udevadm info -p /sys/class/net/wlan0 | grep MAC | awk -F'wlx' '{print $2}' | sed 's/../&:/g' | cut -c 1-17 

In the above command, sed puts in colons every two characters, cut removes the extraneous final colon.

If putting in the extraneous colon offends your sensibilities, here is a slightly more complicated solution (using perl's lookahead feature) that doesn't put in the final colon:

udevadm info -p /sys/class/net/wlan0 | grep MAC | awk -F'wlx' '{print $2}' | perl -pe 's/(..)(?=\w)/$1:/g'

ACTION=="add", SUBSYSTEM=="net", ATTR{address}=="12:34:56:aa:bb:cc", RUN+="/sbin/ip link set dev %k address 12:34:56:dd:ee:ff"

Since eudev is capable of changing MAC addresses, maybe there's a eudev tool that shows original addresses?

My MAC spoofing shell script currently finds real MAC address of wlan0 by parsing /etc/udev/rules.d/70-persistent-net.rules, but this approach burned me recently because that udev file was empty for some strange reason. I tried dmidecode but it does not show MAC address of wlan0. I also tried dmesg, but first mention of wlan0's MAC address already shows the spoofed address. No luck with either lshw -c network or lspci -vvv. Some search engine hits suggest looking in /proc/net/bonding/, but my system does not have this directory. The only alternative I've found to my current approach is ethtool -P wlan0, but I do not want to install an extra package (ethtool) just for this job.

Please, how do I get a wireless network card's real MAC address from the hardware itself or from the kernel without installing any special tools? I know that it is possible because a long time ago I was able to do it (I think by parsing a file in /proc or /sys), but I can't remember how I did it. (Hardwiring the real MAC address as a variable in the script is not possible because I share this shell script with some other folks, so the script needs to be able to find the real MAC address by itself.)