How hardware identity is virtualized — and where it breaks
When a service says it recognises your machine, it is not looking at your machine. It is looking at a handful of values your machine reported, each from a different subsystem, and treating the combination as an identity. That distinction is the whole game.
What "hardware identity" is made of
A device profile is assembled from sources that were never designed to authenticate anything. Firmware exposes vendor, product and serial strings through its description tables. Storage controllers answer an identify command with a model and serial number. Graphics drivers hand out a device UUID. Network interfaces carry a MAC address. The operating system adds installation identifiers of its own, and volume GUIDs on top of that.
None of these were built as a root of trust. They are inventory fields. A field that exists to help an administrator label a laptop is being used to decide whether an account is a repeat offender, and it will behave exactly as well as that mismatch suggests.
Three places the answer can be changed
Because these values are reported rather than proven, they can be changed anywhere along the path between the hardware and the question.
Ring 3 — inside the process
The cheapest option: intercept the API call and return a different string. Requires no privileges beyond the target process, breaks nothing else on the system, and is trivially detected by asking the same question through a second path that the interception did not cover. Anything that only hooks one API is answering one question, not the question.
Ring 0 — a driver
A kernel driver can rewrite the values before user space ever sees them: firmware tables, storage identify responses, GPU identifiers, interface addresses. Done properly this is coherent — every path returns the same fabricated answer, so path diversity alone stops helping. Done sloppily, and it usually is, the fabrication is only applied where the author remembered to apply it.
Ring −1 — a hypervisor
A thin hypervisor presents an entire synthetic machine. The guest cannot inspect past the boundary because the CPU enforces it. What remains is not a value to compare but a shape: timing that is slightly too uniform, instructions whose cost profile does not match the CPU the guest claims to be, device topologies that no shipping product ever had.
The part that is genuinely hard: coherence
Faking one value is easy. Faking a set of values that all agree with each other is a different problem, because these fields are not independent — they are constrained by the physical products they came from.
- A mainboard string implies a chipset generation, which implies a plausible range of onboard network vendors. Claim one, contradict the other, and the set is inconsistent regardless of how convincing each field looks alone.
- Serial numbers are not random strings. Vendors use structured schemes — fixed lengths, character sets, plant and date segments. Random hex passes a glance and fails a format check.
- A GPU UUID that does not correspond to the reported device and vendor IDs is describing a card that does not exist.
- Most decisive of all: values are supposed to be boring. Real hardware identifiers do not change. One that changes between two reads inside a single session has told you more than any individual value ever could.
This is why detection built on a single strong identifier ages badly, while detection built on the relationships between many weak ones holds up. You are no longer asking "is this serial real", a question you cannot answer. You are asking "is this set of claims mutually consistent, and does it stay consistent over time" — which you can.
What this does not prove
A manipulated device profile is evidence of a manipulated environment. It is not evidence of cheating, and treating the two as the same thing is how anti-cheat systems earn their reputation for banning innocent people.
Virtual machines are ordinary. Corporate imaging normalises identifiers on purpose. Privacy tools exist and are legal. Refurbished hardware carries replaced components with mismatched provenance. Every one of those looks, from the outside, a little like an attacker being careless.
So the useful output of this class of detection is never a verdict on its own. It is a weighted signal that belongs next to other signals, with a retained record of what was observed, and a human decision at the end of it. An identifier check that automatically bans is a system that will eventually ban a player for buying a used graphics card.