Jump to content

How-why do some rom installations change the Mac address?


Guest Alg0r1thm

Recommended Posts

Guest Alg0r1thm

Hello guys. After a lot of digging I cannot understand the mechanism of this bug.

It occurs upon installation: After a new ROM I see my Mac address changed to a default one usually beginning with 9c:c1...

The Roms doing this are the majority of the ones I ve tried: laek, mlais and many emuis.

I thorougly checked the updater scripts and I do not see any ones messing with /data/nvram/APCFG/APRDEB/WIFI

Only laek roms had an init.d script messing with the WIFI file but even after ripping this apart and reinstalling the problem persists.

Any ideas? This bug is a real showstopper for 2 coolpad f1 connected to the same router.

Furthermore how can one mount the data partition inside an init script without using busybox? Eg something like

mount("ext4", "EMMC", "/dev/block/mmcblk0p8", "/system");

when the system partition is mounted. (Thx Arpione)

Link to comment
Share on other sites

Do you know if it's the same MAC address every time?

If so can you post it so I can check mine later pleas?

Do you know if it happens with maucat 4.4.2 AOSP?

Is it related to the "NVRAM wifi error" that some people have reported (I don't have details to hand)?

Edited by dalyer
Link to comment
Share on other sites

Guest Alg0r1thm

The WiFi.zip simply flashes another WIFI Mac address (generic one) and does not restore the old unique one.

And yes this bug is related to the err=0 thing. The macaddress in this case simply gets zeroed.

Has anyone found a way to force all those custom Roms NOT f@cking up the macaddress?

Because flashing a ROM is easy for noobs but restoring their macaddress (if they even know it) is a pig.

BTW mine is permanently gone. I made myself a new random one with a yulong prefix.

Link to comment
Share on other sites

Guest mindtrapper

He knows how to restore imei, we are talking about mac address which isn't printed anywhere.

Algo, have you considered checking router logs? Maybe it's there somewhere. Just in case you absolutely want to have your original one.

Link to comment
Share on other sites

Guest Alg0r1thm

Guys I KNOW how to fix my macaddress. All these methods suggested the editing of WIFI file which is a known thing.

I want to do a ROM repack that WON'T mess up an unsuspecting user's mac address at all.

Everything I ve tried results in the same behavior: After baking a zip and having carefully checked the updater script the Mac address still gets messed up.

I found this info on mtk mount layouts: https://github.com/ameer1234567890/OnlineNandroid/wiki/How-To-Gather-Information-About-Partition-Layouts

In our case it is /proc/dumchar_info

and says:

/proc/dumchar_info <

Part_Name Size StartAddr Type MapTo Region

preloader 0x0000000000040000 0x0000000000000000 2 /dev/misc-sd BOOT_1

mbr 0x0000000000080000 0x0000000000000000 2 /dev/block/mmcblk0 USER

ebr1 0x0000000000080000 0x0000000000080000 2 /dev/block/mmcblk0p1 USER

pro_info 0x0000000000300000 0x0000000000100000 2 /dev/block/mmcblk0 USER

nvram 0x0000000000500000 0x0000000000400000 2 /dev/block/mmcblk0 USER

protect_f 0x0000000000a00000 0x0000000000900000 2 /dev/block/mmcblk0p2 USER

protect_s 0x0000000000a00000 0x0000000001300000 2 /dev/block/mmcblk0p3 USER

seccfg 0x0000000000040000 0x0000000001d00000 2 /dev/block/mmcblk0 USER

uboot 0x0000000000060000 0x0000000001d40000 2 /dev/block/mmcblk0 USER

bootimg 0x0000000000a00000 0x0000000001da0000 2 /dev/block/mmcblk0 USER

recovery 0x0000000000a00000 0x00000000027a0000 2 /dev/block/mmcblk0 USER

sec_ro 0x0000000000600000 0x00000000031a0000 2 /dev/block/mmcblk0p4 USER

misc 0x0000000000080000 0x00000000037a0000 2 /dev/block/mmcblk0 USER

logo 0x0000000000800000 0x0000000003820000 2 /dev/block/mmcblk0 USER

ebr2 0x0000000000080000 0x0000000004020000 2 /dev/block/mmcblk0 USER

yl_params 0x0000000000100000 0x00000000040a0000 2 /dev/block/mmcblk0p5 USER

autobak 0x0000000001000000 0x00000000041a0000 2 /dev/block/mmcblk0p6 USER

panic 0x0000000001400000 0x00000000051a0000 2 /dev/block/mmcblk0p7 USER

expdb 0x0000000000a60000 0x00000000065a0000 2 /dev/block/mmcblk0 USER

android 0x0000000050000000 0x0000000007000000 2 /dev/block/mmcblk0p8 USER

cache 0x0000000008000000 0x0000000057000000 2 /dev/block/mmcblk0p9 USER

usrdata 0x0000000171b00000 0x000000005f000000 2 /dev/block/mmcblk0p10 USER

bmtpool 0x0000000000000000 0x00000000ffff00a8 2 /dev/block/mmcblk0 USER

Part_Name:Partition name you should open;

Size:size of partition

StartAddr:Start Address of partition;

Type:Type of partition(MTD=1,EMMC=2)

MapTo:actual device you operate

root@Coolpad8297W:/ # k

Link to comment
Share on other sites

  • 3 weeks later...
Guest Alg0r1thm

OK I found interesting things about the WIFI file containing our Mac address. It seems that even though it has identical structure up till the ending byte of the macadress, it is different in the following bytes from phone to phone.

Which means that every coolpad f1 has its own identical WiFi nvram file.

I am suspecting some sort of combination of serial and/or imei checksum procedure would make possible an algorithm to regenerate a true factory default nvram WiFi file.

But we need a lot of phone serials&imeis in order to reverse engineer this and life is too short for such silliness...

Link to comment
Share on other sites

  • 4 months later...
Guest unix_bosnia

OK, i find solution, i test on few roms, because almost every rom restart my mac adress to my phone, and I get nvram x00:

 

Problems is in rom install, you must open your rom zip and go to:

 

data/nvram/APCFG

 

 

add here this file extract that, and add that folder, and you now will have two folder in APCFG. Here is complete nvram folder if you want

 

For all you who porting rom 

 

 

Credit go to me :)

Edited by unix_bosnia
Link to comment
Share on other sites

Please sign in to comment

You will be able to leave a comment after signing in



Sign In Now
×
×
  • Create New...

Important Information

By using this site, you agree to our Terms of Use.