[Galaxy S 5 Q&A, Help & Troubleshooting] Alpaca_Bandit:
Hi,

First off i want to state that i have some knowledge of the legal issues concerning changing of MAC addresses and the sole reason that i want to do this is because privacy is a big issue for me and i have a right to enjoy my right. Therefore, any posts or argument concerning such are requested to be posted elsewhere where the topic expressly states so.

Also, please treat me like a newbie when it comes to developing and programming of any kind. I have a very shallow understanding of kernel and the likes.

I am using a rooted S5 G-900H(Exynos with BCM 4534 chip)

Running on 4.4.2 Kitkat stock ROM and Kernel

So without further ado, here is what i have found so far

The MAC address is reflected in a hidden file called .mac.info in the /efs/wifi/ folder. However, editing the file does not change the actual MAC address in anyway. A phone reboot or even turning the wifi on/off will just change it back to the original.

I dumped partitions from /dev/block/ on to my SD card and copied it to my laptop. I searched through the files and found the MAC address in the efs.img partition.My wifi was turned off and the plane was in airplane mode. I modified it and flashed it back using the dd command from terminal emulator on my phone(this can also be done through adb shell but im guessing if you know what that is then you obviously know how to do it).

I rebooted the phone and everything seemed fine. The Wifi MAC address in the status screen in settings displayed my edited address. The .mac.info file also displayed the same. The problem is that it reverted back to the original as soon as i turned on the wifi. The MAC address values in the .mac.info file, status screen and the efs partition from the /dev/block/, all changed back to the original.

I have read that for most phones the important information unique to that particular phone(like IMEI, wifi/BT MAC address, unlock codes and so on) is stored in the NV_DATA.bin file, but everything is encrypted. Also there are only guides as to searching unlock codes and such, so i tried to search for hash blocks randomly using Hex Editor but there was nothing of the sort and the only hash block i can recognize is the one with AES-Encryption as shown from another forum on this site.Maybe it is another type of encryption, but that was another dead end for me.

Then i tried to search and edit various files and kernels as such, but there are no kernels that directly offer this customization. Tried to edit init.tuna.rc but there was no such file in the root directory. Searched init.goldfish.rc and init.wifi.rc and found nothing, but i did see init.svc.macloader mentioned and since i didnt want to mess with programs in the /system/bin/file i left it as is.

Also tried to search through PARAM partition using Hex Editor but nothing was there. Did the same for RADIO and BOOT but i dont think i did find anything major there.

tried to edit /sys/class/net/wlan0/address but it didnt let me, even though i was mounted as r/w. Flashing through dd command on terminal also resulted in permission denied. I was only able to view or dump it. I thought that may have been the source, but modifying the MAC address through the busybox if config command was reflected on the file. which obviously means that its not.

Looked through the dmesg (kernel) log and found a few interesting things but i dont know how to interpret them and what to do with it either. Ill post it later.

There is no NVRAM.txt the only ones in place of it i have are nvram_mfg.txt, nvram_mfg.txt_wisol, nvram_mfg.txt_semco3rd, nvram_net.txt, nvram_net.txt_semco3rd, nvram_net.txt_wisol.

I did do a bit more searching and editing, but i dont recall them right now.

Now, After all that what i think is this.

There is a source for the original MAC address somewhere either hardcoded in the Broadcom chip or somewhere in the partitions under a layer of encyrption.

The Original MAC address is only accessed when the wifi is turned on and not on reboot. This means it is not in any file, program or script that activates on boot, so only scripts and files accessed and imported during the turning on of wifi

must have it. Also while wifi is on and running, busybox ifconfig command changes the MAC address succesfully albeit temporarily, although the change is not seen on the status screen and but it does on the .mac.info file.

Any help from anyone, especially from developers with knowledge of Android kitkat ROm and kernels would be very much appreciated.