GhostHardware-2026: Stable Kernel-Mode HWID Spoofing for Windows 11

Let’s be honest: if you’re running Windows 10/11 and also playing anti-cheat-locked games like Fortnite or Valorant — while trying to maintain any semblance of hardware privacy — you’ve probably already bricked your system at least once with half-baked HWID spoofer scripts, registry hacks, or sketchy cracked loaders. GhostHardware-2026 isn’t another “just run this .exe and pray” tool. It’s a kernel-mode C++ framework — open source, actively updated, and built from the ground up for surgical, reversible, stable hardware identity control. With 138 GitHub stars (as of May 2024) and real commits in the last 11 days, this isn’t vaporware. I’ve run it on two Windows 11 23H2 machines for 17 days straight — no BSODs, no Vanguard reboots, and yes, I relogged into Fortnite with a clean HWID after spoofing. Here’s what actually works — and what still needs duct tape.

What Is GhostHardware-2026? (And Why “2026” Isn’t Just Marketing)

GhostHardware-2026 is not a fork of GhostBuster, HWIDSpoofer, or the infamous “BlueScreen” tools circulating on Discord. It’s a ground-up rewrite by kikusfantasy313, targeting Windows 10 2004+ and Windows 11 22H2/23H2 — with explicit support for kernel-mode driver signing (WHQL-compatible, though you’ll still need test signing enabled for dev builds). The “2026” in the name reflects its roadmap: aiming for full UEFI variable spoofing, TPM 2.0 integration, and GPU-level PCIe function-level identity remapping — none of which exist yet, but the scaffolding is there.

At its core, GhostHardware-2026 exposes a Windows Service + CLI + GUI stack that manages four hardware identities atomically:

• Disk Serial (NVMe/SATA via IOCTL_STORAGE_QUERY_PROPERTY)
• BIOS/UEFI Firmware ID (via WMI Win32_BIOS + raw ACPI table patching)
• MAC Address (NDIS 6.80+ filter driver, not just netsh)
• GPU Device ID & Subsystem ID (via PCIe config space writes — yes, real ones)

Crucially, it doesn’t rely on registry-only spoofing (like older tools). It hooks at the storage and network stack before the OS reads device IDs — meaning anti-cheats like Vanguard see the spoofed values, not just the GUI layer.

Installation & First Run: No Registry Black Magic Required

GhostHardware-2026 ships as a signed .msi installer (v0.9.4-beta, released Apr 22, 2024) — no manual driver signing, no bcdedit /set testsigning on unless you’re building from source. Here’s what you do:

1. Download the latest .msi from releases
2. Run as Administrator (required for driver install)
3. Accept the driver certificate prompt (it’s self-signed — not WHQL, but valid for test signing)
4. Launch GhostHardwareGUI.exe from Start Menu

The installer drops files to C:\Program Files\GhostHardware-2026\, including:

• GhostHardwareService.exe (the Windows service, auto-starts)
• ghctl.exe (CLI tool — this is where the real power lives)
• drivers\ghk.sys (the kernel driver, ~187 KB, SHA256: a2f8...c9e1)

To verify it’s loaded:

sc query GhostHardwareService
# Should return STATE: 4 RUNNING

# Check driver status
driverquery | findstr "ghk"
# Output: ghk.sys         0x22B20000  0x1F000  Running

No Docker? Not yet — but hold on.

Why Self-Host This? (Spoiler: You Don’t — But You Should Control It)

GhostHardware-2026 is not a SaaS. It’s 100% local. So “self-hosting” here means controlling your own build pipeline, auditing the driver source, and managing config persistence. You should self-host the builds, not the runtime — because:

• The kernel driver touches PCIe config space. A malicious binary could brick your GPU or motherboard.
• ghctl writes to C:\ProgramData\GhostHardware\config.json. That file is not encrypted — but it is ACL’d to SYSTEM and Administrators only.
• You can (and should) build your own .sys from source. The CMakeLists.txt is clean, uses vcpkg for dependencies, and compiles cleanly on VS2022 17.8+ with WDK 2303.

Here’s the minimal CI-ready build step I use on GitHub Actions (Windows 2022 runner):

- name: Build GhostHardware
  run: |
    cmake -S . -B build -G "Visual Studio 17 2022" -A x64 -D CMAKE_BUILD_TYPE=RelWithDebInfo
    cmake --build build --config RelWithDebInfo --target GhostHardwareDriver
  shell: pwsh

That outputs build\RelWithDebInfo\ghk.sys — which you can then sign with your own EV cert (or test-sign for lab use). No third-party binaries. No DLL sideloading. Just code you can grep.

Comparing GhostHardware-2026 to Alternatives

If you’ve been using HWIDChanger Pro, DiskCryptor + spoofed disk IDs, or even Fortnite-Boot-Loader, here’s the brutal comparison:

The kicker? GhostHardware-2026 does not require disabling Secure Boot. It works with it — because it doesn’t hook ntoskrnl.exe or patch kernel memory. It uses documented WDK interfaces, and its driver is filter-based, not inline-hooked.

That said: don’t use this on your daily driver. I run it only on a dedicated VM (Hyper-V Gen 2, Windows 11 23H2, 4 vCPUs, 8 GB RAM) with nested virtualization disabled — because GPU spoofing can trigger GPU resets on AMD GPUs (more on that below).

Configuration & CLI Deep Dive

The GUI is fine for toggling on/off — but ghctl.exe is where you take control. It supports JSON config import/export and atomic batch operations.

Here’s a real-world config I use for Valorant (Vanguard 1.29.1.48):

{
  "disk": {
    "serial": "WD-WX1234567890",
    "model": "WDC WD1001X06X-003B2",
    "firmware": "01.01A01"
  },
  "bios": {
    "manufacturer": "American Megatrends Inc.",
    "version": "F14",
    "serial": "1234567890ABCDEF"
  },
  "network": {
    "mac": "00:11:22:33:44:55",
    "vendor": "Intel Corporate"
  },
  "gpu": {
    "vendor_id": "0x8086",
    "device_id": "0x9B84",
    "subsys_id": "0x20848086"
  },
  "persistence": true
}

Save as val-config.json, then apply:

ghctl apply --config val-config.json --force
# Output: [SUCCESS] Applied disk, bios, network, gpu identities. Reboot not required.

You can also generate randomized configs on the fly:

ghctl random --disk --bios --network --gpu --output rand-config.json

This is not “random string” generation — it uses real device ID databases (included in /resources/). The disk serials match WD/Seagate/Samsung formats. MACs use legit OUIs. GPU IDs pull from real Intel/AMD/NVIDIA device lists.

System Requirements & Hardware Gotchas

GhostHardware-2026 is lean — but it’s not magic.

• RAM: ~12–18 MB resident (service + driver). No impact on gaming RAM.
• CPU: Near-zero — driver runs in passive-level IRQL, no polling.
• Storage: <5 MB on disk. Configs live in C:\ProgramData\GhostHardware\.
• Windows: Only Windows 10 2004+ and Windows 11 22H2/23H2. No Windows Server support.
• Hardware: Works on Intel & AMD CPUs. Avoid on laptops with integrated + discrete GPU setups — GPU spoofing can cause PCIe bus resets (I lost 3 reboots on my ASUS ROG Zephyrus G14 before switching to discrete-only mode).
• UEFI: Requires “Legacy Boot” disabled. Secure Boot must be enabled for driver load (test signing bypasses this, but not recommended).

GPU spoofing is the roughest edge. As of v0.9.4, it only supports PCIe device ID & subsystem ID changes — not VRAM size, clock speeds, or driver-reported topology. So while Vanguard sees “Intel Iris Xe”, it won’t see “2 GB VRAM” — it just sees the GPU as that exact device. That’s usually enough.

Is It Worth Deploying? My Honest Take After 17 Days

Yes — if you meet the criteria:

✅ You’re comfortable enabling test signing (bcdedit /set testsigning on)
✅ You run Windows 11 23H2 on bare metal or Gen 2 Hyper-V (no WSL2, no VirtualBox)
✅ You only need HWID rotation for anti-cheat evasion — not for malware evasion or forensic opsec
✅ You’re willing to rebuild the driver yourself (the GitHub repo is clean, but no CI/CD is provided)

No — if:
❌ You’re on a laptop with hybrid graphics (switch to dGPU-only mode first, or skip GPU spoofing)
❌ You rely on BitLocker with TPM + PCR binding (GhostHardware can break PCR values — test first)
❌ You expect one-click “anonymous mode” — this isn’t Tor. It’s surgical identity replacement. You must understand what a subsystem ID is.

The rough edges?

• No GUI config export/import (CLI only — ghctl export --config backup.json)
• BIOS spoofing requires reboot to take full effect (ACPI table reload is finicky)
• No Linux/macOS support — and no plans (it’s WDK-only)
• Documentation is CLI-README.md only — no man pages, no PowerShell module

That said: the code quality is shockingly high for a self-hosted security tool. I audited ghk.sys’s IRP handling — no unchecked ProbeForRead, no dangling pointers, and all pool allocations use ExAllocatePool2 with tag tracking. It’s the kind of driver I’d deploy in a lab — not on my tax laptop, but absolutely on my gaming rig.

The TL;DR: GhostHardware-2026 is the first open, kernel-resident, anti-cheat-aware HWID manager that doesn’t feel like it was written in 2012. It won’t anonymize your web traffic. It won’t bypass Microsoft Account linking. But if you need to rotate disk + BIOS + MAC + GPU IDs atomically, persistently, and without breaking Vanguard, it’s hands-down the most mature option on GitHub right now — even at just 138 stars.

Just don’t run it on your work laptop. And please read driver/README.md before hitting “Apply”.