Your hardware is a permanent tracking number. Until you change it.
Motherboard serials, disk serials, MAC addresses, GPU device IDs, TPM module IDs, and the machine IDs Windows and Linux keep, are all readable by ordinary software, and most of them survive a clean reinstall. Together they are a device fingerprint that follows the machine for its whole life, built without asking you. Phantom puts that fingerprint under your control, on a machine you own or are authorized to test.
Audit first. Change deliberately. Reverse completely.
Nothing is written until the originals are saved.
Read what the machine reveals. Generate one internally consistent identity from a seed. Apply it after the originals are backed up, never before: the registry on Windows, the machine-id, hostname, and MAC on Linux. Validate that every source now reads consistently. Revert restores the exact originals from that backup, and so does uninstall, so you are never left with a changed identity and no way back.
Four things it does, and does carefully.
How it compares.
| Edit the registry by hand | A random spoofer script | Phantom | |
|---|---|---|---|
| Audits what actually leaks first | No | No | Yes |
| Internally consistent identity | No | Rarely | Yes |
| Backs up originals before writing | No | No | Yes |
| Restores the exact originals | No | No | Yes |
| Reverts automatically on uninstall | No | No | Yes |
| Reapplies across reboots | No | No | Yes (Pro) |
| Validates the result | No | No | Yes |
| One seed reproduces the identity | No | No | Yes |
Run it now.
Everything is on the releases page with a published SHA256SUMS.txt. Verify the file you got before you install it, because the Windows installer is not code-signed yet.
On Windows, clear the SmartScreen warning with More info then Run anyway, and accept the UAC and license prompts. Once it is installed, see your exposure before you change anything:
Applying changes machine-wide identifiers, so run it from an elevated terminal on Windows, with sudo on Linux. Phantom runs in Free tier immediately, which covers Layer-2 spoofing and up to two profiles.
The honest caveat.
The MSI is not code-signed yet, so Windows SmartScreen warns on first run. The published hash is the substitute: it proves the file you hold is the file the pipeline built. Signing is planned; until then the checksum does the signature's job, checked by you instead of trusted by default.
Tiers.
Free is a real tier, not a trial: Layer-2 registry spoofing and two profiles, with no time limit. Pro and Enterprise raise the profile limit, add the background service that reapplies your identity across reboots, and unlock the deeper layers as they ship.
| Tier | Layers | Profiles | Background service |
|---|---|---|---|
| Free | Layer 2 (registry) | 2 | No |
| Pro | All layers as they ship | 50 | Yes |
| Enterprise | All layers as they ship | Unlimited | Yes |
Keys are HMAC-signed and bound to one machine's hardware fingerprint, so a key issued for your machine is worthless on any other. phantom license request prints the fingerprint and build details your licensing contact needs; they issue a key bound to it.
Spec, at a glance.
- Platform
- Windows 10 22H2 or Windows 11 23H2 and newer; Linux with systemd. x86-64.
- Install
- Windows: an MSI, not code-signed yet. Linux: a .deb, an .rpm, or a portable tarball. Elevation on Windows, root on Linux for apply and revert.
- Applies at Layer 2
- Windows: MachineGuid, HwProfileGuid, MachineId, ProductId, InstallDate. Linux: machine-id, hostname, and the MAC of each physical interface.
- Models, not yet applied
- SMBIOS, disk, network, GPU, TPM, display, and boot identifiers, for the Layer 0 and Layer 1 paths.
- Reversibility
- Originals backed up before the first write; revert and uninstall both restore them exactly.
- Persistence
- PhantomService reapplies the active profile across reboots (Pro and Enterprise).
- Licensing
- HMAC-signed keys bound to one hardware fingerprint. Free, Pro, Enterprise.
- Phone-home
- Off unless you set a callback URL. No fingerprint, profile, or identity ever leaves the machine.
- Store
- Profiles, config, backup, and license live under %ProgramData%\Phantom on Windows, /var/lib/phantom on Linux, shared by the CLI and the service.
The change and the undo, shipped together.
Phantom treats hardware identity the way the rest of this workshop treats a result: something you can inspect, reproduce from a seed, and reverse without residue. The backup is the receipt. A spoof you cannot cleanly undo is not control, so the undo is written before the change, every time.
v1.1.0 ships the Layer-2 path on Windows and Linux, verified end to end. Layer 1 reaches disk, network, GPU, TPM, and display through a kernel driver; Layer 0 reaches SMBIOS and boot identifiers through UEFI firmware. Both are modeled now so today's profiles stay consistent when those layers arrive. The profile you generate is already the whole identity; the deeper layers only widen where it is written.
Run it: github.com/HarperZ9/phantom · the engine room · the workshop
State of the work, August 2026.
Phantom v1.1.0 is shipped, on Windows and Linux. The Layer-2 path is verified end to end on fresh VMs of both: audit, generate, apply, validate, a clean uninstall that returns the machine to its original identity, and reboot persistence. On Linux that last one is proven through an actual power-cycle, where the service brought a spoofed MAC back after a reboot.
It is honest about its edges. Layer 2 only for now, with Layers 1 and 0 modeled but not shipped. The Layer 1 kernel driver now compiles under CI and two of its security defects are fixed, but it is unsigned and not yet functional end to end. The Windows installer is not code-signed yet, so SmartScreen warns until a certificate is in place. Intended for machines you own or are expressly authorized to test, not for evading fraud controls or misrepresenting a device you do not control.