I also took screenshots for you, FBI tier evidence for sure

Next time you complain about lag, just remember its not the game or your ****** cheat you are selling its them extracting your genetic material in real time.

[ZSOFTWARE]

Originally Posted by theminkman

I just finished my reverse engineering on EasyAntiCheat and you wont believe what I found

Turns out that they are not only scanning for cheats, they are actively logging your DNA, *****, Saliva and Blood. I even traced the memory calls and they are cataloguing your genome like it is a rare Pokémon collection.

You really thought your Steam account was safe?

Your bloodstream is in the cloud now, gg bro

Oh ye btw I also took screenshots for you, FBI tier evidence for sure

Next time you complain about lag, just remember its not the game or your ****** cheat you are selling its them extracting your genetic material in real time.

Thank you for putting a smile on my face, that was actually funny. have a good day bro

[ddrake999999]

Originally Posted by theminkman

TPM is not required to be disabled, fTPM is yes.

"also you are missing a EDID for a device that is on everyones motherboard"
Are you referring to integrated graphics? that is on your CPU not motherboard on modern systems.

"also are you sure the ethernet adapters mentioned on your list wont leak your ARP table?"
I'm not worried about ARP tables but we are adding an updated guide on gitbook soon that will cover ARP table and routers that supports it

Sorry for offending the spoofer you are re-selling for 50 euro that is always detected.

LOL

Aint no way you come and talk shit to me when you dont even know EAC logs TPM

buddy, i need to share this. a few weeks ago i was basically going crazy dealing with hwid bans. i tried almost every product on this forum — none of them lasted more than 3 days without getting hit with another hwid ban. i also checked your guide, but since my english isn’t great, it was pretty hard to follow.

then i saw zsoftware offering a trial for their rust product with a spoofer included — and somehow, it just worked. zsoftware is the only provider that actually helped me bypass hwid bans on rust and fortnite. he gave me a 1-week trial key, and during that week i used cheats pretty heavily and kinda obviously. i’m sure i got reported a lot, but i never got kicked from the game.

the only downside is that zsoftware’s spoofer only comes bundled with rust and it’s slot-limited. i can’t afford to buy it right now been spending way too much on fn tournaments lately.

Originally Posted by ZSOFTWARE

Thank you for putting a smile on my face, that was actually funny. have a good day bro

thanks for the 1-week trial, i really appreciate it — that was honestly crazy for me

[ZSOFTWARE]

Originally Posted by ddrake999999

buddy, i need to share this. a few weeks ago i was basically going crazy dealing with hwid bans. i tried almost every product on this forum — none of them lasted more than 3 days without getting hit with another hwid ban. i also checked your guide, but since my english isn’t great, it was pretty hard to follow.

then i saw zsoftware offering a trial for their rust product with a spoofer included — and somehow, it just worked. zsoftware is the only provider that actually helped me bypass hwid bans on rust and fortnite. he gave me a 1-week trial key, and during that week i used cheats pretty heavily and kinda obviously. i’m sure i got reported a lot, but i never got kicked from the game.

the only downside is that zsoftware’s spoofer only comes bundled with rust and it’s slot-limited. i can’t afford to buy it right now been spending way too much on fn tournaments lately.

AMD GPU's seem to have unique DSN's, tho i cant confirm due to lack of data



thanks for the 1-week trial, i really appreciate it — that was honestly crazy for me

I appreciate the kind words, but unfortunately it isnt working for everyone either. Been investigating the issue and it seems like a mixed bag. For some disabling TPM will do it, others you need to spoof the ARP table and Mac address (in a different way then usual) and then there is the last part i am trying to figure out still.

For thread owner but other spoofer devs, this might be interesting for you. EAC is collecting ACPI tables via ntoskrnl export HalAcpiGetTableEx, while most of this seems to be DMA, they do collect MCFG table at the same time as network related serials (MAC). Here you can find the physical address of your PCIE configuration space, which some DMA devs here might know can contain so called Device Serial Numbers (DSN). It could be entirely possible that EAC is just doing it for DMA, but them collecting it at the same time they do HWID checks and the massive potential (will explain later) behind using DSN's makes it quite likely they are at least collecting it

The issue with this is that DSN numbers are stored in memory that you can't modify in a traditional sense, so spoofing them might be out the window. perm spoofing these could be impossible on certain devices too. You could try and modify MCFG to give a different physical address, but it can be integrity checked incredibly easily. Only real way to accomplish fool proof spoofing here is with a hypervisor, from my observation

Originally Posted by ZSOFTWARE

I appreciate the kind words, but unfortunately it isnt working for everyone either. Been investigating the issue and it seems like a mixed bag. For some disabling TPM will do it, others you need to spoof the ARP table and Mac address (in a different way then usual) and then there is the last part i am trying to figure out still.

For thread owner but other spoofer devs, this might be interesting for you. EAC is collecting ACPI tables via ntoskrnl export HalAcpiGetTableEx, while most of this seems to be DMA, they do collect MCFG table at the same time as network related serials (MAC). Here you can find the physical address of your PCIE configuration space, which some DMA devs here might know can contain so called Device Serial Numbers (DSN). It could be entirely possible that EAC is just doing it for DMA, but them collecting it at the same time they do HWID checks and the massive potential (will explain later) behind using DSN's makes it quite likely they are at least collecting it

The issue with this is that DSN numbers are stored in memory that you can't modify in a traditional sense, so spoofing them might be out the window. perm spoofing these could be impossible on certain devices too. You could try and modify MCFG to give a different physical address, but it can be integrity checked incredibly easily. Only real way to accomplish fool proof spoofing here is with a hypervisor, from my observation

edit: important note, many devices don't have DSN's or they share them with others. so it is possible to make this HWID check useless by having the right machine. I have been collecting data from some users and there is a link between it

[SauceMachine]

Originally Posted by ZSOFTWARE

I appreciate the kind words, but unfortunately it isnt working for everyone either. Been investigating the issue and it seems like a mixed bag. For some disabling TPM will do it, others you need to spoof the ARP table and Mac address (in a different way then usual) and then there is the last part i am trying to figure out still.

For thread owner but other spoofer devs, this might be interesting for you. EAC is collecting ACPI tables via ntoskrnl export HalAcpiGetTableEx, while most of this seems to be DMA, they do collect MCFG table at the same time as network related serials (MAC). Here you can find the physical address of your PCIE configuration space, which some DMA devs here might know can contain so called Device Serial Numbers (DSN). It could be entirely possible that EAC is just doing it for DMA, but them collecting it at the same time they do HWID checks and the massive potential (will explain later) behind using DSN's makes it quite likely they are at least collecting it

The issue with this is that DSN numbers are stored in memory that you can't modify in a traditional sense, so spoofing them might be out the window. perm spoofing these could be impossible on certain devices too. You could try and modify MCFG to give a different physical address, but it can be integrity checked incredibly easily. Only real way to accomplish fool proof spoofing here is with a hypervisor, from my observation



edit: important note, many devices don't have DSN's or they share them with others. so it is possible to make this HWID check useless by having the right machine. I have been collecting data from some users and there is a link between it

Not really impossible but devices require a lot of extra work. We implemented this in July 2025.

[ZSOFTWARE]

Originally Posted by SauceMachine

Not really impossible but devices require a lot of extra work. We implemented this in July 2025.

I might just be retarded, but i tried writing to the dsn's and it seems to be getting ignored by the MMIO bullshit. Your only option then would be making a fake PCIE config space and isnt that just asking to get clapped? Good point tho, a lot of work, you can't just randomly spoof these either. Some are not unique kill me

[SauceMachine]

Originally Posted by ZSOFTWARE

I might just be retarded, but i tried writing to the dsn's and it seems to be getting ignored by the MMIO bullshit. Your only option then would be making a fake PCIE config space and isnt that just asking to get clapped? Good point tho, a lot of work, you can't just randomly spoof these either. Some are not unique kill me

Yeah, I wouldn’t go that route. A lot of those values can’t just be spoofed freely without breaking things, since the system actually relies on them for normal operation. Messing with them too much is more likely to brick stability than help.

[ddrake999999]

Originally Posted by ZSOFTWARE

I appreciate the kind words, but unfortunately it isnt working for everyone either. Been investigating the issue and it seems like a mixed bag. For some disabling TPM will do it, others you need to spoof the ARP table and Mac address (in a different way then usual) and then there is the last part i am trying to figure out still.

For thread owner but other spoofer devs, this might be interesting for you. EAC is collecting ACPI tables via ntoskrnl export HalAcpiGetTableEx, while most of this seems to be DMA, they do collect MCFG table at the same time as network related serials (MAC). Here you can find the physical address of your PCIE configuration space, which some DMA devs here might know can contain so called Device Serial Numbers (DSN). It could be entirely possible that EAC is just doing it for DMA, but them collecting it at the same time they do HWID checks and the massive potential (will explain later) behind using DSN's makes it quite likely they are at least collecting it

The issue with this is that DSN numbers are stored in memory that you can't modify in a traditional sense, so spoofing them might be out the window. perm spoofing these could be impossible on certain devices too. You could try and modify MCFG to give a different physical address, but it can be integrity checked incredibly easily. Only real way to accomplish fool proof spoofing here is with a hypervisor, from my observation



edit: important note, many devices don't have DSN's or they share them with others. so it is possible to make this HWID check useless by having the right machine. I have been collecting data from some users and there is a link between it

i have gotten out of the ban. i bought two more devices: an extra wifi router and a usb ethernet adapter. both cost about $15, very cheap. on the main router, i unplugged the power and waited about 10 minutes — my ipv4 was changed. then i connected to my pc through the two new devices, used a spoofer > boom. it’s been 5 days and i haven’t been banned again.
is it that all dev are having trouble with ARP NIC MAC issues? I guess so because it's almost day 6. I'm playing like crazy. No more getting kicked.