Why does my laptop screen have a MAC address?

[chrstrbrts]

Hello,

I bought a laptop last year and accidentally spilled orange juice on it.

I fried the mobo and decided to disassemble the computer and keep the components instead of tossing it to learn more about computer internals and hardware.

My screen has two cable running to it, one through each hinge assembly.

One is sheathed in black fabric like insulation and ends in a simple multi-pin connector that connects somewhere on the mobo.

I presume that this is simply the power input.

The other cable is actually two cables, one white and one black covered in typical plastic insulation.

These cables lead to a small board with a chip on it that is practically the entire size of the board.

The board has two leads for the two cables on one end and something that looks like a small PCIe connection on the other again plugging somewhere into the mobo.

I'm assuming that this is where the data comes through.

I looked on the chip on the small board and it has typical manufacturer stuff: 3 qr codes, serial number, "made in China", etc.

But, it also has a MAC address.

I looked, and it is in fact a 12 digit hex number.

I said all of that to ask this:

Why does a screen's data chip have its own MAC address?

I understand networking equipment having MAC addresses, but a screen?

Any thoughts?

Thanks.

 

[dave_the_nerd]

Those cables are the antennae for your wifi card. They are usually run up into the screen for better reception.

The other multiple-pin connector is what provides data/power to the screen.

 

[chrstrbrts]

Those cables are the antennae for your wifi card. They are usually run up into the screen for better reception.

The other multiple-pin connector is what provides data/power to the screen.

OK, thanks.

Any advice for how I can remove the chip without damaging anything?

My goal is to extricate the chip from the small board, flash it with something like these so I can change the MAC address at the hardware level, and then reattach the chip and use the device.

The problem is that the chip looks "low-profile".

What I mean is I don't see any pins coming off of it.

It looks very flat on the board and almost like it's glued down.

What's the proper term for this type of pinless chip?

More importantly, how can I remove it without damaging anything?

Lastly, are these types of pinless chips flashable by using an external programmer like those Wellons above?

Or, can I flash it somehow on-board?

Thanks.

 

[dave_the_nerd]

OK, thanks.

Any advice for how I can remove the chip without damaging anything?

Not really possible - they're soldered on there by impossibly precise robots. Ball Grid Array, or whatever it's called - hundreds or even thousands of pins in a square inch or two.

There are hacks for BGA soldering you can try at home:

https://www.youtube.com/watch?v=OkjOwuSEzKU

But by and large, it's done by impossibly precise robots.

My goal is to extricate the chip from the small board, flash it with something like these so I can change the MAC address at the hardware level, and then reattach the chip and use the device.

...why? Do it in software.

http://www.instructables.com/id/How-to-Spoof-Your-MAC-Address/

The primary chip on the wifi card is essentially its own CPU - you wouldn't flash it or reprogram it with one of those anyway. You could mess around with maybe designing custom wifi firmware, I suppose - you can update/patch firmware on a wifi card from within the OS. But unless you're already an electrical engineer, the learning curve would be pretty steep.

The problem is that the chip looks "low-profile".

What I mean is I don't see any pins coming off of it.

It looks very flat on the board and almost like it's glued down.

What's the proper term for this type of pinless chip?

More importantly, how can I remove it without damaging anything?

Lastly, are these types of pinless chips flashable by using an external programmer like those Wellons above?

Or, can I flash it somehow on-board?

Thanks.

See above.

 

[Burpo]

That's not the "screens data chip". It's a wifi card and they come in various shapes/sizes & cost $5-$25.

 

[chrstrbrts]

Not really possible - they're soldered on there by impossibly precise robots. Ball Grid Array, or whatever it's called - hundreds or even thousands of pins in a square inch or two.

Why would a chip require so many connections to the board?

Most of the other chips on my mobo, the ones with visible pins, look like they have a few dozen pins total.

...why? Do it in software.

http://www.instructables.com/id/How-to-Spoof-Your-MAC-Address/

Thanks, but I already know how to change it in software; "spoofing" is what the kids call it nowadays.

The reason why I want to try and flash the chip is to see if I can do it.

Another reason is that there must be some OS call that can read the chip to get the "real" MAC address thereby bypassing the spoofed one.

How else would it be possible to restore the original MAC address through the OS?

If such a system call exists, then it's possible to circumvent someone's attempt at spoofing.

It seems to me, from my novice perspective, that the only true MAC address change can exist at the hardware level.

The primary chip on the wifi card is essentially its own CPU - you wouldn't flash it or reprogram it with one of those anyway.

Which chips can be flashed?

Which can't?

Is it simply an issue of pins?

Pinned chips are flashable; pinless aren't?

If the chip is essentially a small CPU, then where is the MAC address burned?

In a special register within the CPU?

If so, this register can't be written to?

That's not the "screens data chip". It's a wifi card and they come in various shapes/sizes & cost $5-$25.

Yes, my wifi card looks like those.

Incidentally, why doesn't the first card have a MAC address listed on its label?

Is that just a manufacturer's prerogative and not an industry wide convention?

 

[dave_the_nerd]

Why would a chip require so many connections to the board?

Most of the other chips on my mobo, the ones with visible pins, look like they have a few dozen pins total.

More complex chips need more pins. Except for the CPU and GPU, most of the chips on a motherboard only do a couple things and are (relatively) simple. Or they aren't even chips at all (resistors and stuff.)

The Realtek 8111 Ethernet NIC has 64 pins, the Broadcom BMC4311 Wifi chip has 196. For a reference point.

Thanks, but I already know how to change it in software; "spoofing" is what the kids call it nowadays.

The reason why I want to try and flash the chip is to see if I can do it.

Another reason is that there must be some OS call that can read the chip to get the "real" MAC address thereby bypassing the spoofed one.

How else would it be possible to restore the original MAC address through the OS?

If such a system call exists, then it's possible to circumvent someone's attempt at spoofing.

Only if the person doing the circumventing has physical access to the machine that's spoofing its MAC address. Otherwise, the spoofed MAC address is the only thing they see - the WiFi controller at Starbucks isn't able to execute OS calls on your machine.

Anyway, you probably can't do this. Unless you're an electrical engineer or something and actually can rewrite a firmware package/flasher to force a new MAC address - even then it would only work on certain cards.

It seems to me, from my novice perspective, that the only true MAC address change can exist at the hardware level.

It varies from device to device, but they're usually stored in firmware or ROM on the NIC. If it's not in firmware (which can be flashed) then... you can't change it. (Unless you replace the ROM chip, assuming that's not integrated into the controller chip itself...)

Which chips can be flashed?

Which can't?

Some chips are programmable, some aren't. The ones that are tend to be slower and more expensive, so they aren't as common in set-it-and-forget-it consumer electronics.

Is it simply an issue of pins?

Pinned chips are flashable; pinless aren't?

It has nothing to do with pins. BGA chips have pins, they are just very tiny.

If the chip is essentially a small CPU, then where is the MAC address burned?

In a special register within the CPU?

If so, this register can't be written to?

https://en.wikipedia.org/wiki/MAC_address

MAC addresses are most often assigned by the manufacturer of a network interface controller (NIC) and are stored in its hardware, such as the card's read-only memory or some other firmware mechanism.

Yes, my wifi card looks like those.

Incidentally, why doesn't the first card have a MAC address listed on its label?

Is that just a manufacturer's prerogative and not an industry wide convention?

Yeah, the labels aren't standardized. Sometimes it's on a sticker separate from the label and the sticker falls off, etc. Don't overthink it.

 

[chrstrbrts]

Only if the person doing the circumventing has physical access to the machine that's spoofing its MAC address. Otherwise, the spoofed MAC address is the only thing they see - the WiFi controller at Starbucks isn't able to execute OS calls on your machine.

OK. But, can't a server send a packet back to the client that sneaks an executable into memory and asks the OS to perform tasks?

What about sending a packet to the client that says: "Hey, OS. Get the real MAC address from that ROM chip on the NIC and send it to me in a string."

Is that possible?

It varies from device to device, but they're usually stored in firmware or ROM on the NIC. If it's not in firmware (which can be flashed) then... you can't change it. (Unless you replace the ROM chip, assuming that's not integrated into the controller chip itself...)

Is it possible to grab spec sheets for popular wifi cards and see which option they use?

 

[dave_the_nerd]

OK. But, can't a server send a packet back to the client that sneaks an executable into memory and asks the OS to perform tasks?

What about sending a packet to the client that says: "Hey, OS. Get the real MAC address from that ROM chip on the NIC and send it to me in a string."

Is that possible?

Not if your laptop is properly configured with all relevant security patches.

Networking protocols aren't supposed to allow that kind of thing to happen, although sometimes there will be bugs in certain protocol implementations which allow an attacker more access to a system than they should have.

On a laptop, generally speaking, you're going to be running a firewall which will block all incoming traffic, except to certain ports that you've already given your blessing to.

Incoming traffic on those ports will be directed to the applications listening on those ports. (A web server, an Remote Desktop service, etc.)

Those applications are what process the incoming packet. If those applications don't have access to read hardware info (they probably don't), or don't have the ability to read it (almost certainly don't) then it won't happen. In any case, the "magic packet" you're hypothesizing would more than likely be nonsense as far as the service/application is concerned, and would be ignored. (Notwithstanding some kind of weird bugs in the program that allowed malformed packets to cause unexpected behavior.)

Realistically, the only way for that scenario to happen is if you program software yourself that does exactly that.

Is it possible to grab spec sheets for popular wifi cards and see which option they use?

It wouldn't be on the card spec sheet. They usually include the model number of the actual controller chip.

It might be in the development docs for the controller chip itself. Hard to get access to those, though. Generally.

 

[chrstrbrts]

Realistically, the only way for that scenario to happen is if you program software yourself that does exactly that.

OK. So, barring some crazy bug, the only realistic way of doing this is to first somehow get some software on the target machine that responds to the magic packet and makes a system call to get the info.

Right?

Incidentally, do you know the name of the system calls in Windows and *NIX that grab the data from the NIC's ROM?

What about the pertinent C wrapper functions?

It wouldn't be on the card spec sheet. They usually include the model number of the actual controller chip.

It might be in the development docs for the controller chip itself. Hard to get access to those, though. Generally.

Why? Proprietary?

 

[Gunbuster]

Didn't read the latter part of the thread but... I'm really confused by the jump from you not knowing what a standard mini pcie wifi card is to lets help me unsolder the chip to flash a new MAC... In over your head would be an understatement.

 

[dave_the_nerd]

OK. So, barring some crazy bug, the only realistic way of doing this is to first somehow get some software on the target machine that responds to the magic packet and makes a system call to get the info.

Right?

Basically, yes.

Incidentally, do you know the name of the system calls in Windows and *NIX that grab the data from the NIC's ROM?

What about the pertinent C wrapper functions?

No. Good luck figuring it out though. Since you couldn't tell the difference between a screen and a WiFi card 3 days ago, I'd suggest you start with this:

https://www.eecs.umich.edu/

Good luck, see you in a little while.

Why? Proprietary?

I guess it depends on how you define proprietary? Every design is different, most of the designs are patented and/or copy written, and a company is within its rights to charge you for access to that information.

But the information is made available to registered developers and OEM/channel partners who design the boards, as well as, eventually, sometimes, to people in the FOSS community who write drivers and such.

 

[chrstrbrts]

https://www.eecs.umich.edu/
Good luck, see you in a little while.

I was actually accepted to Michigan, but I rejected their offer.

I chose to stay in NY and attend one of the ivies.

Michigan seems like a decent 2nd tier school, though, for people who didn't get accepted to tier 1 schools.

Actually, I started out as an EE major but dropped after a year when I realized that it wasn't going to be challenging enough for me.

I ended up graduating with a degree in pure mathematics.

Anyway, you don't need a degree in EE to extricate and flash a chip.

Christ, people are doing it on YouTube with industrial hair dryers and flapjack griddles.

 

[dave_the_nerd]

I was actually accepted to Michigan, but I rejected their offer.

I chose to stay in NY and attend one of the ivies.

Michigan seems like a decent 2nd tier school, though, for people who didn't get accepted to tier 1 schools.

Actually, I started out as an EE major but dropped after a year when I realized that it wasn't going to be challenging enough for me.

I ended up graduating with a degree in pure mathematics.

Anyway, you don't need a degree in EE to extricate and flash a chip.

Christ, people are doing it on YouTube with industrial hair dryers and flapjack griddles.

Huh.

I initially thought you might actually be serious, but if you're not trolling at this point, you should probably ask your alma mater for a refund.

 

[chrstrbrts]

you should probably ask your alma mater for a refund.

Why?

Because I don't know how to flash an EEPROM?

Computer science generally isn't covered in a pure mathematics curriculum, not in any real depth anyway.

It's OK though, Dave; I understand your jealousy.

I get a lot of it from tier 2 guys like you.

You should relax; everything is alright.

The world needs betas too.

 

[esquared]

OK, this thread has turn into a insult fest.

It's locked now.


esquared
Anandtech Forum Director