4

i have registry from another machine and i need to extract mac-address from ethernet adapter

the adapter settings in HKEY_LOCAL_MACHINE\old_registry\ControlSet001\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}\0009

and there is parameter:

BIMacAdddress_l (REG_DWORD) = f315d433 and it is hexadecimal, decimal is 4078294067

when in submenu choose "Edit binary data" i see something like this:

0000 33 D4 15 F3 (and here is two some weird symbols)

33 D4 15 F3 looks like MAC address which is i looking for, but its only 8-characters, normal mac has 12 characters.

screenshot with registry tree: http://i.imgur.com/m8ssP.png

So what i doing wrong?

Improve this question
4
  • 0000 33 D4 15 F3 means that you are starting at address 0000 and have four bytes in little endian order (reversed). hence you have the data f315d433.
    – Robert
    Jun 15, 2012 at 12:00
  • And how exactly did BIMacAdddress_h and BIMacAdddress_l come into existence? I did some research. It turns out these are named symbols in a PE called l160x64.sys which is a driver for Atheros L1 Gigabit Ethernet adapter. I am not surprised. This is exactly what we see in the screenshot.
    – Samir
    Sep 30, 2019 at 22:27
  • You will normally not find the MAC address in the Windows registry. Not unless an administrator overrides the UAA address with an LAA address, in which case you will find a NetworkAddress field in one of the sub-keys of class key {4D36E972-E325-11CE-BFC1-08002bE10318}. What you have found is a hardly readable MAC address, which most likely has been registered by the NIC driver, unless you were doing some funny business and put it in there yourself.
    – Samir
    Sep 30, 2019 at 22:33
  • By the way, "BI" as in BIMacAdddress_h stands for binary. It's meant to be readable by the operating system and possibly the NIC driver, not by humans. It's no wonder it's incomprehensible.
    – Samir
    Sep 30, 2019 at 22:39

2 Answers 2

Reset to default
5

I would assume that the MAC address is 00:18:f3:15:d4:33 (belongs to "Asustek" which is a mainboard manufacturer).

The trick is that the MAC address has 48bit and is saved splitted into a high (BIMacAddress_h) and a low (BIMacAddress_l) part. Therefore you have to combine both parts and then use the lower 48bits of the resulting 64bit number. Then you get the MAC address above.

Improve this answer
3
  • I can confirm your assumtion is 100% correct.
    – Ramhound
    Jun 15, 2012 at 14:01
  • if this is true, why I'm reading "Atheros" in the DriverDesc and ProviderName (in the screenshot) ? which is a network device manufacturer
    – user8228
    Jun 17, 2012 at 18:59
  • I a mainboard manufacturer like Asustek buys network chips for their mainboards they often change the MAC address to one of their own pool. Therefore I don'T see a problem in having an Atheros LAN chip with an Asustek MAC address.
    – Robert
    Jun 18, 2012 at 7:28
-1

Hey the four zeroes are also considered as the mac address and therefore its a valid mac - 000033D415F3 .

Improve this answer
1
  • This answer is not correct. You need to combine BIMacAddress_h and BIMacAddress_l in order to get the correct MAC address. BIMacAddress_l is equal to f315d433 thus 33:d4:14:f3 is the second half of the address. The first part is 00000018 which is 00:18 combine them and you have the correct address.
    – Ramhound
    Jun 15, 2012 at 14:05

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .