📅 This article precedes the reboot and might be outdated.

I recently bought a new LG Nexus 5X, and I was looking for a simple way to permanently change (spoof) the MAC address of the built-in WLAN adapter. It ships with Android Marshmallow 6.0.1 and previous guides do not work with it.

Let’s get to work.

⚠️ Follow the steps described below at your own risk. The author shall not be held responsible for any errors, omissions, or damages arising from the use of the information provided here.

🧑‍⚖️ With that out of the way, know that I have successfully used this method without any noticeable problem.

# Requirements

You’ll need a rooted device and working adb access on your machine. busybox is not mandatory, but if you want to follow my exact steps you’ll need it. It also allows making a backup of the previous MAC address. So, go get it.

# Spoofing

Enable the USB debugging on your device, connect it to your PC and check that everything works as expected.

» adb devices
List of devices attached
[redacted]  device

The WLAN MAC address is stored inside the /persist partition of your device. More info about it can be found here.

First, take a backup using tar:

» adb shell
shell@bullhead:/ $ su
root@bullhead:/ # cd /persist/
root@bullhead:/persist # ls -la
-rw-rw---- bluetooth bluetooth       17 1969-12-31 20:01 bdaddr.txt
drw-r-x--- input    system            1969-12-31 19:56 calibration
drwx------ system   system            1970-02-11 09:38 data
drwx------ root     root              1969-12-31 19:00 lost+found
-rw-r----- root     system        121 1969-12-31 19:55 sensorcal.json
drwxrwx--- drm      system            1969-12-31 20:01 widevine
-rw-rw---- wifi     system        116 2016-01-03 19:59 wlan_mac.bin
root@bullhead:/persist # tar -zcvf /sdcard/persist_backup.tar.gz .
./
./lost+found/
./data/
./data/sfs/
./data/sfs/U6Gno760ZM24B0p9bVVAfWlpN18_
./data/sfs/ONAfupniDQclyd+6sL8DWUyHKTI_
./data/sfs/Hi8Tz8W0bXUB4uoqPe3f39li2kc_
./data/tz/
./data/tz/tz_counter
./data/tz/tz_counter.bak
./data/app_g/
./widevine/
./widevine/index.txt
./calibration/
./calibration/cnt
./calibration/offset
./wlan_mac.bin
./sensorcal.json
./bdaddr.txt
root@bullhead:/persist #

You should now have a backup of the partition, called persist_backup.tar.gz in the root of your /sdcard.

Now let’s take a look at the /persist/wlan_mac.bin file:

root@bullhead:/persist # cat wlan_mac.bin
Intf0MacAddress=[redacted]
Intf1MacAddress=[redacted]
Intf2MacAddress=[redacted]
Intf3MacAddress=[redacted]

I have redacted the actual addresses but you can edit the file (you’ll specifically need to edit the Intf0MacAddress line) to your MAC address of choice. If you are comfortable with vi, edit the file in place. Otherwise, adb pull it, edit and then adb push it. Remember to fix its permissions after the push.

After a reboot (adb reboot), you’ll start using the address.

This way you’ll have a fixed MAC address that persists over reboots. If you prefer to randomly generate a new one, write a small script to replace it by using something similar to the /etc/init.d scripts.

# Bonus: Bluetooth MAC Spoofing

The /persist/bdaddr.txt file contains the MAC address of your BT adapter, that can be spoofed too.