Spoofing MAC ID programmatically

Question

I am trying to change System MAC ID programatically and am using the following code but it does not work as RegistryKey key = bkey.OpenSubKey(Constants.baseReg + nicid) is null. how can i fix this issue. I am running Win7 64 bit OS if that matters.

also public const string baseReg = @"SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}\"; and nicid = the current mac ID of the first network adapter

public static bool SetMAC(string nicid, string newmac)
    {
        bool ret = false;
        using (RegistryKey bkey = GetBaseKey())
        using (RegistryKey key = bkey.OpenSubKey(Constants.baseReg + nicid))
        {
            if (key != null)
            {
                key.SetValue("NetworkAddress", newmac, RegistryValueKind.String);

                ManagementObjectSearcher mos = new ManagementObjectSearcher(
                    new SelectQuery("SELECT * FROM Win32_NetworkAdapter WHERE Index = " + nicid));

                foreach (ManagementObject o in mos.Get().OfType<ManagementObject>())
                {
                    o.InvokeMethod("Disable", null);
                    o.InvokeMethod("Enable", null);
                    ret = true;
                }
            }
        }

Answer 1

So i Solved this Issue after hours of digging and browsing. on the side note, there is a problem with this one, it only uses the first adapter from the ActiveAdapterMAC list.

PSS - This Code isn't the best one and i have few fixes to do. but i am sure this can get you to the right direction. here is the Code to get the current active network adapter NICID then use that to set the MAC ID

public static void GetAllNetworkAdapters()
    {           
        NetworkInterface[] adapters = NetworkInterface.GetAllNetworkInterfaces();
        foreach (NetworkInterface adapter in adapters.Where(a => a.OperationalStatus == OperationalStatus.Up))
        {                
            ActiveAdapters.Add(adapter.Id);
            string MAC = adapter.GetPhysicalAddress().ToString();
            ActiveAdapterMAC.Add(MAC);
            Logger.LogGenericText($"Adapter Properties => {adapter.Id} / {MAC}");
        }
    }

public static string GetSubKeyValue()
    {
        RegistryKey Base = GetBaseKey();
        RegistryKey Key = Base.OpenSubKey(@"SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002BE10318}", true);
        string SelectedKey = null;
        string[] Values = Key.GetSubKeyNames();
        try
        {
            foreach (var key in Values)
            {
                RegistryKey ValueChecker = Base.OpenSubKey(Constants.baseReg + key, true);
                string NetCFID = ValueChecker.GetValue("NetCfgInstanceId").ToString();
                if (NetCFID == ActiveAdapters[0])
                {
                    SelectedKey = key;
                }
                ValueChecker.Close();
            }
        }
        catch(Exception ex)
        {
            if(ex is SecurityException)
            {
                Key.Close();
                return SelectedKey;
            }
        }

        Key.Close();
        return SelectedKey;
    }

public static void ConfigMAC(bool Reset = false, bool RegisterDefault = false)
    {
        RegistryKey Base = GetBaseKey();
        string NICID = GetSubKeyValue();
        string NewMAC = GenerateMACAddress();
        CachedNICID = NICID;

        if (Config.WifiConnection)
        {
            NewMAC = GetRandomWifiMacAddress();
        }

        if (RegisterDefault)
        {               
            string CurrentMAC = GetMacIDWithCache();
            Constants.CurrentMACID = CurrentMAC;
            try
            {
                RegistryKey RegisterKey = Base.OpenSubKey(Constants.baseReg + NICID, true);
                if (RegisterKey.GetValue(Constants.DefaultMAC) != null)
                {
                    RegisterKey.Close();
                    return;
                }
                else
                {
                    RegisterKey.SetValue(Constants.DefaultMAC, CurrentMAC);
                    RegisterKey.Close();
                    return;
                }
            }
            catch (Exception ex)
            {
                Logger.LogGenericText(ex.ToString());
                return;
            }                      
        }

        if (Reset)
        {
            DeleteKey(NICID, true);
            return;
        }

        Logger.LogGenericText("Opening Sub Key => " + Constants.baseReg + NICID);
        RegistryKey Key = Base.OpenSubKey(Constants.baseReg + NICID, true);

        string[] KeyValues = Key.GetValueNames();

        if (!KeyValues.Contains(Constants.MacValue))
        {
            Key.SetValue(Constants.MacValue, NewMAC);
            Logger.LogGenericText("Value Set for " + Constants.MacValue + " as " + NewMAC);                
            Constants.CurrentMACID = NewMAC;
            Task.Run(() => ResetAdapter(NICID));
        }
        else
        {
            DeleteKey(NICID, false);
            Key.SetValue(Constants.MacValue, NewMAC);
            Logger.LogGenericText("Value Set for " + Constants.MacValue + " as " + NewMAC);
            Constants.CurrentMACID = NewMAC;
            Task.Run(() => ResetAdapter(NICID));
        }
        Key.Close();
    }    

    public static void DeleteKey(string Nicid, bool Restart)
    {
        Logger.LogGenericText("Deleting Previous Changed MAC...");
        RegistryKey Base = GetBaseKey();
        RegistryKey ResetKey = Base.OpenSubKey(Constants.baseReg + Nicid, true);
        ResetKey.DeleteValue(Constants.MacValue);
        ResetKey.Close();

        if (Restart)
        {
            Task.Run(() => ResetAdapter(Nicid));
            return;
        }
        else
        {
            return;
        }            
    }

    public static void ResetAdapter(string Nicid)
    {
        ManagementObjectSearcher mos = new ManagementObjectSearcher
                            (new SelectQuery("SELECT * FROM Win32_NetworkAdapter WHERE Index = " + Nicid));

        foreach (ManagementObject o in mos.Get().OfType<ManagementObject>())
        {
            Logger.LogGenericText("Disabling Adapter and Waiting for 6 Seconds.");
            o.InvokeMethod("Disable", null);
            Task.Delay(6000).Wait();
            o.InvokeMethod("Enable", null);
            Logger.LogGenericText("New MAC ID Set Sucessfully!");
        }
    }

How does it work? I used this logic

This software just writes a value into the windows registry. When the Network Adapter Device is enabled, windows searches for the registry value 'NetworkAddress' in the key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class{4D36E972-E325-11CE-BFC1- 08002bE10318}[ID of NIC e.g. 0001]. If a value is present, windows will use it as MAC address, if not, windows will use the hard coded manufacturer provided MAC address. Some Network Adapter drivers have this facility built-in. It can be found in the Advance settings tab in the Network Adapter's Device properties in Windows Device Manager.

From => TMAC website.