Find MAC in memory dump

I tried to find MAC address string in raw memory dump, by viewing dump content in HEX editor, but it looks that dump does not contain any useful details. Can anyone point me in the right direction for this?

http://s29.postimg.org/9y9a2ayzr/screen.png

It would help to understand why you are looking for the MAC Address. There might be a better way.

In general, I want to find offset address for MAC address in memory address space. Debugging has a few commands that use memory address space to read or write data. But any instructions on how to find that registers in memory address space is completely missing. Is there programming way to to find that offset? If MAC address is hard code into the NVRAM, possibly there is way to find an offset.

Not sure if this will help as I don't do this normally.

I used lshw to list installed hardware. In htere is a section for network and here is what it showed me;

        *-network
             description: Ethernet interface
             product: 82567LM-3 Gigabit Network Connection
             vendor: Intel Corporation
             physical id: 19
             bus info: pci@0000:00:19.0
             logical name: enp0s25
             version: 02
             serial: 78:ac:c0:b2:d1:09
             size: 1Gbit/s
             capacity: 1Gbit/s
             width: 32 bits
             clock: 33MHz
             capabilities: bus_master cap_list ethernet physical tp 10bt 10bt-fd 100bt 100bt-fd 1000bt-fd autonegotiation
             configuration: autonegotiation=on broadcast=yes driver=e1000e driverversion=2.3.2-k duplex=full firmware=0.5-3 ip=10.5.32.50 latency=0 link=yes multicast=yes port=twisted pair speed=1Gbit/s
             resources: irq:46 memory:f0500000-f051ffff memory:f0525000-f0525fff ioport:1100(size=32)

At the bottom it looks like memory off-sets. Not sure.

Sorry I couldn't be of more help.

Originally Posted by dorsio In general, I want to find offset address for MAC address in memory address space. Debugging has a few commands that use memory address space to read or write data. But any instructions on how to find that registers in memory address space is completely missing.

Instructions are missing where? Which program do you use to find the MAC address?

Is there programming way to to find that offset? If MAC address is hard code into the NVRAM, possibly there is way to find an offset.

If you know the MAC address, a C program to find it is almost trivial, as long as you have a way to access the NVRAM from C.

Can't you just write the NVRAM content to a file and use the xd command and vi to find the offset of your MAC address?

Originally Posted by berndbausch Instructions are missing where? Which program do you use to find the MAC address? If you know the MAC address, a C program to find it is almost trivial, as long as you have a way to access the NVRAM from C. Can't you just write the NVRAM content to a file and use the xd command and vi to find the offset of your MAC address?

It's limited Busybox shell on embedded system, no access to nvram from C.
Command usage:

macread - <offset address from 0x90000000> Read from MAC register.
macwrite - <val> <offset address from 0x90000000> Write to MAC register.

So I need to know the offset address of register.

Originally Posted by dorsio It's limited Busybox shell on embedded system, no access to nvram from C. Command usage: macread - <offset address from 0x90000000> Read from MAC register. macwrite - <val> <offset address from 0x90000000> Write to MAC register. So I need to know the register numbers.

Your original post contains a screenshot of what looks like a hexdump of NOVRAM. So you are able to look at NOVRAM content. Can this tool copy the dump to a file? If yes, you can use vi or any other editor to search for the MAC address in the dump.

I copied the raw memory dump and save it to a file, but I can't find Mac address there. Also, I'm not sure that MAC is stored on NVRAM, it can be hard coded in config file or other file within /usr/sbin.