Simple + Intuitive MAC Address Spoofer on
Windows 2000, XP, 2003, VISTA, 2008, Windows 7, Virtual Machine (VM)

Download NowTry Now

Getting Started

Before we get into the technical details, if you are not comfortable of changing MAC Address via registry entries, please use the User Friendly SMAC MAC Address Changer. It will be less risk and it will make your life a lot easier.

There could be couple ways to do change (spoof) MAC Addresses on Windows 2000, XP, 2003, and VISTA.Make sure you read through the steps first.If my explanation does not make sense to you, please useSMAC.

The following information is provided “AS IS.”If you have any inputs, please feel free to send me an email.

Before we start: KLC Consulting Security Teamhas developed a Windows MAC Address Spoofing tool, SMAC. SMAC is developed based on this research article, and it has manyfunctionalities. SMAC allows Windows 2000, XP, 2003 Server and VISTA users to change MACaddress regardless of whether manufacturers allow this option or not. URL of SMAC is http://www.klcconsulting.net/smac.

Method 1:

This is depending on the typeof Network Interface Card (NIC) you have.Ifyou have a card that doesn’t support Clone MAC address, then you have to go tosecond method.

1. Go to Start->Settings->Control Panel and double click on Network and Dial-up Connections.

2. Right click on the NIC you want to change the MAC address and click on properties.

3. Under “General” tab, click on the “Configure” button

4. Click on “Advanced” tab

5. Under “Property section”, you should see an item called “Network Address” or 'Locally Administered Address', click on it. (See figure below as an example)
   

6. On the right side, under “Value”, type in the New MAC address you want to assign to your NIC.Usually this value is entered without the “-“ between the MAC address numbers.

7. Goto command prompt and type in “ipconfig /all” or “net config rdr” to verify the changes.If the changes are not materialized, then use the second method.

8. If successful, reboot your systems.

Method 2:

This method requires someknowledge on the Windows Registry.If you are not familiar with Windows Registry, just use the simple-to-useSMAC MAC Address Changer to change the MAC addresses (the easiest and safest way,) or consult with a technicalperson before you attempt on the following steps.Also, make sure you have a good backup of your registry.

1.Goto command prompt and type “ipconfig /all”, and

I. Record the Description for the NIC you want to change.

II. Record the Physical Address for the NIC you want to change. Physical Address is the MAC Address
figure 1.

2.Goto command prompt and type “net config rdr”, and you should seesomething like

figure 2.

3.Remember the number between the long number (GUID) inside the { }.For example, in the above “net config rdr” output, for MAC address“00C095ECB793,” you should remember {1C9324AD-ADB7-4920-B02D-AB281838637A}.You can copy and paste it to the Notepad, that’s probably the easiestway. (See figure 2.)

4.Go to Start -> Run, type “regedt32” to start registry editor.Do not use “Regedit.”

5.Do a BACKUP of your registry in case you screw up the following steps.To do this

1. Clickon “HKEY_LOCAL_MACHINE on Local Machine” sub-window

2. Clickon the root key “HKEY_LOCAL_MACHINE”.

3. Clickon the drop-down menu “Registry -> Save Subtree As” and save the backupregistry in to a file. Keep thisfile in a safe place.

6.Go to “HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlClass{4D36E972-E325-11CE-BFC1-08002BE10318}. Double click on it to expand the tree.Thesubkeys are 4-digit numbers, which represent particular networkadapters. You should see it starts with 0000, then 0001, 0002, 0003 and soon. (See figure 3.)

Figure 3.

7. Go through each subkey that starts with 0000. Click on 0000, check DriverDesckeyword on the right to see if that's the NIC you want to change the MACaddress. The DriveDesc should match the Description yourecorded from step (a.-I.). If you are not 100% sure about the DriverDesc,then you can verify by checking if the NetCfgInstanceID keyword valuematches the GUID from step (c).
If there is no match, then move on to 0001, 0002, 0003, and so on, until youfind the one you want. Usually 0000 contains the first NIC youinstalled on the computer.
In this demonstration, 0000 is the NIC I selected. (See figure 3.)

8. Once you selected the subkey (i.e. 0000), check if there is a keyword 'NetworkAddress'exist in the right side of the window. (See figure 3.)

I. If 'NetworkAddress' keyworddoes not exist, then create this new keyword:

i. Click on the drop down menu “Edit -> Add Value”.

ii. In the Add Value window, enter the following value then clickOK. (See figure 4.)
Value Name: =NetworkAddress
Data Type: =REG_SZ

Figure 4.

iii. String Editor window will pop up at this time (see figure5.)

iv. Enter the new MAC address you want to modify. Then click OK.
(There should not be any '-' inthis address. Your entry should only consist of 12 digits as seen in thefigure 5.)

II. If 'NetworkAddress' keyword exists, make sure it shows thekeyword type is REG_SZ, and it should show as NetworkAddress:REG_SZ: . This keyword might not have a value at this time.

i. Double click on the keyword NetworkAddressand the String Editor window will pop up. (See Figure 5.)

ii. Enter the new MAC address you want to modify. Then click OK.
(There should not be any'-' in this address. Your entry should only consist of 12digits as seen in the figure 5.)

Figure 5.

The Simple-to-UseSMAC MAC Address Changer (Spoofer) is definitely a lot SAFER and EASIER for this type of process. Check out some SMAC screenshots. ☺

9.There are 2 ways to make the new MAC address active. Method I doesnot require a system reboot:

I. Goto Start->Setting->Control Panel, and double click on'Network Neighborhood'.
WARNING: Make sure you understand that you WILL lose thenetwork connection after completing step 'ii.' below, and
if you have a DHCP client, you will get a new IP addressafter completing step 'iii.'

i. Select the Network Adaptor you just changed the MAC address.

ii. Right click on the selected Network Adaptor and click'Disable.'
Verify the status column for this adaptorchanges to 'Disabled'

iii. Right click on the selected Network Adaptor and click'Enable.'
Verify the status column for this adaptorchanges to 'Enabled'

iv. If for any reason it cannot be disabled or re-enabled, you have to
reboot your system to make thechanges effective.

II. Reboot your Windows system.

10. Once completing step j (if rebooting the system, wait until the reboot is completed), go to command prompt, type “ipconfig /all” to confirm the new MAC address.

Note: SMAC 2.0 Professional Edition can do step 9 and 10 with '1-click' and that really means 1 click, on the 'Activate MAC' button.

Now you have seen the whole process, it's time to see how SMAC MAC Address Changer (Spoofer) is a lot SAFER and EASIER for changing (spoofing) MAC Address on Windows 2000, XP, 2003, and VISTA . ☺

Restore The TRUE Hardware burned-in MAC Address:

1. Remove the entry you added:

1. If you followed Method 1, then go back to the advanced properties window and remove the entry you add.

2. If you followed Method 2, then remove the 'NetworkAddress' keyword you added in the registry.

2. Use step (j) above to activate the change you make.

3. Once rebooted, go to command prompt, type “ipconfig /all” to confirmthe original MAC address.

IfMAC Address changes does not work:

If for whatever reason the MAC address cannot be changed usingmethod 2, make sure you restore the registry setting by following the 'Restore The TRUE Hardware burned-in MAC Address' instruction above.If necessary, restore the registry you just backed-up to get your systemback to the original state.You cando this by clicking on the drop-down menu “Registry->Restore,” andrestore your backup registry file.

MACAddress Spoofer:

KLCConsulting Security Team has developed SMAC,a Windows MAC Address Changer / Spoofer for Windows 2000, XP, 2003, and VISTA Serversystems, regardless ofwhether manufacturers allow this option or not. SMAC has been used by many Fortune 500 companies to help enhancing their security and provide network solutions. KLC has integrated features requested by network and security professionals, andSMAC has been published inmany security books and training manuals.SMAC URL is http://www.klcconsulting.net/smac.

Reference:

Additionalinformation:

About KLC Consulting:

KLC's mission is to provide a continuous effort to protect the confidentiality, integrity and availability of your corporate resources and data. Through each stage of the information security lifecycle, we help you prevent, detect, respond to, and resolve your enterprise security issues. We published several best practices articles and virus analyses to assist the public to stay secure.

KLCencompasses security expertise in the MAC Address (Network Address) based Security, Networking and Application Security, Financial Institutions (GLBA), Healthcare (HIPAA Security) and Pharmaceutical (21 CFR Part 11), Vulnerability Management and Protection, Security Technologies Design and Implementation, and a full range of Professional Security Services.

Contact KLC Consulting:

KLC Consulting, Inc.
http://www.klcconsulting.net

Telephone:
617-314-9721

E-Mail:
info@klcconsulting.net

Postal Mail:
KLC Consulting, Inc.
PO Box 395
Holden, MA 01520