Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

i have registry from another machine and i need to extract mac-address from ethernet adapter

the adapter settings in HKEY_LOCAL_MACHINE\old_registry\ControlSet001\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}\0009

and there is parameter:

BIMacAdddress_l (REG_DWORD) = f315d433 and it is hexadecimal, decimal is 4078294067

when in submenu choose "Edit binary data" i see something like this:

0000 33 D4 15 F3 (and here is two some weird symbols)

33 D4 15 F3 looks like MAC address which is i looking for, but its only 8-characters, normal mac has 12 characters.

screenshot with registry tree: http://i.imgur.com/m8ssP.png

So what i doing wrong?

share|improve this question

migrated from stackoverflow.com Jun 15 '12 at 8:17

This question came from our site for professional and enthusiast programmers.

    
0000 33 D4 15 F3 means that you are starting at address 0000 and have four bytes in little endian order (reversed). hence you have the data f315d433. –  Robert Jun 15 '12 at 12:00

3 Answers 3

I would assume that the MAC address is 00:18:f3:15:d4:33 (belongs to "Asustek" which is a mainboard manufacturer).

The trick is that the MAC address has 48bit and is saved splitted into a high (BIMacAddress_h) and a low (BIMacAddress_l) part. Therefore you have to combine both parts and then use the lower 48bits of the resulting 64bit number. Then you get the MAC address above.

share|improve this answer
    
I can confirm your assumtion is 100% correct. –  Ramhound Jun 15 '12 at 14:01
    
if this is true, why I'm reading "Atheros" in the DriverDesc and ProviderName (in the screenshot) ? which is a network device manufacturer –  Revolter Jun 17 '12 at 18:59
    
I a mainboard manufacturer like Asustek buys network chips for their mainboards they often change the MAC address to one of their own pool. Therefore I don'T see a problem in having an Atheros LAN chip with an Asustek MAC address. –  Robert Jun 18 '12 at 7:28

it is 12 characters and it looks like a valid address, I did a lookup on 00-00-33 and it matched with the vendor egan machinery company.

share|improve this answer
    
this address is not correct. The MAC address in the screenshot does not belong to egan machinery company –  Ramhound Jun 15 '12 at 14:06

Hey the four zeroes are also considered as the mac address and therefore its a valid mac - 000033D415F3 .

share|improve this answer
    
This answer is not correct. You need to combine BIMacAddress_h and BIMacAddress_l in order to get the correct MAC address. BIMacAddress_l is equal to f315d433 thus 33:d4:14:f3 is the second half of the address. The first part is 00000018 which is 00:18 combine them and you have the correct address. –  Ramhound Jun 15 '12 at 14:05

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.