Change your Mac - Page 2

01-29-2002

Hey Trey....

Look at the first post, some vendors do not add the string value called NetworkAddress so you will have to add it yourself..

02-01-2002

OK- what am I doing wrong? Following the above instructions, I opened the only orinoco key there
(HKEY_LOCAL_MACHINE\System\CurrentControlSet\Servi ces\Class\Net\0007\Config02)and changed networkaddress from nothing to a new MAC. Iris doesn't say it changed. I've rebooted, pulled the card and put it back, and tried changing it in different combinations with the above key and \0007's networkaddress. I've tried to keep a lot of the numbers the same as original, but nada. No matter what I do, it seems to list the original MAC. Oh, this is on ME. Ideas??

Thanks all-

Den

02-01-2002

hmm, i also have ME and it works on my machine.

if your first number of your MAC is 00 than try 00:2C

E:AD:BE:EF. if you have some thing else than replace the first numer to yours.

did you selected the right profile at the client manager?

02-01-2002

Odd. I tried again and had the same results. I also switched identities and it didn't help. Is there somewhere else in the reg that it checks? Or maybe there is a firmware check that it runs to pull the mac? I'm using the WildPackets drivers for the Orinoco Gold card, maybe there's something odd from there??

Urgh.

02-01-2002

Hum...that MAC looks familure. LOL

Tron Of Borg
The Beef People

02-02-2002

OK....just tried it on ME and it worked fine.. Export yor reg entry for this and either post it or email it to some one to take a looksi

02-02-2002

Rember windows will use the settings in ControlSet001 first, it is the primary. If for some reason ControlSet001 is corrupted windows will look at ControlSet002 because it is the backup. CurrentControlSet is what is currently activated.

02-02-2002

OK- Here is the profile on the card I'm using. I also changed the config01 to the same "registry mac" with no change in mac detected.

REGEDIT4

[HKEY_LOCAL_MACHINE\System\CurrentControlSet\Servic es\Class\Net\0007\Config02]
"ConfigName"="Home"
"NetworkType"=dword:00000002
"SystemScale"="1"
"RTSThreshold"="2347"
"PMEnabled"="0"
"MicroWaveRobustness"="0"
"CreateIBSS"="1"
"NetworkAddress"="00:2C

E:AD:BE:EF"
"PortType"="1"
"APMode"="0"
"OwnSSID"=""
"DesiredSSID"="linksys1"
"Encryption"="G?TIUEA]d5MAdZV'eUb&&6.)'&:,'VF/(FR2)6^5*'*8*W6;+GB>,7NA-'ZD-X&G.H2J/8>M0(JP0XVS1HbV29.Y3):\\3YF_4IRb56"

That's all there is... need anything else, just let me know. I'm going to keep messing with it-

Den

02-03-2002

delete the ":" than it should work.

02-03-2002

Well. Slap my arse and call me charlie. That did it! I just had to lose those pesky colons. And using the orinoco's client manager, I just have to switch profiles from home (which works fine with my setup) to stumble (which, well, doesn't), reboot the card, and I have a new mac!

How cool is that!

Thanks for all the help-

Den, the local newbie

02-10-2002

You know what this means...

Now we won't be able to hack into other stumblers, cuz we're all using 002c DEAD BEEF.

btw: I've had this happen on a network before in the olden days. Two 10BT cards with the same MAC address (inconceivable!) It causes all kinds of connectivity problems for each card. But a total pain in the butt for the IT department to track down.

Unless they have an IDS, of course.

02-10-2002

thats the reason why i started this new topic http://forums.netstumbler.com/showthread.php?threadid=687

so we netstumbler users know that we found another netstumbler but noone else know it

)

so everyone should post some funny mac adresses to get a pool of mac´s.

cu AssetBurned

04-03-2002

I changed the registry like the above suggested. The 002cdeadbeef was changed to 022cdeadbeef in my WaveLan client manager automatically. Is this normal? Also the MAC address when I run ipconfig /all shows my orinoco card MAC address as 00-00-00-00-00-00 Is this what will be seen when stumbling or will it be 022cdeadbeef

04-03-2002

On a big enough network it will eventually happen and yes it sux :-( Thankfully it was someone else's headache to fix.

I've seen a fellow stumbler myself already. At least it looked like it - Peer connection with a MAC consisting of all Fs if I recall correctly. I'd have to check my logs to see but it was definatly a hacked MAC! Will have to see if I can do the beef thing when the laptop is rebuilt. Wonder if different hardware will want a different set of chars up front or not..?

04-04-2002

just save the following text as a .reg file and it works

-------------------
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Cl ass\{4D36E972-E325-11CE-BFC1-08002bE10318}\0012]

"NetworkAddress"="feeddeadbeef"
-------------------
ps! hkey should be as one line, not two. forum feature

01-29-2002	#16 (permalink)
Posts: n/a	Add the the Key Hey Trey.... Look at the first post, some vendors do not add the string value called NetworkAddress so you will have to add it yourself..

02-01-2002	#17 (permalink)
Posts: n/a	WTF?? OK- what am I doing wrong? Following the above instructions, I opened the only orinoco key there (HKEY_LOCAL_MACHINE\System\CurrentControlSet\Servi ces\Class\Net\0007\Config02)and changed networkaddress from nothing to a new MAC. Iris doesn't say it changed. I've rebooted, pulled the card and put it back, and tried changing it in different combinations with the above key and \0007's networkaddress. I've tried to keep a lot of the numbers the same as original, but nada. No matter what I do, it seems to list the original MAC. Oh, this is on ME. Ideas?? Thanks all- Den

02-01-2002	#18 (permalink)
Posts: n/a	hmm, i also have ME and it works on my machine. if your first number of your MAC is 00 than try 00:2CE:AD:BE:EF. if you have some thing else than replace the first numer to yours. did you selected the right profile at the client manager?

02-01-2002	#20 (permalink)
Posts: n/a	MAC is 00 than try 00:2C:DE:AD:BE:EF Hum...that MAC looks familure. LOL Tron Of Borg The Beef People

02-02-2002	#21 (permalink)
Posts: n/a	Read the First post again..... OK....just tried it on ME and it worked fine.. Export yor reg entry for this and either post it or email it to some one to take a looksi

02-01-2002	#19 (permalink)
Posts: n/a	Odd. I tried again and had the same results. I also switched identities and it didn't help. Is there somewhere else in the reg that it checks? Or maybe there is a firmware check that it runs to pull the mac? I'm using the WildPackets drivers for the Orinoco Gold card, maybe there's something odd from there?? Urgh.

02-02-2002	#22 (permalink)
Posts: n/a	Dendrite Rember windows will use the settings in ControlSet001 first, it is the primary. If for some reason ControlSet001 is corrupted windows will look at ControlSet002 because it is the backup. CurrentControlSet is what is currently activated.

02-02-2002	#23 (permalink)
Posts: n/a	OK- Here is the profile on the card I'm using. I also changed the config01 to the same "registry mac" with no change in mac detected. REGEDIT4 [HKEY_LOCAL_MACHINE\System\CurrentControlSet\Servic es\Class\Net\0007\Config02] "ConfigName"="Home" "NetworkType"=dword:00000002 "SystemScale"="1" "RTSThreshold"="2347" "PMEnabled"="0" "MicroWaveRobustness"="0" "CreateIBSS"="1" "NetworkAddress"="00:2CE:AD:BE:EF" "PortType"="1" "APMode"="0" "OwnSSID"="" "DesiredSSID"="linksys1" "Encryption"="G?TIUEA]d5MAdZV'eUb&&6.)'&:,'VF/(FR2)6^5'8*W6;+GB>,7NA-'ZD-X&G.H2J/8>M0(JP0XVS1HbV29.Y3):\\3YF_4IRb56" That's all there is... need anything else, just let me know. I'm going to keep messing with it- Den

02-03-2002	#24 (permalink)
Posts: n/a	delete the ":" than it should work.

02-03-2002	#25 (permalink)
Posts: n/a	Oh! Well. Slap my arse and call me charlie. That did it! I just had to lose those pesky colons. And using the orinoco's client manager, I just have to switch profiles from home (which works fine with my setup) to stumble (which, well, doesn't), reboot the card, and I have a new mac! How cool is that! Thanks for all the help- Den, the local newbie

02-10-2002	#26 (permalink)
Posts: n/a	MAC Collisions You know what this means... Now we won't be able to hack into other stumblers, cuz we're all using 002c DEAD BEEF. btw: I've had this happen on a network before in the olden days. Two 10BT cards with the same MAC address (inconceivable!) It causes all kinds of connectivity problems for each card. But a total pain in the butt for the IT department to track down. Unless they have an IDS, of course.

02-10-2002	#27 (permalink)
Posts: n/a	thats the reason why i started this new topic http://forums.netstumbler.com/showthread.php?threadid=687 so we netstumbler users know that we found another netstumbler but noone else know it ) so everyone should post some funny mac adresses to get a pool of mac´s. cu AssetBurned

04-03-2002	#28 (permalink)
Posts: n/a	I changed the registry like the above suggested. The 002cdeadbeef was changed to 022cdeadbeef in my WaveLan client manager automatically. Is this normal? Also the MAC address when I run ipconfig /all shows my orinoco card MAC address as 00-00-00-00-00-00 Is this what will be seen when stumbling or will it be 022cdeadbeef

04-03-2002	#29 (permalink)
Posts: n/a	I've seen MAC collisions too On a big enough network it will eventually happen and yes it sux :-( Thankfully it was someone else's headache to fix. I've seen a fellow stumbler myself already. At least it looked like it - Peer connection with a MAC consisting of all Fs if I recall correctly. I'd have to check my logs to see but it was definatly a hacked MAC! Will have to see if I can do the beef thing when the laptop is rebuilt. Wonder if different hardware will want a different set of chars up front or not..?

04-04-2002	#30 (permalink)
Posts: n/a	.reg for xp/orinoco gold just save the following text as a .reg file and it works ------------------- Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Cl ass\{4D36E972-E325-11CE-BFC1-08002bE10318}\0012] "NetworkAddress"="feeddeadbeef" ------------------- ps! hkey should be as one line, not two. forum feature

Thread Tools
Show Printable Version Email this Page
Display Modes
Linear Mode Switch to Hybrid Mode Switch to Threaded Mode