RedM HWID ban: what sticks, what does not, and how to ban a player for good

You banned a cheater on Monday. On Wednesday a player with a different name, the same habits and the same mod menu is back on your server. A RedM HWID ban was supposed to prevent exactly that. This article explains why it often does not, what each kind of ban really records, and what you can do so that coming back costs the player something.

We write an anticheat, so we will say it early: no ban is permanent against someone willing to buy a new account and new hardware. The goal is to make that purchase worth less than your server is to them.

#What identifiers a RedM server actually sees

When a player connects, the server receives a list of identifiers, each prefixed by its type. The Cfx.re documentation for GetPlayerIdentifiers lists them:

• license and license2: the Rockstar licence hash. On RedM this is the one you can count on, because it is always present.

• steam: present only when the player runs Steam. Optional, so you cannot assume it.

• discord: the Discord user id. It is not guaranteed to be there, so never depend on it alone.

• fivem: the Cfx.re account id.

• ip: the address the connection comes from.

On top of identifiers, FXServer exposes hardware tokens through GetNumPlayerTokens and GetPlayerToken. The native reference describes them in one line: tokens can be used to enhance banning logic, however they are specific to a server. That second half matters, and we come back to it below.

AddEventHandler('playerConnecting', function(name)
  local src = source
  local ids = GetPlayerIdentifiers(src)

  local tokens = {}
  for i = 0, GetNumPlayerTokens(src) - 1 do
    tokens[#tokens + 1] = GetPlayerToken(src, i)
  end

  print(('%s: %d identifiers, %d tokens'):format(name, #ids, #tokens))
end)

#Why a ban on one identifier fails

Every identifier has a different price for the player:

• IP is free to change: a router restart on some connections, a VPN on any of them. It also gets reused by innocent people, so an IP ban is the most likely to hit the wrong player.

• Discord is free to change: create another account.

• Steam costs a little: another account.

• Licence costs a Rockstar account and a copy of the game.

• Hardware tokens cost a different machine, or a tool that lies about the one they have.

A ban written on the licence alone is defeated by the player who buys another licence. A ban written on the IP alone is defeated by a phone hotspot. The bans that hold are the ones written on several identifiers at once, because the player has to replace all of them on the same day, and one slip is enough for the match.

#What a txAdmin ban on RedM records

A txAdmin ban is already better than a script that bans a single licence. In the txAdmin source, a ban is stored with the list of identifiers the player had and a separate list of hardware tokens. When someone connects, txAdmin looks for a match on the identifiers, and on the tokens too when its ban settings ask for it. The txAdmin events documentation shows both lists in the ban event (targetIds and targetHwids).

Three things to know about it:

• The token match needs a minimum number of matching tokens, and that minimum is a setting. Too strict and a changed disk or network card lets the player through. Too loose and you ban a stranger who shares one component.

• A ban only holds what the player carried when you banned them. A player banned while Steam was closed has no Steam id on the ban, and a ban placed on identifiers only (an old legacy ban, for instance) has no tokens at all.

• The data lives in that one server's txAdmin. The second server of your community does not know about it unless you copy it.

None of this is a criticism. txAdmin does what a ban list should do. It is also all a ban list can do: it matches, it does not link.

#The limits you cannot engineer away

A RedM HWID ban depends on the tokens being the player's. Three situations break that, and you should plan for all of them.

1. 1

   A new Rockstar account. A new licence on the same machine is a new player as far as the game is concerned. If the tokens did not match, nothing links the two.

2. 2

   A VPN. It removes the IP from the equation. It does nothing for the licence, but it makes the IP, the most commonly shared signal, worthless as evidence.

3. 3

   Spoofed hardware. Tools exist that change what a machine reports to the game, and a token is only as good as what the machine reports. We will not describe how.

#RedM ban evasion and the alt account problem

Ban evasion is rarely a clever attack. It is a banned player who creates a RedM alt account, forgets one detail (the same home connection, the same Discord, the same machine) and plays the same way. Your job is to catch that detail.

That means keeping links, not just bans: which accounts shared an address, which shared a hardware token, which shared a Discord identity. When a new account matches a banned one on any of those, you want a notification, not a surprise three days later. For the same reason, shared signals need judgment. A family on one router, or a mobile carrier that puts thousands of subscribers behind one address, will look like evasion when it is not. Whatever tool you use needs a way to say "this one is fine".

#Good practice for a ban that holds

• Ban on everything you have. Licence, Steam, Discord, tokens and IP together, never one of them.

• Keep the evidence. The reason field is not enough. A clip, a screenshot or a replay is what lets a second admin confirm the ban a month later.

• Give an appeal path. A public form or a Discord channel is enough. It saves you from the one wrong ban you will make. See our note on false positives.

• Use durations on purpose. A permanent ban for a cheater, a temporary one for a rule break, and a revocation for a mistake, written down.

#What Baobab AC adds to a RedM HWID ban

Baobab AC runs on your server, next to your framework, and keeps the link graph that a plain ban list does not. This is what that means for the problems above. It is also described, with the plan it comes with, on the features page.

An alt network built automatically

The alt network links accounts through shared IP, hardware tokens and Discord identity, and recognises a returning ban evader on any one of them. The player profile shows the links, and whois gives you the identifiers, tokens, aliases and connection history of any player in one view. A returning evader is caught on connect and the sanction is reapplied at the first match.

The anti multi-account detection builds on the same graph: it looks for money and item transfers between linked alternate accounts, and for ban re-entry. A shared address can be exempted by hand, for the family case above.

A cheating ban that follows the links

When you ban a player and tag the ban as cheating, the ban extends to the accounts linked to them, instead of leaving you to find the alts one at a time. The tag is a choice you make when you issue the ban, so an ordinary ban stays an ordinary ban. If you tagged the wrong player, one revocation undoes the whole cascade at once.

A watchlist for the ones you are not sure about

Sometimes you do not have enough to ban. The watchlist flags a player and tells your staff the moment they connect. Set to kick instead, it enforces on join. It is how you handle the account that looks like last week's banned player but has not done anything yet.

Your txAdmin bans, brought along

You can import the bans from your txAdmin players database (the playersDB.json file) in the panel. The file is read in your browser and only the ban entries are sent. A ban that is attached to a known player becomes a sanction. A ban placed when the player had no Steam id stays on its identifiers, is checked at connect against the licence, Discord and hardware ids, and becomes a sanction the first time that player appears. Expired and lifted bans are skipped, running the same file twice changes nothing, and an import can be undone in one click. Details are on the ban list page.

Sanctions you can explain

A sanction has a duration or is permanent, can be revoked without erasing its history, and carries an evidence file collected when it is issued. On the Pro and Network plans, the black box adds a replay of what the server measured, and you can share a link that expires with the player, so they see the same numbers you do. That is the strongest answer to an appeal, in either direction. You can look at a sample on the demo dashboard and see the plans on the pricing page.

#What this does not do

A hardware ban raises the cost of coming back, it does not close the door. A new account with a new licence is a new player as far as the game is concerned. What Baobab AC keeps is the link graph, so that the return shows up as a match instead of a stranger. If the player changes the licence, the machine, the Discord, the connection and the habits all at once, there is no match to find, and no tool will invent one.

It also does not replace judgment. Shared addresses exist, and a link is a lead for a human, not a verdict. For how the detection side works, see how a RedM anticheat works, and for why the server is where this has to live, server-side vs client-side anticheat.

#RedM HWID ban checklist

1. 1

   Does every ban you write carry the licence, Steam if present, Discord, tokens and IP, and not only one of them?

2. 2

   Do you keep a link between accounts, not just a list of banned ones?

3. 3

   Can your staff exempt a shared address without removing the ban?

4. 4

   Is there evidence attached to each ban, readable by an admin who was not there?

5. 5

   Can a player appeal, and can you revoke a mistake cleanly?

6. 6

   Do your other servers see the ban?

If you answered no to two or more, the next evader will walk through. If you want the linking, the evidence and the txAdmin import in one place, the features page lists what is included.