---
layout: post
title: MAC spoofing on Android Marshmallow for LG Nexus 5X
excerpt: >
    How to spoof the MAC address of your LG Nexus 5X.
last_modified_at: 2023-10-03
categories: [articles]
tags: [android, marshmallow, nexus, 5x, mac, spoofing]
---

<div class="note" markdown="1">
📅 This article precedes the [reboot](2023-10-07-reboot.md) and
might be outdated.
</div>

I recently bought a new LG Nexus 5X, and I was looking for a simple way to
permanently change (*spoof*) the MAC address of the built-in WLAN adapter. It
ships with `Android Marshmallow 6.0.1` and previous guides do not work with it.

Let's get to work.

<div class="warning" markdown="1"> ⚠️ Follow the steps described below
at your own risk. The author shall not be held responsible for any errors,
omissions, or damages arising from the use of the information provided here.
</div>

<div class="hint" markdown="1">
🧑‍⚖️  With that out of the way, know that I
have successfully used this method without any noticeable problem.
</div>

## Requirements

You'll need a `rooted` device and working `adb` access on your machine.
`busybox` is not mandatory, but if you want to follow my exact steps you'll need
it. It also allows making a backup of the previous MAC address. So, go [get
it](https://play.google.com/store/apps/details?id=stericson.busybox&hl=it).

## Spoofing

Enable the `USB debugging` on your device, connect it to your PC and check that
everything works as expected.

```bash
» adb devices
List of devices attached
[redacted]  device
```

The WLAN MAC address is stored inside the `/persist` partition of your device.
More info about it can be found [here](http://forum.xda-developers.com/google-nexus-5/general/guide-to-fix-persist-partition-t2821576).

First, take a backup using `tar`:

```bash
» adb shell
shell@bullhead:/ $ su
root@bullhead:/ # cd /persist/
root@bullhead:/persist # ls -la
-rw-rw---- bluetooth bluetooth       17 1969-12-31 20:01 bdaddr.txt
drw-r-x--- input    system            1969-12-31 19:56 calibration
drwx------ system   system            1970-02-11 09:38 data
drwx------ root     root              1969-12-31 19:00 lost+found
-rw-r----- root     system        121 1969-12-31 19:55 sensorcal.json
drwxrwx--- drm      system            1969-12-31 20:01 widevine
-rw-rw---- wifi     system        116 2016-01-03 19:59 wlan_mac.bin
root@bullhead:/persist # tar -zcvf /sdcard/persist_backup.tar.gz .
./
./lost+found/
./data/
./data/sfs/
./data/sfs/U6Gno760ZM24B0p9bVVAfWlpN18_
./data/sfs/ONAfupniDQclyd+6sL8DWUyHKTI_
./data/sfs/Hi8Tz8W0bXUB4uoqPe3f39li2kc_
./data/tz/
./data/tz/tz_counter
./data/tz/tz_counter.bak
./data/app_g/
./widevine/
./widevine/index.txt
./calibration/
./calibration/cnt
./calibration/offset
./wlan_mac.bin
./sensorcal.json
./bdaddr.txt
root@bullhead:/persist #
```

You should now have a backup of the partition, called `persist_backup.tar.gz` in
the root of your `/sdcard`.

Now let's take a look at the `/persist/wlan_mac.bin` file:

```bash
root@bullhead:/persist # cat wlan_mac.bin
Intf0MacAddress=[redacted]
Intf1MacAddress=[redacted]
Intf2MacAddress=[redacted]
Intf3MacAddress=[redacted]
```

I have redacted the actual addresses but you can edit the file (you'll
specifically need to edit the `Intf0MacAddress` line) to your MAC address of
choice. If you are comfortable with `vi`, edit the file in place. Otherwise,
`adb pull` it, edit and then `adb push` it. Remember to fix its permissions
after the push.

After a reboot (`adb reboot`), you'll start using the address.

This way you'll have a fixed MAC address that persists over reboots. If you
prefer to randomly generate a new one, write a small script to replace it by
using something similar to the `/etc/init.d` scripts.

## Bonus: Bluetooth MAC Spoofing

The `/persist/bdaddr.txt` file contains the MAC address of your BT adapter, that
can be spoofed too.