Capturing WiFi robe requests and derandomizing MAC address

We would to develop a software in C/C++ for Linux/OpenWrt to capture probe requests received from WiFi for marketing purposes. Capturing "probe request" is simple by setting the WiFi interface in "monitor mode" and capture traffic via tcpdump. However, randomization of MAC addresses made by many Apple and Android operating systems, causes various problems and we would like to find a system that can de-randomize it. Reading this document ([login to view URL]), we found out that someone managed to do it and writes: "The novelty in our method is that we are sending RTS frames to IEEE 802.11 client devices, not APs, to ex15 tract a CTS response message which we derive the true global MAC address of that device. Instead of a localization attack, we are using RTS/CTS exchanges to perform derandomization attacks". In essence we would get a CSV file with the following data of the device present in the area: date and time in microseconds of probe request reception, MAC addresses received from the probe request, RSSI (received signal), frame sequence number, WiFi frequency, any SSID, date and time in microseconds of RTS sending, date and time in microseconds of CTS reception, MAC Address received from CTS (eventually derandomized).