search

mkst / zte-config-utility

Scripts for decoding/encoding config.bin for ZTE routers
MIT License
234 stars 77 forks source link

[FEATURE] Support for ZTE H388X (and maybe H388XF), used by Italian ISP TIM (Telecom Italia) #91

Open Ghibbi64 opened 5 months ago

Ghibbi64 commented 5 months ago

Hi, i was thinking that it may be a good idea to try adding support for the H388X and the H833XF as they are one of the most used modem/router given by Telecom Italia (apart from the Technicolor variant). I analyzed the config.bin file and it gives me this info:

Signature:          H388X
Payload Type:       4 (ZLIB+AES256CBCDIFFIV)
Payload Start:      77
Decompressed size:  0 bytes
2nd last chunk:     0
Chunk size:         0 bytes
Payload CRC:        0
Header CRC:         0

I also tried to decrypt it using all the known keys, but without results:

Detected signature: H388X
Detected payload type 4
Trying key: 'H388XKey02721401' iv: 'H388XIv02721401' generated from signature: 'H388X'
Trying key: 'H388XKey02710010' iv: 'H388XIv02710010' generated from signature: 'H388X'
Trying key: 'H388XKey02710001' iv: 'H388XIv02710001' generated from signature: 'H388X'
Trying key: 'H388XKey02660004' iv: 'H388XIv02660004' generated from signature: 'H388X'
Trying key: 'H388X8cc72b05705d5c46f412af8cbed55aa' iv: 'H388X667b02a85c61c786def4521b060265e' generated from signature: 'H388X'

Has someone ever managed to decrypt this type of config files? Thanks