mkst / zte-config-utility

Scripts for decoding/encoding config.bin for ZTE routers
MIT License
234 stars 77 forks source link

[FEATURE] support for ZXHN H367A #71

Open AndreMiras opened 1 year ago

AndreMiras commented 1 year ago

Description of new feature I would like the ZXHN H367A V1.0 router to be supported.

Describe alternatives you've considered I've tried:

python examples/decode.py config.bin config.xml --try-all-known-keys

And got the following output:

Detected signature: ZXHN H367A V1.0
Detected payload type 2
Trying key: MIK@0STzKpB%qJZe
Trying key: MIK@0STzKpB%qJZf
Trying key: 402c38de39bed665
Trying key: Q#Zxn*x3kVLc
Trying key: Wj
Trying key: m8@96&ZG3Nm7N&Iz
Trying key: GrWM2Hz&LTvz&f^5
Trying key: GrWM3Hz&LTvz&f^9
Trying key: Renjx%2$CjM
Trying key: tHG@Ti&GVh@ql3XN
Trying key: SDEwOE5WMi41Uk9T
Failed to decrypt type 2 payload, tried 11 key(s)!

Additional context I suspect the router admin password is also used as part of the config.bin encryption. This is because when I download the config then change the web UI password and download again, the payload changes. Info command and output:

python examples/info.py config.bin 
Signature:          ZXHN H367A V1.0
Payload Type:       2 (ZLIB+AES128ECB)
Payload Start:      87
Decompressed size:  0 bytes
2nd last chunk:     17224
Chunk size:         65536 bytes
Payload CRC:        0
Header CRC:         0

Attach config.bin for your device I'd love to, but not publicly