# How Bans Work ## Hardware Bans & Modern Anti-cheat Measures Modern anti-cheat software vendors issue hardware bans, leaves trace files, and they track the PC in many other ways. These bans have multiple sophisticated techniques for tracking the user between bans. To fully bypass a ban, you must understand which techniques these anti-cheat vendors deploy to track the PC. ## Ban Enforcement Methods ### Flagged Hardware These bans are flags that automatically target the PC. They are stored on the anti-cheat vendor's servers on the internet in the cloud and cannot be removed. Hardware, such as: * hard drive (HDD), solid state drive (SSD), flash storage (NVME) * network card (NIC) * processor (CPU) * graphics card (GPU), etc. ...all have MAC addresses. These addresses are hard-coded into the device and are not designed to be changed. Thus, this is a consistent and reliable way to track users and issue bans that stick and can be difficult to bypass. This is what is flagged. These are known as hardware or hardware identifier (HWID) bans.

PC components affected by hardware bans. (not the ribbon cable)

#### How can I remove hardware flags? The quickest and easiest way (takes less than 5 minutes): [use the spoof function of our Spoofer tool](https://dexa.im/products/hardware-spoofer). The cheap way? Research free spoofer tools on the internet. {% hint style="warning" %} **Be advised:** these spoofers are *not* updated by a dedicated, experienced reverse-engineering team who's entire job is solely keeping track of the latest flags issued by modern anti-cheat. You will run into cases where the free spoofer does not spoof some or all of the tracked components. Second, free spoofers can be deployed with malware and viruses. Keep in mind what a spoofer is doing - it is changing *deep* components of your PC. We highly recommend you do not use free spoofer tools. {% endhint %} ### Trace Files Some anti-cheat vendors will also deploy trace (or tracking) files into your system. These files can be embedded deep within the PC's operating system (in the kernel). These files are often difficult to remove and require deep experience in reverse engineering to identify and successfully remove. Additionally, these trace files are ever-changing between updates by the anti-cheat which in most cases are not published to the public.

Eww, trace files!

#### How can I remove all trace files? The quickest and easiest way (takes less than 5 minutes): [use the clean function of our Spoofer tool](https://dexa.im/products/hardware-spoofer). The cheap way? Do a [Clean Windows Install](/learn/resources/windows-10-and-11-guides/clean-windows-install.md). ### IP address While IP bans are unreliable (most internet service companies issue [dynamic IPs](#user-content-fn-1)[^1]), some anti-cheat vendors opt for this method. Your PC has an address, much like a house. When an anti-cheat vendor bans the IP address, the PC is flagged.
#### How can I bypass IP address bans? Easy, use a [VPN](https://go.nordvpn.net/SH8k3). Or, unplug your modem/router for 5 minutes. {% embed url="" %} ### Ban Enforcement Obfuscation Anti-cheat vendors employ multiple methods to hide what is causing a ban. These include: * delayed bans (hours, days, or even weeks) * ban waves, thousands of users banned at once - often combining two *or more* cheat brands into one ban wave to further confuse cheat developers ## What does a Hardware Spoofer do? As the name suggests, a hardware spoofer tool randomizes PC identifiers like the MAC addresses of the PC's components, SMBIOS identifiers, and so on. Some spoofers, such as ours, deploy other additional mechanisms to help mitigate bans.

Wow! A motherboard!

## Types of Spoofers Spoofing software comes in two flavors: temporary and permanent. ### Temporary Hardware Spoofers Temporary hardware spoofers, work *temporarily*. Any changes made by the spoofer are reverted to normal when the PC is rebooted. Temporary spoofers are the *least invasive* and *safest way* to spoof. They will not affect the licensing of the software you use, Windows, or the hardware's functionality. We *always* suggest using a temporary spoofer. {% embed url="" %} ### Permanent Spoofers Permanent spoofers are typically a one-time use. These will permanently change the MAC addresses and other identifiers of the PC. The downside of permanent spoofers is that they can cause permanent issues with your hardware. MAC addresses aren't designed to be permanently altered; by doing so, you introduce irreversible changes to your PC's hardware. {% hint style="danger" %} For this reason, *we never recommend* using a permanent spoofer. {% endhint %} ### Account Creation Just make a new account and carry on, right? Not anymore. Anti-cheat tracks this as well. Through a combination of fingerprinting methods we discussed above in addition to: email addresses, passwords, usernames, and so on.
#### So what about buying accounts? Good thought! This is the quickest and easiest way to removed potential fingerprinting vectors between accounts. However, some account sellers use mass account creation methods that essentially lump all of their batch-made accounts into a single pool which is then identified by the anti-cheat and a ban is issued. #### So how do I safely bypass account creation flags? There isn't a quick answer here. The only way to do this is by experience. Find a reputable seller you trust. The account selling market is fast-paced and ever-changing. Finding the right seller is the highest priority. #### What are NFA vs. FA accounts? In the account marketplace, there are two acronyms used to identify accounts: * Full Access (FA) account * you will receive full account credentials * **the good news:** these have a near-zero chance of account loss or seizure by another user, you own the account including recovery information * **the bad news:** FA accounts typically cost 20% to 40% more per account * Non-Full Access (NFA) account * you will receive (typically) only the username and password * **the good news:** the cheapest way to get an account * **the bad news:** little to no control of the account; usually the original owner will recover the account; most sellers will only warranty NFA accounts for 12 hours or not at all ### Where can I buy accounts from trusted sellers? There are a few account selling platforms we suggest: #### Eldorado {% embed url="" %} #### G2G {% embed url="" %} #### Z2U {% embed url="" %} ### I will just make the account myself? If you don't wish to buy accounts - that's cool. However, creating your own accounts requires a significant time investment to do this correctly. We won't outline the *entire* process here. * create a new account using random email addresses * an easy way to do this is to [buy a domain](https://www.namecheap.com/) and use a [wildcard/catchall email address setup](https://www.namecheap.com/support/knowledgebase/article.aspx/310/2214/how-to-set-up-a-catchall-wildcard-email-address/) * verify the phone number using a service like [TextVerified](https://www.textverified.com/) * use a [VPN](https://go.nordvpn.net/SH8k3) to keep your IP address masked * either [clean trace files with our spoofer](https://dexa.im/products/hardware-spoofer) or do a [Clean Windows Install](/learn/resources/windows-10-and-11-guides/clean-windows-install.md) ## Is there an easier and safer way to cheat? Yes. While it involves a higher up-front cost, DMA or Direct Memory Access cheats are the gold standard for cheating in modern titles utilizing quality anti-cheat softwares like those mentioned in this guide. Read more about DMA here: [What is DMA?](/dma/what-is-dma.md) ## Conclusion Hey - that was a lot, right? Good on you for reading through this guide. This should provide more clarity to how bans work, how to bypass them, and how to keep your PC masked from anti-cheat software. {% embed url="" %} [^1]: A dynamic IP is an internet address that changes over time. Your internet provider assigns it automatically, and it may change when you restart your router or after a certain period. It's the opposite of a static IP, which stays the same. --- # Agent Instructions: Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter: ``` GET https://docs.dexa.im/learn/resources/bans.md?ask= ``` The question should be specific, self-contained, and written in natural language. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.