MAC Addresses

Amit_Kulkarni-2 · June 10, 2011, 7:04am

Hi All,

I want to retrieve the actual MAC address of currently installed Network Adapter Cards (ie. MAC address provided by manufacturer). For that we are currently using GetAdaptersInfo API.

But the problem is that GetAdaptersInfo does not retrieve actual MAC address. Is there any IOCTL or API (user/kernel mode) to do so?

Thanks & Regards,
Amit.

Maxim_S_Shatskih · June 10, 2011, 9:12am

WMI?

–
Maxim S. Shatskih
Windows DDK MVP
xxxxx@storagecraft.com
http://www.storagecraft.com

wrote in message news:xxxxx@ntdev…
> Hi All,
>
> I want to retrieve the actual MAC address of currently installed Network Adapter Cards (ie. MAC address provided by manufacturer). For that we are currently using GetAdaptersInfo API.
>
> But the problem is that GetAdaptersInfo does not retrieve actual MAC address. Is there any IOCTL or API (user/kernel mode) to do so?
>
> Thanks & Regards,
> Amit.
>
>

David_R_Cattley · June 10, 2011, 10:01am

OID_XXX_PERMANENT_ADDRESS (or most likely in your case
OID_802_3_PERMANENT_ADDRESS) via WMI with the class
MSNdis_EthernetPermanentAddress.

Good Luck,
Dave Cattley

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of
xxxxx@yahoo.com
Sent: Friday, June 10, 2011 7:08 AM
To: Windows System Software Devs Interest List
Subject: [ntdev] MAC Addresses

Hi All,

I want to retrieve the actual MAC address of currently installed Network
Adapter Cards (ie. MAC address provided by manufacturer). For that we are
currently using GetAdaptersInfo API.

But the problem is that GetAdaptersInfo does not retrieve actual MAC
address. Is there any IOCTL or API (user/kernel mode) to do so?

Thanks & Regards,
Amit.

NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

Amit_Kulkarni-2 · June 10, 2011, 10:39am

Hi All,

Thanks for the reply.

I have used MSNdis_EthernetPermanentAddress class with NdisPermanentAddress property, CIM_NetworkAdapter & Win32_NetworkAdapter class with PermanentAddress property but none of them worked for me.

MSDN states that PermanentAddress in case of CIM_NetworkAdapter & Win32_NetworkAdapter is not implemented yet.

Thanks & Regards,
Amit.

David_R_Cattley · June 10, 2011, 11:30am

Not sure what you mean by “none of them worked for me” given that you did
not really say what you tried.

But when I use CIM Studio from the WMI Tools to go and enumerate all
instances of MSNdis_EthernetPermanentAddress on my XP system it surely works
just fine and returns every Adapter’s reported permanent address in the
system.

I would guess that Scriptomatic would do the same as well as powershell and
other quick & dirty ways to get at WMI (CIM Studio happened to be handy).

Not working for you does not mean that they don’t work. So maybe you be a
bit more specific?

Good Luck,
Dave Cattley

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of
xxxxx@yahoo.com
Sent: Friday, June 10, 2011 10:43 AM
To: Windows System Software Devs Interest List
Subject: RE:[ntdev] MAC Addresses

Hi All,

Thanks for the reply.

I have used MSNdis_EthernetPermanentAddress class with NdisPermanentAddress
property, CIM_NetworkAdapter & Win32_NetworkAdapter class with
PermanentAddress property but none of them worked for me.

MSDN states that PermanentAddress in case of CIM_NetworkAdapter &
Win32_NetworkAdapter is not implemented yet.

Thanks & Regards,
Amit.

NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

Tim_Roberts · June 10, 2011, 12:44pm

xxxxx@yahoo.com wrote:

I want to retrieve the actual MAC address of currently installed Network Adapter Cards (ie. MAC address provided by manufacturer). For that we are currently using GetAdaptersInfo API.

But the problem is that GetAdaptersInfo does not retrieve actual MAC address. Is there any IOCTL or API (user/kernel mode) to do so?

What does it retrieve?

–
Tim Roberts, xxxxx@probo.com
Providenza & Boekelheide, Inc.

Jeffrey_Tippet_MSFT · June 10, 2011, 3:45pm

I wrote up a little guide on how to query NDIS via WMI and PowerShell. You are lucky: the example that I had used happens to be querying the current MAC address. All you have to do is substitute the word “Permanent” for “Current” in a couple places, and you’re good to go:

http://blogs.msdn.com/b/ndis/archive/2010/12/15/pwn-your-network-adapter.aspx

$Adapters = Get-WMIObject -Namespace root\wmi -Class MSNdis_EthernetPermanentAddress

$Adapters | ForEach-Object {
$FormattedAddress = ($.NdisPermanentAddress.Address | % {“{0:X2}” -f $}) -join “-”
Write-Host $FormattedAddress, $_.InstanceName
}

Amit_Kulkarni-2 · June 13, 2011, 3:39am

Hi David R. Cattley,

?none of them worked for me? may be because I was enumerating from user mode. It works fine in kernel mode(Thanks to Jeffrey Tippet).

Is it the case that I can not do it from user mode VC++ code?

Hi Tim Roberts,

GetAdaptersInfo retrives “Current” not “Permanent” MAC address. You can change your system MAC address but not the Adapter Card’s.

Thanks & Regards,
Amit.

Tim_Roberts · June 13, 2011, 1:02pm

xxxxx@yahoo.com wrote:

Hi Tim Roberts,

GetAdaptersInfo retrives “Current” not “Permanent” MAC address. You can change your system MAC address but not the Adapter Card’s.

That is strictly an implementation detail of some particular board. A
“system” does not have a MAC address. Only adapter cards have MAC
addresses. If you change a board’s MAC address, that’s the address that
it’s going to respond to. It won’t respond to the original address any
more. I know of boards that keep the MAC address in an EEPROM; when you
change the MAC address, you change the EEPROM, and the
factory-programmed MAC address is gone.

–
Tim Roberts, xxxxx@probo.com
Providenza & Boekelheide, Inc.

Jeffrey_Tippet_MSFT · June 13, 2011, 2:49pm

> Is it the case that I can not do it from user mode VC++ code?

Yes, you absolutely can. Take the PowerShell I posted, and port it to the COM API. E.g., go to the example here: http://msdn.microsoft.com/en-us/library/aa390423(v=VS.85).aspx and change the namespace, WQL query, and the datatype of the resulting VARIANT. But gosh, is that a lot of work, when PowerShell is so easy.

-----Original Message-----
From: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com] On Behalf Of xxxxx@yahoo.com
Sent: Monday, June 13, 2011 12:43 AM
To: Windows System Software Devs Interest List
Subject: RE:[ntdev] MAC Addresses

Hi David R. Cattley,

?none of them worked for me? may be because I was enumerating from user mode. It works fine in kernel mode(Thanks to Jeffrey Tippet).

Is it the case that I can not do it from user mode VC++ code?

Hi Tim Roberts,

GetAdaptersInfo retrives “Current” not “Permanent” MAC address. You can change your system MAC address but not the Adapter Card’s.

Thanks & Regards,
Amit.

NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer

Amit_Kulkarni-2 · June 15, 2011, 8:27am

Hi All,

How can I issue OID_802_3_PERMANENT_ADDRESS command via WMI from user mode?
I have googled lot but didn?t find a way.

Thanks & Regards,
Amit.

Andy · June 16, 2011, 11:42am

If you know the IP address, which is available via GetAdaptersInfo, could you not try the IP Helper API SendARP() function? This may be simpler if you’re in user mode