[FEATURE] ZTE ZXHN F6600R

D3vl0per commented 9 months ago

Description of new feature I would like to ask for your help with this equipment. Unfortunately there is very little information about it on the web. I have a device of a local internet service provider and have made a config backup of it, but I have not yet encountered that type 06 mode. Is there possibly a non destructive ( no UART and no other hw magic) way to retrieve the ISP firmware or not? Maybe someone has firmware for it, so I can start from the CSPD to see what keys it can use.

Additional context f6600r

modem

Attach config.bin for your device I can share it privately.

flashworldnet commented 8 months ago

Send me zhanshi.avi@gmail.com

I'll give it a try

D3vl0per commented 8 months ago

Send me zhanshi.avi@gmail.com

I'll give it a try

Hi! It's already done, but thanks. The CSPD is very similar to F660. Same SERIAL+MAC and IV pair btw.

flashworldnet commented 8 months ago

Send me zhanshi.avi@gmail.com I'll give it a try

Hi! It's already done, but thanks. The CSPD is very similar to F660. Same SERIAL+MAC and IV pair btw.

Nice. I thought it could work.

tbaumann commented 4 months ago

› ./venv/bin/python3 examples/decode.py --serial ZTEGD1EF4583 --mac  84-93-B2-51-BD-4E ~/Downloads/config.bin config.out
Traceback (most recent call last):
  File "/home/tilli/git/zte-config-utility/examples/decode.py", line 194, in <module>
    main()
  File "/home/tilli/git/zte-config-utility/examples/decode.py", line 45, in main
    zcu.zte.read_header(infile)
  File "/home/tilli/git/zte-config-utility/venv/lib/python3.11/site-packages/zcu/zte.py", line 17, in read_header
    assert header[2] == 4
           ^^^^^^^^^^^^^^
AssertionError

I might be passing the arguments wrongly. But I think it fails before that.

The router has a somewhat spotted history. It's possible the SN is wrong. The web interface reports 8493B2-ZTEGD1EF4583 but the sticker on the device says GPON SN ZTEGD1E2B9F1 D-SN ZTE0QL4N901958

mkst commented 1 month ago

Can you try this again with the latest version of the repo? and/or can you upload your config.bin?

ruimarinho commented 1 month ago

@mkst this is what I get with the latest version:

python3 examples/decode.py --serial ZTExxxxxxxxxxxx --mac xx-xx-xx-xx-xx-xx config.bin config.xml
WARNING: Incorrect endianess specified!
Detected signature: F6640
Detected payload type 6
No support for payload type 6!

Not exactly F6600, but probably very close to it. Previously, the tool would crash immediately. Thanks for your efforts!

mkst commented 1 month ago

Can you try the same parameters, but use the auto.py script instead of decode.py? I'm guessing you don't have telnet access, or a way to provide the cspd binary?

h33im commented 1 month ago

same problem

WARNING: Incorrect endianess specified! Detected signature: F6600P Detected payload type 6 No support for payload type 6!

example/auto.py help, but

WARNING: Incorrect endianess specified! Successfully decrypted and decompressed config.bin.original using (key, iv):

I can't encode the config file after editing

can send config.bin if you want

h33im commented 1 month ago

I was able to access via telnet with root rights, but I still can't decrypt anything

sendcmd 1 DB decry /userconfig/cfg/db_user_cfg.xml - not work

h33im commented 1 month ago

also example/auto.py helped, but as it turned out, it did not decipher all parts of the config, some are missing

D3vl0per commented 3 weeks ago

I forgot to mention I have all the default credentials for that device… Should I share it?

h33im commented 1 week ago

I forgot to mention I have all the default credentials for that device… Should I share it?

Oh, I was more interested in decoding the settings in order to set up the ONU Stick and abandon the router. I have admin access to this device, but it doesn’t allow me to see the PON passwords

mkst / zte-config-utility

[FEATURE] ZTE ZXHN F6600R #87