[RESOLVED] Anti Spoofing MAC Address Change

[nepalbinod]

My program's security basically depends on the host PC's MAC Address. Since there are a couple of utilities that can change MAC Address of a Network Card. My question is, under VB 6, is there any way to ....

1. Get the original MAC Address (no matter which address has been configured)
2. Or, Forcefully restore the original MAC Address of the NIC.

Thankxs.

[Hack]

As far as I know, the answer is no to both.

[nepalbinod]

I have tested a utility "Amac MAC Address Changer". With this utility you can change the MAC Address of NIC Card, and later you can reset the MAC Address to its original state.

If MAC Address can be changed and reset by a utility, WHY not VB6 ?

[zeezee]

Did you try a simple google search

http://www.nthelp.com/NT6/change_mac_w2k.htm
http://www.irongeek.com/i.php?page=security/changemac
http://www.techsupportforum.com/netw...ss-all-fs.html
http://www.thescripts.com/forum/thread274429.html
http://www.windowsitpro.com/Article/...256/23256.html

[Hack]

I have tested a utility "Amac MAC Address Changer". With this utility you can change the MAC Address of NIC Card, and later you can reset the MAC Address to its original state.

If MAC Address can be changed and reset by a utility, when not VB6 ?

Ok....I didn't know you could do that, but, at any rate, I strongly suspect this utility was not written in VB6, but probably something like C++

[zeezee]

Oops !!!
I think I gave you how to change it, not how to restore it.
Sorry!
My Bad.

[nepalbinod]

Did you try a simple google search

http://www.nthelp.com/NT6/change_mac_w2k.htm
http://www.irongeek.com/i.php?page=security/changemac
http://www.techsupportforum.com/netw...ss-all-fs.html
http://www.thescripts.com/forum/thread274429.html
http://www.windowsitpro.com/Article/...256/23256.html

Yes, zeezee. I have been searching for some time. I've already been to these sites. My question, again, is if MAC Address can be changed and reset from a utility, why not from VB 6?

Hack says the answer is no to both questions, but what I feel is there must be a way that MAC Address change can be retained.

[zeezee]

Ok look at these

http://www.klcconsulting.net/Change_MAC_w2k.htm
http://tmac.technitium.com/tmac/index.html

in 1st one

*

SMAC took advantage of the NdisReadNetworkAddress function in the Microsoft Device Driver Development Kit (DDK.)
*

NdisReadNetworkAddress(...) is called by the network adapter driver to obtain a user specified MAC address in the registry. After the driver confirms that there's a valid MAC address specified in the registry key, the driver then programs the MAC address to its hardware registers to override the burn-in MAC address.

2nd one

This software just writes an value into the windows registry. When the Network Adapter Device is enabled, windows searches for the registry value 'NetworkAddress' in the key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1- 08002bE10318}\[ID of NIC e.g. 0001]. If a value is present, windows will use it as MAC address, if not, windows will use the hard coded manufacturer provided MAC address. Simple? Some Network Adapter drivers have this facility built-in. It can be found in the Advance settings tab in the Network Adapter's Device properties in Windows Device Manager.

4. To restore the original MAC address of the network adapter, select the adapter, click Change MAC button and then click Original MAC button and confirm changes you made when prompted.

NOTE: This tool cannot change MAC address of Microsoft Network Bridge. Network Bridge will automatically use the original MAC address of the first NIC added into bridge with the first octet of MAC address set to 0x02.

so the answer to your qestion lies there.
May be you could contact those developers and get some help. (If they are willing)

Sure you can do it in VB. Its only a registry hack. make an app to search for those values and resotre it.
But changing original Hardware MAC is beyond my knowledge. May be a Flash burner or some radio shack gadget would do.

[nepalbinod]

Hello Folks,

I have been through this for the whole day. My conclusion here is :

1. By default, the MAC Address of a LAN Card is not saved on registry.
2. When a user changes the MAC Address of a NIC with a utility, it is not actually changed. The MAC Address remains same forever, only the registry contains an additional entry "NetworkAddress" in

"HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}\"
under the respective key of ethernet control

e.g.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}\0000

If I had come to the conclusion very fast or impatiently, it is :

Delete the String Value "NetworkAddress" for each Network Control Class. The changed MAC Address will be reset to the original one.

Could you show me VB Function that upon call, deletes the above entries in the registry.

Thankx.

[LaVolpe]

There are dozens upon dozens of registry editors on forums like this one, and sites like PSCcode. You can easily use them and tweak your own registry. Keep in mind that on newer systems, anyone running your app without higher privileges probably won't be able to modify the registry.

[nepalbinod]

Yes zeezee.

Now on the next step ...

I want a way to force the registration to "demo version only" if there is not "actual ethernet controller" present on the system.

Since, anyone could use "Microsoft Loopback Adapter" which has "02-00-4C-4F-4F-50" MAC Address and register the program with the same serial number on multiple systems.

What is the range of MAC Address that is alloted to NIC manufacturers ?
What is the range of MAC Address that have been reserved for "Virtual Network Devides" such as "Microsoft Loopback Adapter".

[zeezee]

See whether this would help you

http://standards.ieee.org/regauth/oui/oui.txt

But I wouldnt think that there is REALLY a way to avoid this.

You know hackers will always hack. SO they will find a way around this also.

Another thing is to get the real Hardware MAC. This wouldnt be easy. But sure their would be a way to that.

I still wonder whether ther is actually way to stop piracy.

But , wish you luck.

[Hack]

I still wonder whether ther is actually way to stop piracy.

Yes, there is a way. It is invented nearly every day.

Then, the day after, someone comes up with a way to get around the new way to prevent it.

If your question was "I still wonder whether ther is actually way to stop piracy permanately...then I would No.

[RobDog888]

It doesnt matter if the user has MAC cloning software or Hack it somehow. The real solution will be in the way your obtain the MAC address. If you use WMI then it should be obtaining it from the network card and not the registry.

[zeezee]

@ Hack
Sometimes wonder isnt it good if everything was free. Then no hackers right?
Then again , how would I feed my self If I cant make money
So its going to be a never ending fight between Pirates and Traders.
(A Good plot for next Pirates of the Caribbean????)

@ RobDog888

Yeah you gave one good point.

[nepalbinod]

It doesnt matter if the user has MAC cloning software or Hack it somehow. The real solution will be in the way your obtain the MAC address. If you use WMI then it should be obtaining it from the network card and not the registry.

Would you tell me how to obtain MAC Addres using WMI.

Still Unanswered Questions:
What is the range of MAC Address that is alloted to NIC manufacturers ?
What is the range of MAC Address that have been reserved for "Virtual Network Devides" such as "Microsoft Loopback Adapter"?

[RobDog888]

Download Scriptomatic v2 from Microsoft and it will generate the script to execute the WMI code. Then just convert to VB.

On Error Resume Next

Const wbemFlagReturnImmediately = &h10
Const wbemFlagForwardOnly = &h20

arrComputers = Array(".")
For Each strComputer In arrComputers
   WScript.Echo
   WScript.Echo "=========================================="
   WScript.Echo "Computer: " & strComputer
   WScript.Echo "=========================================="

   Set objWMIService = GetObject("winmgmts:\\" & strComputer & "\root\CIMV2")
   Set colItems = objWMIService.ExecQuery("SELECT * FROM Win32_NetworkAdapter", "WQL", _
                                          wbemFlagReturnImmediately + wbemFlagForwardOnly)

   For Each objItem In colItems
      WScript.Echo "AdapterType: " & objItem.AdapterType
      WScript.Echo "AdapterTypeId: " & objItem.AdapterTypeId
      WScript.Echo "AutoSense: " & objItem.AutoSense
      WScript.Echo "Availability: " & objItem.Availability
      WScript.Echo "Caption: " & objItem.Caption
      WScript.Echo "ConfigManagerErrorCode: " & objItem.ConfigManagerErrorCode
      WScript.Echo "ConfigManagerUserConfig: " & objItem.ConfigManagerUserConfig
      WScript.Echo "CreationClassName: " & objItem.CreationClassName
      WScript.Echo "Description: " & objItem.Description
      WScript.Echo "DeviceID: " & objItem.DeviceID
      WScript.Echo "ErrorCleared: " & objItem.ErrorCleared
      WScript.Echo "ErrorDescription: " & objItem.ErrorDescription
      WScript.Echo "Index: " & objItem.Index
      WScript.Echo "Installed: " & objItem.Installed
      WScript.Echo "LastErrorCode: " & objItem.LastErrorCode
      WScript.Echo "MACAddress: " & objItem.MACAddress
      WScript.Echo "Manufacturer: " & objItem.Manufacturer
      WScript.Echo "MaxNumberControlled: " & objItem.MaxNumberControlled
      WScript.Echo "MaxSpeed: " & objItem.MaxSpeed
      WScript.Echo "Name: " & objItem.Name
      WScript.Echo "NetConnectionID: " & objItem.NetConnectionID
      WScript.Echo "NetConnectionStatus: " & objItem.NetConnectionStatus
      strNetworkAddresses = Join(objItem.NetworkAddresses, ",")
         WScript.Echo "NetworkAddresses: " & strNetworkAddresses
      WScript.Echo "PermanentAddress: " & objItem.PermanentAddress
      WScript.Echo "PNPDeviceID: " & objItem.PNPDeviceID
      strPowerManagementCapabilities = Join(objItem.PowerManagementCapabilities, ",")
         WScript.Echo "PowerManagementCapabilities: " & strPowerManagementCapabilities
      WScript.Echo "PowerManagementSupported: " & objItem.PowerManagementSupported
      WScript.Echo "ProductName: " & objItem.ProductName
      WScript.Echo "ServiceName: " & objItem.ServiceName
      WScript.Echo "Speed: " & objItem.Speed
      WScript.Echo "Status: " & objItem.Status
      WScript.Echo "StatusInfo: " & objItem.StatusInfo
      WScript.Echo "SystemCreationClassName: " & objItem.SystemCreationClassName
      WScript.Echo "SystemName: " & objItem.SystemName
      WScript.Echo
   Next
Next

[nepalbinod]

Thankx RobDog888,

This was a bit hard to implement on VB6. I couldn't play around with 'WScript'.

In my case (please note)
Just don't need to access the WMI Service through network. The program is intended to check the MAC Address of the computer on which it is running.

I will try the 'Scriptomatic v2' thing asap.

Thankx for the your great concept, but the problem is not solved till now if I mean it do your way (and I think that's the best way).

[RobDog888]

Well it is easy to convert. Just change all variables to either string or Object as needed so you can maintain the Option Explicit good coding standards. then switch Echos to MsgBox or write to a string variable.

But most important is that it shows the properties available to you which is hard to figure out any other way.

[zeezee]

What is the range of MAC Address that is alloted to NIC manufacturers ?

http://standards.ieee.org/regauth/oui/oui.txt

This is it I think.

BTW, what ever the method we obtain MAC, WMI or Registry, isnt it the driver that provides it?

@nepalbinod
Just a question, cant you use any other method for this demo version thing?
Like MB Serial + Hard Drive Serial ?

Or GUID / UUID?

[nepalbinod]

Of course, zeezee !

But this method has already been implemented and now if I am able to obtain the original MAC Address (I will finally do it!), it would be very hard to crack the program unless a keygen is developed.

Hi RobDog888,

I tested as you said, I changed (spoofed) the original MAC Address to 0A-0A-0A-0A-EA-EA. Now when I check using WMI, it returns the spoofed MAC Address (not the original one). Here's the code:

'---------------------------------------------------
'Begin

strComputer = "."
strTargetAddress = "173.16.10.13" 'Change the IP Address to Network Card's IP Address

Set objWMIService = GetObject("winmgmts:\\" & strComputer & "\root\cimv2")
Set colItems = objWMIService.ExecQuery _
    ("Select * From Win32_NetworkAdapterConfiguration Where IPEnabled = True")

For Each objItem In colItems
    arrIPAddresses = objItem.IPAddress
    For Each strAddress In arrIPAddresses
        If strAddress = strTargetAddress Then
            strMACAddress = objItem.MacAddress
  
        End If
    Next
Next

MsgBox strMACAddress

'End
'---------------------------------------------------

It does not work as you said RobDog888!

[westconn1]

there is also an api, getadaptorsinfo which will return the mac address, but without testing how to tell if it is the real one or a spoof

from allapi you can cut out all the stuff you don't need

'Paste this code into a module and set the Startup Object
'to 'Sub Main'
'(To set the startup object, go to
'Project->Project Properties->General Tab->Startup Object)
 
Public Const MAX_HOSTNAME_LEN = 132
Public Const MAX_DOMAIN_NAME_LEN = 132
Public Const MAX_SCOPE_ID_LEN = 260
Public Const MAX_ADAPTER_NAME_LENGTH = 260
Public Const MAX_ADAPTER_ADDRESS_LENGTH = 8
Public Const MAX_ADAPTER_DESCRIPTION_LENGTH = 132
Public Const ERROR_BUFFER_OVERFLOW = 111
Public Const MIB_IF_TYPE_ETHERNET = 1
Public Const MIB_IF_TYPE_TOKENRING = 2
Public Const MIB_IF_TYPE_FDDI = 3
Public Const MIB_IF_TYPE_PPP = 4
Public Const MIB_IF_TYPE_LOOPBACK = 5
Public Const MIB_IF_TYPE_SLIP = 6
 
Type IP_ADDR_STRING
    Next As Long
    IpAddress As String * 16
    IpMask As String * 16
    Context As Long
End Type
 
Type IP_ADAPTER_INFO
    Next As Long
    ComboIndex As Long
    AdapterName As String * MAX_ADAPTER_NAME_LENGTH
    Description As String * MAX_ADAPTER_DESCRIPTION_LENGTH
    AddressLength As Long
    Address(MAX_ADAPTER_ADDRESS_LENGTH - 1) As Byte
    Index As Long
    Type As Long
    DhcpEnabled As Long
    CurrentIpAddress As Long
    IpAddressList As IP_ADDR_STRING
    GatewayList As IP_ADDR_STRING
    DhcpServer As IP_ADDR_STRING
    HaveWins As Boolean
    PrimaryWinsServer As IP_ADDR_STRING
    SecondaryWinsServer As IP_ADDR_STRING
    LeaseObtained As Long
    LeaseExpires As Long
End Type
 
Type FIXED_INFO
    HostName As String * MAX_HOSTNAME_LEN
    DomainName As String * MAX_DOMAIN_NAME_LEN
    CurrentDnsServer As Long
    DnsServerList As IP_ADDR_STRING
    NodeType As Long
    ScopeId  As String * MAX_SCOPE_ID_LEN
    EnableRouting As Long
    EnableProxy As Long
    EnableDns As Long
End Type
 
Public Declare Function GetNetworkParams Lib "IPHlpApi" (FixedInfo As Any, pOutBufLen As Long) As Long
Public Declare Function GetAdaptersInfo Lib "IPHlpApi" (IpAdapterInfo As Any, pOutBufLen As Long) As Long
Public Declare Sub CopyMemory Lib "kernel32" Alias "RtlMoveMemory" (Destination As Any, Source As Any, ByVal Length As Long)
Sub main()
    'This example was created by George Bernier ([email protected])
    Dim error As Long
    Dim FixedInfoSize As Long
    Dim AdapterInfoSize As Long
    Dim i As Integer
    Dim PhysicalAddress  As String
    Dim NewTime As Date
    Dim AdapterInfo As IP_ADAPTER_INFO
    Dim Adapt As IP_ADAPTER_INFO
    Dim AddrStr As IP_ADDR_STRING
    Dim FixedInfo As FIXED_INFO
    Dim Buffer As IP_ADDR_STRING
    Dim pAddrStr As Long
    Dim pAdapt As Long
    Dim Buffer2 As IP_ADAPTER_INFO
    Dim FixedInfoBuffer() As Byte
    Dim AdapterInfoBuffer() As Byte
    
    'Get the main IP configuration information for this machine using a FIXED_INFO structure
    FixedInfoSize = 0
    error = GetNetworkParams(ByVal 0&, FixedInfoSize)
    If error <> 0 Then
        If error <> ERROR_BUFFER_OVERFLOW Then
           MsgBox "GetNetworkParams sizing failed with error " & error
           Exit Sub
        End If
    End If
    ReDim FixedInfoBuffer(FixedInfoSize - 1)
 
    error = GetNetworkParams(FixedInfoBuffer(0), FixedInfoSize)
    If error = 0 Then
            CopyMemory FixedInfo, FixedInfoBuffer(0), Len(FixedInfo)
            MsgBox "Host Name:  " & FixedInfo.HostName 'host name
            MsgBox "DNS Servers:  " & FixedInfo.DnsServerList.IpAddress 'dns server IP
            pAddrStr = FixedInfo.DnsServerList.Next
            Do While pAddrStr <> 0
                  CopyMemory Buffer, ByVal pAddrStr, Len(Buffer)
                  MsgBox "DNS Servers:  " & Buffer.IpAddress 'dns server IP
                  pAddrStr = Buffer.Next
            Loop
            
            Select Case FixedInfo.NodeType 'node type
                       Case 1
                                  MsgBox "Node type: Broadcast"
                       Case 2
                                   MsgBox "Node type: Peer to peer"
                       Case 4
                                    MsgBox "Node type: Mixed"
                       Case 8
                                    MsgBox "Node type: Hybrid"
                       Case Else
                                    MsgBox "Unknown node type"
            End Select
            
            MsgBox "NetBIOS Scope ID:  " & FixedInfo.ScopeId 'scope ID
            'routing
            If FixedInfo.EnableRouting Then
                       MsgBox "IP Routing Enabled "
            Else
                       MsgBox "IP Routing not enabled"
            End If
            ' proxy
            If FixedInfo.EnableProxy Then
                       MsgBox "WINS Proxy Enabled "
            Else
                       MsgBox "WINS Proxy not Enabled "
            End If
            ' netbios
            If FixedInfo.EnableDns Then
                      MsgBox "NetBIOS Resolution Uses DNS "
            Else
                      MsgBox "NetBIOS Resolution Does not use DNS  "
            End If
    Else
            MsgBox "GetNetworkParams failed with error " & error
            Exit Sub
    End If
    
    'Enumerate all of the adapter specific information using the IP_ADAPTER_INFO structure.
    'Note:  IP_ADAPTER_INFO contains a linked list of adapter entries.
    
    AdapterInfoSize = 0
    error = GetAdaptersInfo(ByVal 0&, AdapterInfoSize)
    If error <> 0 Then
        If error <> ERROR_BUFFER_OVERFLOW Then
           MsgBox "GetAdaptersInfo sizing failed with error " & error
           Exit Sub
        End If
    End If
   ReDim AdapterInfoBuffer(AdapterInfoSize - 1)
 
 ' Get actual adapter information
   error = GetAdaptersInfo(AdapterInfoBuffer(0), AdapterInfoSize)
   If error <> 0 Then
      MsgBox "GetAdaptersInfo failed with error " & error
      Exit Sub
   End If
   CopyMemory AdapterInfo, AdapterInfoBuffer(0), Len(AdapterInfo)
   pAdapt = AdapterInfo.Next
 
   Do While pAdapt <> 0
        CopyMemory Buffer2, AdapterInfo, Len(Buffer2)
          Select Case Buffer2.Type
                Case MIB_IF_TYPE_ETHERNET
                    MsgBox "Ethernet adapter "
                Case MIB_IF_TYPE_TOKENRING
                    MsgBox "Token Ring adapter "
                Case MIB_IF_TYPE_FDDI
                    MsgBox "FDDI adapter "
                Case MIB_IF_TYPE_PPP
                    MsgBox "PPP adapter"
                Case MIB_IF_TYPE_LOOPBACK
                    MsgBox "Loopback adapter "
                Case MIB_IF_TYPE_SLIP
                    MsgBox "Slip adapter "
                Case Else
                    MsgBox "Other adapter "
        End Select
    MsgBox " AdapterName: " & Buffer2.AdapterName
    MsgBox "AdapterDescription: " & Buffer2.Description 'adatpter name
 
    For i = 0 To Buffer2.AddressLength - 1
           PhysicalAddress = PhysicalAddress & Hex(Buffer2.Address(i))
            If i < Buffer2.AddressLength - 1 Then
             PhysicalAddress = PhysicalAddress & "-"
            End If
 
    Next
    MsgBox "Physical Address: " & PhysicalAddress 'mac address
    If Buffer2.DhcpEnabled Then
            MsgBox "DHCP Enabled "
    Else
            MsgBox "DHCP disabled"
    End If
 
    pAddrStr = Buffer2.IpAddressList.Next
    Do While pAddrStr <> 0
           CopyMemory Buffer, Buffer2.IpAddressList, LenB(Buffer)
           MsgBox "IP Address: " & Buffer.IpAddress
           MsgBox "Subnet Mask: " & Buffer.IpMask
           pAddrStr = Buffer.Next
           If pAddrStr <> 0 Then
            CopyMemory Buffer2.IpAddressList, ByVal pAddrStr, Len(Buffer2.IpAddressList)
           End If
   Loop
    MsgBox "Default Gateway: " & Buffer2.GatewayList.IpAddress
    pAddrStr = Buffer2.GatewayList.Next
    Do While pAddrStr <> 0
            CopyMemory Buffer, Buffer2.GatewayList, Len(Buffer)
            MsgBox "IP Address: " & Buffer.IpAddress
            pAddrStr = Buffer.Next
            If pAddrStr <> 0 Then
            CopyMemory Buffer2.GatewayList, ByVal pAddrStr, Len(Buffer2.GatewayList)
            End If
    Loop
 
    MsgBox "DHCP Server: " & Buffer2.DhcpServer.IpAddress
    MsgBox "Primary WINS Server: " & Buffer2.PrimaryWinsServer.IpAddress
    MsgBox "Secondary WINS Server: " & Buffer2.SecondaryWinsServer.IpAddress
 
    ' Display time
    NewTime = CDate(Adapt.LeaseObtained)
    MsgBox "Lease Obtained: " & CStr(NewTime)
 
    NewTime = CDate(Adapt.LeaseExpires)
    MsgBox "Lease Expires :  " & CStr(NewTime)
    pAdapt = Buffer2.Next
    If pAdapt <> 0 Then
        CopyMemory AdapterInfo, ByVal pAdapt, Len(AdapterInfo)
    End If
 
   Loop
   
End Sub

[Lord Orwell]

do NOT go changing a system setting like the mac address. Some people have their mac address modified because their ISP uses it for authentication, and they've upgraded computers or some such. Deleting that key and resetting their mac address will break their internet connection. That is a VERY bad idea. Changing it in general will screw up internet until a reboot on everyone's computer because it's used for packet routing.

[nepalbinod]

do NOT go changing a system setting like the mac address.

If you read carefully once again, you'll understand that it is not being changed !

Some people have their mac address modified because their ISP uses it for authentication, and they've upgraded computers or some such.

Doesn't a NIC come with a MAC burned in itself ? For what reason should you modify the hard-coded [read-only] MAC Address ? Could you please explain a bit more ?

Deleting that key and resetting their mac address will break their internet connection. That is a VERY bad idea. Changing it in general will screw up internet until a reboot on everyone's computer because it's used for packet routing.

It is not applicable in my case. The software operates on several computers of a network. If you agree, every other system on the LAN might not be connected to ISP oneself !

On our software license agreement, it is clearly stated that the software users are not allowed to change, modify, spoof, ....., edit the MAC Address in any ways.

If the ISP needs their MAC address changed, then they will have to get a new ISP's-favorite Network Interface Card.

Since there are a couple of utilities that can "fake" MAC Address, my concern is just to get the original MAC Address that is programmed into the network card by their manufacturer, not changing a system setting like the mac address.

[zeezee]

I dont know about any other method would work beacuase if Windows is getting the MAC from Registry, will any other method would get it from some where else?
If you are going to use MAC as the security code base, then what you could do is to search the registry for that key "Netowrk Address" in

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}\
sub keys.

Thats how its spoofed.

Besides all the methods should be using the driver. Otherwise reading it directly from the NIC.

But not sure if its a reliable method.
Another thing you could do is to base the key on several Hardware keys.
Hard Drive , M/B , MAC etc ...
But if that is changed, then your client will have to get a new key again from you.
If your agreement has phrase that they cannot change the MAC address by these methods, do a regular search whether they have spoofed the MAC in a way you have found in here.

If westcon1's function doesnt give you results, then I think thats what you would have to do.

[westconn1]

Doesn't a NIC come with a MAC burned in itself ? For what reason should you modify the hard-coded [read-only] MAC Address ? Could you please explain a bit more ?

why they spoof there mac address it not the point, it is unlikely they are doing without good reason, it is not up to software developers to determine how users should set up their computers
reading the original mac from the card is fine, but not to force them to use it
note also that many computers have multiple NICs, some of which are removable, not permanent, like usb wireless cards or pccard, so you need to determin if the card is permanent or other cards are peresent

[RobDog888]

Even routers with mac addresses allow cloning. The suggestion to determine if its an onboard nic or an add on card nic would prove more reliable if its a mobo one but to determine the difference...

[Lord Orwell]

even worse, some computers don't have NICs at all, and in that case, the call returns a different number every single time it is called.

I really don't think it will affect your licensing one way or the other. If they decide to clone the mac address onto every system, that will invalidate the ability of the computers to share a single internet connection, which is pretty much required in most large businesses.

[RobDog888]

More then likely anyone that wants to "hack" the software wont be doing it or running it in a business environment.

[Lord Orwell]

why don't you base the protectoin on something that CAN'T be spoofed, like the hard-drive serial number and dimensions?

[RobDog888]

HDs go out too often. I would use the CPU as the most consistent piece of hardware to generate any alogorithum off of. Add a couple of other hardware items that wont get changed too ofter like amount of RAM.

[Lord Orwell]

Well that's pretty much how microsoft does it. They come up with some number based on system metrics and small changes are ignored. A large change makes you call them and explain!

[RobDog888]

Yup, one other sure fire way is to use one of the loopback adapter hardware keys. You cant use the software without it being verified with the key. Only problem is that you will have to ship it out to the customers that purchase your software.

[nepalbinod]

Greetings to all,

It's been a long time to vbforum. Till now, our software licensing relies on MAC address and for me, it has proven to be 'hacker safe' untill and unless someone is able to know the algorithm and technique used to generate serial numbers for unique MAC Addresses.

What I've implemented is:

• It's very easy to know if MAC Address has been modified or spoofed.
• The software will not work if there is a change or modification in MAC Address (Spoofing).
• If the MAC address has not been altered, each users must have unique serial numbers.

[Lord Orwell]

Greetings to all,

It's been a long time to vbforum. Till now, our software licensing relies on MAC address and for me, it has proven to be 'hacker safe' untill and unless someone is able to know the algorithm and technique used to generate serial numbers for unique MAC Addresses.

What I've implemented is:

• It's very easy to know if MAC Address has been modified or spoofed.
• The software will not work if there is a change or modification in MAC Address (Spoofing).
• If the MAC address has not been altered, each users must have unique serial numbers.

it's not an algorithm. The first half of a mac address is a code assigned to a particular manufacturer and the 2nd half is a manufacturer's serial number. Since there are a finite number of allowed digits, duplicates can exist. For this reason, many modern network cards allow you to reprogram a custom mac address.

[nepalbinod]

it's not an algorithm. The first half of a mac address is a code assigned to a particular manufacturer and the 2nd half is a manufacturer's serial number. Since there are a finite number of allowed digits, duplicates can exist. For this reason, many modern network cards allow you to reprogram a custom mac address.

Please do note that I mentioned algorithm used to generate serial number for each (unique) MAC Address. For example, if a MAC Address is 0021523456FA, the serial number would be something like: Wdf3B eGPD0 GEOD5 4kSG1 8LSG9. The serial number will be different for each MAC address. If anyone modifies it, there will be an entry in the registry which can be caught easily. The software will not work under the condition when MAC Address has been altered.

I hope, I was clear this time...

[Lord Orwell]

Please do note that I mentioned algorithm used to generate serial number for each (unique) MAC Address. For example, if a MAC Address is 0021523456FA, the serial number would be something like: Wdf3B eGPD0 GEOD5 4kSG1 8LSG9. The serial number will be different for each MAC address. If anyone modifies it, there will be an entry in the registry which can be caught easily. The software will not work under the condition when MAC Address has been altered.

I hope, I was clear this time...

oh, sorry. I thought you were saying "generating the mac address". I probably read it wrong. Thanks for the clarification.

In the event someone upgrades, you might be able to add some kind of option to your program that lets them contact customer support for a new code as long as they can give a reasonable explanation for the old one not working any more. Say, it's been two years, you can reasonably expect an upgrade in that time. How about storing BOTH the hard drive AND the mac address in the hash? And only having one be required? This could cut down on customer complaints because if your program detected a change of just one of them it could automatically generate a new hash off the new hardware.

[nepalbinod]

oh, sorry. I thought you were saying "generating the mac address". I probably read it wrong. Thanks for the clarification.

In the event someone upgrades, you might be able to add some kind of option to your program that lets them contact customer support for a new code as long as they can give a reasonable explanation for the old one not working any more. Say, it's been two years, you can reasonably expect an upgrade in that time. How about storing BOTH the hard drive AND the mac address in the hash? And only having one be required? This could cut down on customer complaints because if your program detected a change of just one of them it could automatically generate a new hash off the new hardware.

You're right.