Strange physical address on ethernet adapter after flashing bios

Discussion in 'BIOS Mods' started by sawa, Dec 2, 2013.

  1. sawa

    sawa MDL Junior Member

    Jul 22, 2010
    63
    11
    0
    Hi,
    please click on the image below:

    Przechwytywanie.PNG

    As you can see there is 00-11-22-33-44-55. How is it possible? Can I change it?
     
  2. windsman

    windsman MDL Expert

    Jan 11, 2010
    1,491
    1,350
    60
  3. Mutagen

    Mutagen MDL Addicted

    Feb 18, 2013
    580
    123
    30
    #3 Mutagen, Dec 3, 2013
    Last edited: Dec 3, 2013
    Wow, that is neat! Should put it up for sale on eBay.

    (Decades ago, I worked with a guy whose Social Security number was 555-55-5555. The guy made more money winning bar bets than he did working).
     
  4. sawa

    sawa MDL Junior Member

    Jul 22, 2010
    63
    11
    0
    #4 sawa, Dec 3, 2013
    Last edited: Dec 3, 2013
    (OP)
    My MAC address begins with 001122 that belongs to "CINSYS Inc". It should belong to "Realtek" and not to "CINSYS". That's why I want to change the physical address.

    BTW. I'm just wondering if Is it possible to have a virus in the BIOS (for example a backdoor)? Do you know if a hacker can do something with this simple and strange MAC address?
     
  5. windsman

    windsman MDL Expert

    Jan 11, 2010
    1,491
    1,350
    60
    #5 windsman, Dec 3, 2013
    Last edited: Dec 3, 2013
    The previous link is a archive of codes (the date of the list is old), maybe some codes change.

    If you change the Mac adress in bios your adaptater should not working (for sure).

    If you think a threat is in your bios (thing that i doubt), just flash it and everything should be original.

    windsman.

    PS : Normally if you open your computer, a sticker should be on the ethernet adaptater with the MAC adress writing.

     
  6. Carlos Detweiller

    Carlos Detweiller Emperor of Ice-Cream

    Dec 21, 2012
    6,349
    7,068
    210
    In Device Manager, entry of your NIC, on the Advanced tab, is there anything configured in "Network Address"?
     
  7. sawa

    sawa MDL Junior Member

    Jul 22, 2010
    63
    11
    0
    #9 sawa, Dec 10, 2013
    Last edited: Dec 10, 2013
    (OP)
    NIC.PNG

    I flashed my BIOS with "5FCN35WW.exe" found on internet that can't be downloaded from the Lenovo official site because they write that "Bios update is not required for this product" (my model is Z580). That's why I also had a question about the virus in the BIOS. I think my MAC address changed for this reason. Am I right?
     
  8. Stannieman

    Stannieman MDL Guru

    Sep 4, 2009
    2,232
    1,818
    90
    The adapter will work fine if you change it. You just have to make sure no identical addresses exist in the same subnet (behind last router).
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  9. Yen

    Yen Admin
    Staff Member

    May 6, 2007
    13,081
    13,980
    340
    Why have you flashed an unofficial BIOS? Is it modified, or does it fix an issue?
    Normally a biosupdate does not change the MAC and keeps the original one. It sounds to me it has been overwritten when you flashed it and it simply shows a default one that it can be addressed at all....
    It also can be the BIOS was obtained from a full dump from another machine...and the MAC address conflict caused a reset to default whilst flashing...

    How did you flash it? something with /all switch?

    You don't have to be worried of a BIOS virus because of that....it's just a default address which is used when the original becomes overwritten...
    But I do not recommend to flash a BIOS which is not officially available (and modified).

    To mod a current one if no update is officially available always use the own dump (backup)
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  10. sawa

    sawa MDL Junior Member

    Jul 22, 2010
    63
    11
    0
    #12 sawa, Dec 17, 2013
    Last edited: Dec 17, 2013
    (OP)
    I flashed the BIOS because I had a problem with boot: the BIOS didn't save the settings for boot priority order.

    I flashed the BIOS more than one time. The first time, I flashed it booting from pendrive but I don't own the files on pendrive anymore (I only remember that there was a .rom file). The first method didn't help.
    The second time, I flashed the BIOS by simply double clicking on "5FCN35WW.exe" which has copyright from "Phoenix Technologies Ltd." and I don't know if it's modified. I suppose that the person who shared that file, had the same problem as me and contacted the Lenovo support which sended that file to him. So the second method helped. Now everything is ok, except for the MAC address and UUID Number, that now is different. Please help me.
     
  11. Yen

    Yen Admin
    Staff Member

    May 6, 2007
    13,081
    13,980
    340
    It is really no issue. :)
    Normally each MAC and UUID should be unique identifiers. But any virtual machine can used modified values. Both values seem to be used at M$ activation (installationID). M$ uses them to have reference to the machine activated.

    The worst thing that can happen is that M$ product gets deactivated when activated with the original values before.....but that's no issue since you can reactivate it...

    Per definition MAC and UUID must not be zero or FFh.
    Would you know your original values?
    If it uses phoenix winphlash one could extract the exe and add into the ini [UI] advanced = 1 to enable advanced settings, AFAIK there can be new DMI entries flashed....not sure if for MAC.....
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  12. LatinMcG

    LatinMcG Bios Borker

    Feb 27, 2011
    5,711
    1,606
    180
    only 2 ways i find it if its not on a sticker
    1: in registry
    2: in router logs

    some bios flashes have power to mod the mac address, not many ive seen tho.
    sometimes u can find the chipset and find the mac flash tool
     
  13. sawa

    sawa MDL Junior Member

    Jul 22, 2010
    63
    11
    0
    #15 sawa, Dec 19, 2013
    Last edited: Dec 19, 2013
    (OP)
    Yes, it does.

    Is it possible to extract the exe without running it? If yes, how can I do it? I'm asking because if I run it, it starts to flash and I can do nothing.
    It's impossible to extract it with 7-zip.
     
  14. sawa

    sawa MDL Junior Member

    Jul 22, 2010
    63
    11
    0
    #17 sawa, Jan 6, 2014
    Last edited: Jan 6, 2014
    (OP)
    Universal Extractor.PNG

    FindGZ.PNG

    Both of them didn't work.
    With FindGZ nothing was extracted.

    BTW I'm not sure if this can help us, but in regedit I noticed this:

    MAC1.png

    MAC2.png
     
  15. nexus76

    nexus76 MDL Addicted

    Jan 25, 2009
    788
    300
    30
    #18 nexus76, Jan 6, 2014
    Last edited: Jan 6, 2014
    extract

    Just open the exe, in C:\Users\{YourUserName}\AppData\Local\Temp\ExtactTemp there's the extracted folder were the ROM gets uncompressed:

    extact.jpg
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  16. sawa

    sawa MDL Junior Member

    Jul 22, 2010
    63
    11
    0
    #19 sawa, Jan 8, 2014
    Last edited: Jan 8, 2014
    (OP)
    Sorry guys, I was pretty sure that the exe file uses Phoenix Winphlash. I just opened it again and I saw that it uses Phoenix SCT Flash, which starts to flash automatically and I can do nothing.
    Unfortunately there isn't any extracted bios in the temp directory.
    I only found some .mo files:

    temp.PNG
     
  17. Tito

    Tito Super Mod / Adviser
    Staff Member

    Nov 30, 2009
    18,681
    18,589
    340
    You need to run the SFX on a non-Lenovo PC, perhaps a VM to get the files. Close the error message after grabbing them from TEMP.