[Dev] Real WiFi MAC address - HD2 Android SD Development

Hello, every SD build users,
Savan told me a method about how to get the real WiFi MAC address from the kernel (i.e. the same MAC address you see on WM6.5).
However, we need to get the memory dump of HSPL running WM6.5 and your real MAC address, so Savan can find out the MAC offset and write it to kernel for getting the real WiFi MAC address.
I'm running NAND ROM now and I'm lazy (have no free time) to flash back to WM6.5 just for dumping HSPL and then flash back to MAGLDR later.
Thus, I would like to request helps from you, the SD build users running WM6.5.
If you can help, please use the following steps to dump the HSPL. Thanks.
Backup your original "startup.txt" in Android folder.
Place the following command in "startup.txt".
Code:
pwf hspl.dump 0x0 0x100000
Start HaRET and it will automatically run the above command.
Check if file hspl.dump exists in your SD card.
Send me hspl.dump and your real WiFi MAC address you see on WM6.5.
Reference: http://htc-linux.org/wiki/index.php?title=HaRET_Documentation#HaRET_commands
Update:
We can get the real WiFi MAC address from SPL/HSPL when using SD builds on WM. (Please use r12 kernel if you want to try it.)
However, we cannot get the real WiFi MAC when using MAGLDR and cLK bootloaders.

---

here you are:
MAC
00-23-76-8e-23-dc
let us know... thank
Marco

---

Real MAC:
38: E7: D8: 8E: 27: 6D

---

Thank you very much to marco.palumbi and kajos.
The correct command is 'pwf hspl.dump 0x0 0x100000'.

---

Hello marco.palumbi and kajos,
Thanks for your help.
Which version of HSPL do you use?
Is it SPL 2.08.HSPL?
I can find 0023768E23DC at 0xFC028 when HEX editing marco.palumbi's hspl.dump. (Nothing at 0x90028.)
But I can find 38E7D88E276D at 0x90028 and 0xFC028 when HEX editing kajos' hspl.dump.
These two memory dumps seem to be different in terms of format.
When I add 0x90028 or 0xFC028 to kernel source code, I still cannot read MAC address from kernel.
Maybe Savan and I miss something.
I'm trying different possible methods.

---

tytung said:
Hello marco.palumbi and kajos,
Thanks for your help.
Which version of HSPL do you use?
Is it SPL 2.08.HSPL?
Click to expand...
Click to collapse
My Bootloader shows SPL-3.03.0000
I don't use HSPL
R 2.15.50.14
G 15.42.50.11U
D 3.14.04666
is HSPL necessary for this?

---

Hi tytung,
I have the latest official HTC rom installed on my Italian EU device.
booting the device with vol- pressed I read:
PB81100 HX-BC
SPL-3.03.0000 XE
MicroP(LED) 0x05
MicroP(TOUCH) 0x30
let me know if you need more information

---

Thanks to both of you.
I'm not sure whether SPL and HSPL have different format.
I changed my HD2 to HSPL 2.08 in order to install MAGLDR and flash NAND ROM.
And the new kernel with real MAC fix doesn't work for me on my NAND ROM.
WiFi MAC = ff:ff:ff:ff:ff:ff and bootloop.
Savan, the kernel developer of HTC Photon (HD Mini, another WM6.5 phone), told me that his real MAC fix may only work with SD build.

---

...but you've detected the realMAC at 0xFC028.
May be there a different way for implementing this?

---

Hi!
My MAC: 7C-61-93-33-F1-CF
With Power and Vol- i get:
PB81100 HX-BC
SPL-2.08.HSPL 8G XE
0x50
CotullaHSPL 0x50

---

hi
I am not expert on the HD2 device but I have some experience with embedded systems.
just to better understand and give some help.
the problem can be splitted in two steps:
1) find from somwhere in the device the assigned MAC addres. this seems to be at memory phisycal address 0xFC028 on kajos and mine device.
2) modify the kernel driver in order to use the address retrived from the prvious step.
tytung, which step is failing in your implementation?
to debug you can try
a) to printk() the phisical addres at 0xFC028 (so you can see it on dmesg)
b) modify the ETH kerrnel driver to use a string passed as kernel command line.
the last could be a easy solution for SD users becouse this way they can put the MAC on startup.txt...

---

zboq said:
Hi!
My MAC: 7C-61-93-33-F1-CF
With Power and Vol- i get:
PB81100 HX-BC
SPL-2.08.HSPL 8G XE
0x50
CotullaHSPL 0x50
Click to expand...
Click to collapse
Thank you.
I can find 7C619333F1CF at 0x90028 and 0xFC028 when HEX editing your hspl.dump.

---

marco.palumbi said:
hi
I am not expert on the HD2 device but I have some experience with embedded systems.
just to better understand and give some help.
the problem can be splitted in two steps:
1) find from somwhere in the device the assigned MAC addres. this seems to be at memory phisycal address 0xFC028 on kajos and mine device.
2) modify the kernel driver in order to use the address retrived from the prvious step.
tytung, which step is failing in your implementation?
to debug you can try
a) to printk() the phisical addres at 0xFC028 (so you can see it on dmesg)
b) modify the ETH kerrnel driver to use a string passed as kernel command line.
the last could be a easy solution for SD users becouse this way they can put the MAC on startup.txt...
Click to expand...
Click to collapse
I am not expert on the HD2 device either.
Here is my kernel diff. http://pastebin.com/HeSUAd5Y
What I cannot ensure is values of MSM_SPLHOOD_BASE and id_base.
According to your three spl.dump files, I think id_base = 0xFC028.
I don't know how to determine MSM_SPLHOOD_BASE.
Savan used IOMEM(0xF9500000) in his kernel, but he let me try IOMEM(0xF9200000).
I tried both and had the same result.
dmesg
Code:
<6>[ 3.489532] wifi_nvs_init
<4>[ 3.489562] id1 = 0xffffffff
<4>[ 3.489593] id2 = 0xffffffff
<4>[ 3.489593] id3 = 0xffffffff
<6>[ 3.489624] Device Wifi Mac Address by cardsharing-x: macaddr=ff:ff:ff:ff:ff:ff
I can boot into Android, but it reboots itself later. (I always enable WiFi.)
Update:
Doesn't the original kernel support set cmdline "rel_path=Android wifi.mac=00:11:22:33:44:55" in startup.txt?

---

kajos said:
...but you've detected the realMAC at 0xFC028.
May be there a different way for implementing this?
Click to expand...
Click to collapse
Maybe the real MAC patch only works for SD build because we get memory dump when running WinMo 6.5.
I tested new kernel on NAND with MAGLDR installed.
And the kernel cannot read SPL or have different address offset.
Here is my r12 beta2 kernel including the above real MAC patch.
You can try it on SD build.

---

I'm testing your new kernel and all i can say now is that i have my real mac address.
Edit:
I'm getting 60mA on standby so i'm going back to hastarin 8.6

---

No thanks left today
I'll do it tomorrow
I'm using MccMBoxmaX GS V9
http://forum.xda-developers.com/showthread.php?t=1038694
...and I'm getting no WIFI with r12beta2, but no wifi-error - it only can find no network
Is there a (universal) way, using this AutoMAC?

---

I can confirm that the MAC works for me too with r12beta2.
I get the correct one.
tytung,
I made some tests.
I am able to read the mac address from android in user space.
from the shell I issue this command:
devmem 0xFC028 64
the result for me is :
0x0000DC238E762300
that is my MAC.
devmem is part of busybox and read (and writes) phisycal memory using the /dev/mem device
can please try what is the results on your device?
regarding "wifi.mac=00:11:22:33:44:55" in startup.txt i think that it is not supported by the kernel itself.
in some android ROM this command line parameter is used by an userspace application somwhere during android boot to change values in /proc/calibration.
can you please point me to your latests kernel sources (the r11)?
i would like to give a look to them.

---

tytung said:
Maybe the real MAC patch only works for SD build because we get memory dump when running WinMo 6.5.
I tested new kernel on NAND with MAGLDR installed.
And the kernel cannot read SPL or have different address offset.
Here is my r12 beta2 kernel including the above real MAC patch.
You can try it on SD build.
Click to expand...
Click to collapse
Thank tytung for looking after the SD build user we need more stable kernel .. seems now u are the one that really focus on it !
Sent from my HD2 Bliss using XDA App

---

kajos said:
No thanks left today
I'll do it tomorrow
I'm using MccMBoxmaX GS V9
http://forum.xda-developers.com/showthread.php?t=1038694
...and I'm getting no WIFI with r12beta2, but no wifi-error - it only can find no network
Is there a (universal) way, using this AutoMAC?
Click to expand...
Click to collapse
My kernel needs a new /system/bin/wpa_supplicant.
You can get it from http://nexus-hd2.googlecode.com/files/kernel_tytung_r12_beta1_update.zip
And remember to set the permissions.
Code:
adb shell chown 0:2000 /system/bin/wpa_supplicant
adb shell chmod 755 /system/bin/wpa_supplicant

---

marco.palumbi said:
I can confirm that the MAC works for me too with r12beta2.
I get the correct one.
tytung,
I made some tests.
I am able to read the mac address from android in user space.
from the shell I issue this command:
devmem 0xFC028 64
the result for me is :
0x0000DC238E762300
that is my MAC.
devmem is part of busybox and read (and writes) phisycal memory using the /dev/mem device
can please try what is the results on your device?
regarding "wifi.mac=00:11:22:33:44:55" in startup.txt i think that it is not supported by the kernel itself.
in some android ROM this command line parameter is used by an userspace application somwhere during android boot to change values in /proc/calibration.
can you please point me to your latests kernel sources (the r11)?
i would like to give a look to them.
Click to expand...
Click to collapse
In r12 beta1:
# devmem 0xFC028 64
devmem 0xFC028 64
0xFFFF7FFFFFFFFFFF
Cotulla said "MAGLDR doesn't replace OSPL/HSPL. It runs in the chain after."
http://forum.xda-developers.com/showthread.php?t=893618
Not sure what he means exactly.
I think the kernel cannot access SPL when using MAGLDR and NAND ROM.
Maybe the memory space is overwritten by MAGLDR after HSPL's task is done.
My r11 kernel info: http://forum.xda-developers.com/showpost.php?p=10429937&postcount=3
Git: http://gitorious.org/~tytung/linux-on-wince-htc/tytungs-hastarins-linux_on_wince_htc