Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

i have registry from another machine and i need to extract mac-address from ethernet adapter

the adapter settings in HKEY_LOCAL_MACHINE\old_registry\ControlSet001\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}\0009

and there is parameter:

BIMacAdddress_l (REG_DWORD) = f315d433 and it is hexadecimal, decimal is 4078294067

when in submenu choose "Edit binary data" i see something like this:

0000 33 D4 15 F3 (and here is two some weird symbols)

33 D4 15 F3 looks like MAC address which is i looking for, but its only 8-characters, normal mac has 12 characters.

screenshot with registry tree:

So what i doing wrong?

share|improve this question

migrated from Jun 15 '12 at 8:17

This question came from our site for professional and enthusiast programmers.

0000 33 D4 15 F3 means that you are starting at address 0000 and have four bytes in little endian order (reversed). hence you have the data f315d433. – Robert Jun 15 '12 at 12:00

I would assume that the MAC address is 00:18:f3:15:d4:33 (belongs to "Asustek" which is a mainboard manufacturer).

The trick is that the MAC address has 48bit and is saved splitted into a high (BIMacAddress_h) and a low (BIMacAddress_l) part. Therefore you have to combine both parts and then use the lower 48bits of the resulting 64bit number. Then you get the MAC address above.

share|improve this answer
I can confirm your assumtion is 100% correct. – Ramhound Jun 15 '12 at 14:01
if this is true, why I'm reading "Atheros" in the DriverDesc and ProviderName (in the screenshot) ? which is a network device manufacturer – user8228 Jun 17 '12 at 18:59
I a mainboard manufacturer like Asustek buys network chips for their mainboards they often change the MAC address to one of their own pool. Therefore I don'T see a problem in having an Atheros LAN chip with an Asustek MAC address. – Robert Jun 18 '12 at 7:28

Hey the four zeroes are also considered as the mac address and therefore its a valid mac - 000033D415F3 .

share|improve this answer
This answer is not correct. You need to combine BIMacAddress_h and BIMacAddress_l in order to get the correct MAC address. BIMacAddress_l is equal to f315d433 thus 33:d4:14:f3 is the second half of the address. The first part is 00000018 which is 00:18 combine them and you have the correct address. – Ramhound Jun 15 '12 at 14:05

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .