如何获取网卡真实的MAC地址

[cxghj]

在网上有很多介绍如何修改MAC地址的方法，我想如何绕开这些修改，从而获取网卡真实的MAC地址呢？

[prettywolf]

对,我也测试过,的确是真正的MAC地址.
#include "nb30.h"
#pragma comment(lib,"netapi32.lib")
typedef struct _ASTAT_
{
ADAPTER_STATUS adapt;
NAME_BUFFER NameBuff[30];
} ASTAT, * PASTAT;


CString GetMacAddress(CString sNetBiosName)
{
ASTAT Adapter;

NCB ncb;
UCHAR uRetCode;

memset(&ncb, 0, sizeof(ncb));
ncb.ncb_command = NCBRESET;
ncb.ncb_lana_num = 0;

uRetCode = Netbios(&ncb);

memset(&ncb, 0, sizeof(ncb));
ncb.ncb_command = NCBASTAT;
ncb.ncb_lana_num = 0;

sNetBiosName.MakeUpper();

FillMemory(ncb.ncb_callname, NCBNAMSZ - 1, 0x20);

strcpy((char *)ncb.ncb_callname, (LPCTSTR) sNetBiosName);

ncb.ncb_callname[sNetBiosName.GetLength()] = 0x20;
ncb.ncb_callname[NCBNAMSZ] = 0x0;

ncb.ncb_buffer = (unsigned char *) &Adapter;
ncb.ncb_length = sizeof(Adapter);

uRetCode = Netbios(&ncb);

CString sMacAddress;

if (uRetCode == 0)
{
sMacAddress.Format(_T("%02x%02x%02x%02x%02x%02x"),
Adapter.adapt.adapter_address[0],
Adapter.adapt.adapter_address[1],
Adapter.adapt.adapter_address[2],
Adapter.adapt.adapter_address[3],
Adapter.adapt.adapter_address[4],
Adapter.adapt.adapter_address[5]);
}
return sMacAddress;
}

[cxghj]

ipconfig -all得到的是修改后的MAC地址，如原始MAC地址为：5D-10-01-76-3B-48，我修改成5D-10-01-76-3B-58后，则ipconfig -all得到的是5D-10-01-76-3B-58，而不是48，我需要得到48。

[cxghj]

我用的网卡是Realtek RTL8139(A) PCI Fast Ethernet Adapter，他的MAC地址可以随意修改，修改后用上面的程序就无法得到原始地址了。

[cxghj]

我用过很多方法，包括Netbios、GetAdaptersInfo、NetWkstaTransportEnum都无法得到原始的MAC地址，得到的都是修改后的MAC地址。

[sdice]

面对关公，上3柱香，手掌合并，低头默念：我要真实MAC！

[PiggyXP]

既然如此，只有出动底层汇编了...^_^

Use following APIs, you can get PERMANENT_ADDRESS.
CreateFile: opened the driver
DeviceIoControl: send query to driver

Use softice to track where the OID_802_3_PERMANENT_ADDRESS is processed:
Find the location:
.................
:0001ACB6 8D B3 EA 00 00 00 lea esi, dword ptr [ebx+000000EA]
:0001ACBC 8D7DDC lea edi, dword ptr [ebp-24]
:0001ACBF A5 movsd //CYM: move out the mac address
:0001ACC0 66A5 movsw
:0001ACC2 C745F406000000 mov [ebp-0C], 00000006
:0001ACC9 8D75DC lea esi, dword ptr [ebp-24]
:0001ACCC E926070000 jmp 0001B3F7
............
change to:
:0001ACB6 8D75DC lea esi, dword ptr [ebp-24]
:0001ACB9 C70600002003 mov dword ptr [esi], 03200000 //CYM
:0001ACBF 66C746041224 mov [esi+04], 2412
:0001ACC5 C745F406000000 mov [ebp-0C], 00000006
:0001ACCC E926070000 jmp 0001B3F7
.....


DASM driver .sys file, find NdisReadNetworkAddress

......
:000109B9 50 push eax

* Reference To: NDIS.NdisReadNetworkAddress, Ord:00EAh
|
:000109BA FF1538040100 Call dword ptr [00010438]
:000109C0 837DF400 cmp dword ptr [ebp-0C], 00000000
:000109C4 7516 jne 000109DC //is set mac addr in registry, use it. others jump
:000109C6 8B45E8 mov eax, dword ptr [ebp-18]
:000109C9 8B08 mov ecx, dword ptr [eax]
:000109CB 898EE4000000 mov dword ptr [esi+000000E4], ecx
:000109D1 668B4004 mov ax, word ptr [eax+04]
:000109D5 668986E8000000 mov word ptr [esi+000000E8], ax
......

set w memory breal point at esi+000000e4, find location:
......
:000124D6 8A83E5000000 mov al, byte ptr [ebx+000000E5] // mac addr 2nd byte
:000124DC 0A83E6000000 or al, byte ptr [ebx+000000E6] // mac addr 3rd byte
:000124E2 0A83E7000000 or al, byte ptr [ebx+000000E7] ...
:000124E8 0A83E8000000 or al, byte ptr [ebx+000000E8]
:000124EE 0A83E9000000 or al, byte ptr [ebx+000000E9] // mac addr 6th byte
:000124F4 0A07 or al, byte ptr [edi] //
:000124F6 7503 jne 000124FB //
:000124F8 A5 movsd //
:000124F9 66A5 movsw // if no station addr use permanent address as mac addr
.....

change to
:000124D6 C683E500000000 mov byte ptr [ebx+000000E5], 00 //CYM
:000124DD C683E600000020 mov byte ptr [ebx+000000E6], 20
:000124E4 C683E700000003 mov byte ptr [ebx+000000E7], 03
:000124EB C683E800000012 mov byte ptr [ebx+000000E8], 12
:000124F2 C683E900000024 mov byte ptr [ebx+000000E9], 24
:000124F9 90 nop
:000124FA 90 nop

It seems that the driver can work now.

Testing: disable nic, enable nic. jump 0xc0000221 error, checksum error

Before windows load .sys file, it will check the checksum
The checksum can be get by CheckSumMappedFile.

Build a small tools to reset the checksum in .sys file.

Test again, OK.

[PiggyXP]

是的，因为那些函数都是在软件级别得到的MAC地址

所以要得到真实的地址要用到很底层的方法了..-_-b

[windoze]

估计你得和网卡直接打交道才行，不过话说回来，大部分网卡也就是上电的时候从FLASH里面读一下“真实MAC”，如果你后面改了MAC，连网卡自己都不知道“真实MAC”是什么了。

[自由的风]

MAC地址有两个:
OID_802_3_PERMANENT_ADDRESS
OID_802_3_CURRENT_ADDRESS

OID_802_3_CURRENT_ADDRESS 可以通过修改注册表改变
OID_802_3_PERMANENT_ADDRESS 你只能通过修改驱动改变了

用:
CreateFile()
DeviceIoControl()你可以得到PERMANENT_ADDRESS

[自由的风]

我看了一下，上面所有人的方法全是得到注册表中可以修改的MAC,而不是硬件MAC

[你还能看见几颗星星]

众多牛人出动，mark……

[PiggyXP]

呵呵，连limin都来了，我也mark一下吧^_^

[cxghj]

PiggyXP(【小猪】能不能写的详细一些，是否能给一段调用的代码啊？

[adamx]

niu x

[自由的风]

这实际上就是向网卡设备发送一个 OID 请求,网卡就会返回硬件MAC
CreateFile() //用于打开硬件设备,也就是网卡
DeviceIoControl() //用于向硬件发送控制信息,也就是OIDs
请努力查MSDN

[wdy9927]

1 唉，把网卡的eeprom 拔下来， 读出来。就知道了。
但不同厂家的网卡，mac地址在eeprom中放的地方可能不一样。

2 直接用pci_read去读网卡的寄存器。前提是，pci网卡，你了解pci　bus

3 网卡上不是都帖着一张条么？上面几是mac地址呀！！！！

[wdy9927]

补充一下
如果他是直接在网卡寄存器上改了mac地址，你用２就不行了。只能用１or３　了。

[PiggyXP]

网卡上不是都帖着一张条么？上面几是mac地址呀！！！！

=======================================================

这个方法不错啊^_^

呵呵，开个玩笑，楼主可以看看置顶的那个帖子，不知道是否对你有帮助:)

[ripyu]

mark

[betsyalan]

mark