BOOL GetPhysicMacAddrList(list<string>* xList)
{

	xList->clear();

	CString strNetCardString;
	CString strKey;
	HKEY hKey;
	ULONG iSubKey;
	LONG nResult;
    TCHAR szKeyName[MAX_PATH+1];
	ULONG nKeyNameLen;
	

	strKey = "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\NetworkCards";
	nResult = RegOpenKeyEx(HKEY_LOCAL_MACHINE, 
		strKey, 
		0, 
		KEY_READ,
		&hKey );

	if (nResult != ERROR_SUCCESS)
	{
		return FALSE;
	}

	BOOL bFinish = FALSE;
    iSubKey = 0;
	while (!bFinish)
	{
		nKeyNameLen = sizeof(szKeyName)/sizeof(*szKeyName);
		nResult = RegEnumKeyEx(
			hKey,
			iSubKey,
			szKeyName,
			&nKeyNameLen,
			NULL,
			NULL,
			NULL,
			NULL);


		if((nResult != ERROR_SUCCESS) && (nResult != ERROR_NO_MORE_ITEMS))
		{
			break;
		}

		if (nResult == ERROR_NO_MORE_ITEMS)
			bFinish = TRUE;


		CString strKey2 = strKey;
		HKEY hKey2;
		strKey2 += "\\";
		strKey2 += CString(szKeyName);

		nResult = RegOpenKeyEx(
			HKEY_LOCAL_MACHINE, 
			strKey2, 
			0, 
			KEY_READ,
			&hKey2 );

		if (nResult != ERROR_SUCCESS)
		{
			iSubKey++;
			continue;
		}

		DWORD dwType = REG_SZ;
		TCHAR szValue[MAX_PATH+1];

		ULONG nLeng = sizeof(szValue)/sizeof(*szValue);

		nLeng = sizeof(szValue)/sizeof(*szValue);
		nResult = RegQueryValueEx(hKey2,
			_T("ServiceName"),
			NULL,
			&dwType,
			(LPBYTE)szValue,
			&nLeng);

		if (nResult != ERROR_SUCCESS)
		{
			RegCloseKey(hKey2);
			iSubKey++;
			continue;
		}

		RegCloseKey(hKey2);

		CString strDirverName;
		strDirverName.Format("\\\\.\\%s",szValue);

		HANDLE hDriver = CreateFile(strDirverName,GENERIC_READ,  
                                                  0,  
                                                  NULL,  
                                                  OPEN_EXISTING,  
                                                  0,  
                                                  NULL);  
		if (hDriver == INVALID_HANDLE_VALUE)  
		{  
			iSubKey++;
			continue;
		} 

		UCHAR ucData[8] = {0};
		ULONG oid = OID_802_3_PERMANENT_ADDRESS;
		DWORD ByteRet;


		if(DeviceIoControl(hDriver,IOCTL_NDIS_QUERY_GLOBAL_STATS,    
				 &oid,
				 4,  
				 ucData,
				 sizeof(ucData),  
				 &ByteRet,  
				 NULL))
		 {
			
			char szTemp[MAX_BUFFER];
			RtlZeroMemory(szTemp,sizeof(szTemp));
			int nResult = _snprintf(szTemp,sizeof(szTemp),"%02X-%02X-%02X-%02X-%02X-%02X-%02X-%02X",ucData[0],ucData[1],ucData[2],ucData[3],
				ucData[4],ucData[5],ucData[6],ucData[7]);

			if (nResult > 0 && nResult < sizeof(szTemp))
			{
				xList->push_back(szTemp);
			}
		}
		 CloseHandle(hDriver);
		 iSubKey++;
	}
	RegCloseKey(hKey);

	return TRUE;
}

[课程]Linux pwn 探索篇！