Archive Contents

The archive contains the following files:

• README.md - This file
• zyxel-qemu.bat - QEMU execution batch file
• qemu - QEMU configuration file
• rootfs.ext2 - Contains the router's filesystem
• zImage - Linux kernel
• vexpress-v2p-ca9.dtb - Required for ARM architecture and Linux
• genpass - Linux script for parameter management

Note: The genpass file is not meant to be used as a file but was included only for studying the Linux script.

Using the emulator requires QEMU to be installed.

---

Installing QEMU

On Windows

Download the latest version from:

• 32-bit version – Works on 64-bit Windows as well
• 64-bit version

Then install the application.

On Linux (Ubuntu/Debian)

Run the following command:

sudo apt-get install qemu-system-arm

---

Using the Zyxel Emulator

1. Download the emulator archive.
2. Extract the archive into a folder.
3. On Windows, run the batch file zyxel-qemu.bat.

---

Emulator Package Information

• /opt/zyxel – Contains libraries extracted from the firmware distributed by Zyxel.

• /opt/genpass/ – Contains the libhook.so library, which compensates for the lack of router flash memory. It allows the serial number to be read from an environment variable instead of from flash.

• getpassword – A binary that calls functions inside Zyxel's libraries to calculate the password and prints it to the screen.

• genpass – A script that ties everything together.

---

Modifying the rootfs.ext2 File

To mount and modify the rootfs.ext2 image file, you need a Linux system with ext2/ext3 utilities.

Steps

1. Create a mount point:

   sudo mkdir /mnt/rootfs
   

2. Mount the filesystem:

   sudo mount -t ext2 rootfs.ext2 /mnt/rootfs
   

   The genpass file is located at /mnt/rootfs/opt/genpass/.

3. Make your changes (e.g., copy a new genpass file).

4. Unmount the filesystem:

   sudo umount /mnt/rootfs
   

5. Remove the mount point (optional):

   sudo rm -rf /mnt/rootfs
   

---

Serial Number Format

The modem's serial number consists of:

Part	Description	Example
1	Letter S	S
2	Three digits	182
3	One uppercase letter	V
4	Eight digits	12345678

Full example: S182V12345678

---

Using the Zyxel Emulator

Once the system has booted, you will see the classic Unix/Linux console:

root@VMG8825-B50B-emul login:

Login credentials

• Username: root
• Password: root

You can also use SSH access on port 2222. QEMU (launched via the batch file) listens on port 2222 and forwards connections to port 22 of the emulated router.

Generating passwords

After logging in, run the following command from any directory:

genpass <SerialNumber>

Replace <SerialNumber> with the modem's serial number (e.g., S182V12345678).

Example output

Old algorithm supervisor password: cdef644b
New algorithm supervisor password: 7QrscaaYya

Old algorithm admin password param 1: WJNCRMTT
Old algorithm admin password param 2: K9KydTzT
Old algorithm admin password param 3: S9KcdTeT

New algorithm admin password param 1: WJNCRMTT
New algorithm admin password param 2: K9KydTzT

New algorithm admin wind password param 2: K9KydTzT73
New algorithm admin wind password param 1: WJNCRMTTQ3

Old algorithm admin wind password param 2: K9KydTzT73
Old algorithm admin wind password param 1: WJNCRMTTQ3
Old algorithm admin wind password param 3:

Wifi password param 2 e 1: MPPGPCJ444MXGU34
Wifi password param 0:     C9D4CB2BADE5618AD92BEC2AC7
Wifi password param 1:     CFC9887CA2
Wifi password param 2 e 0: SPP6WCJ444SX6U34
Wifi password param 2 e 2: 8PPXWCJ4448XXU34
Wifi password param 2 e 3: apprwcjpppaxrunp
Wifi password param 2 e 4: SPP6WCJ444SX6U34
Wifi password param 2 e 5: hPPNWCJ444hXNU34

---

Exiting the Emulator

1. After logging in, type:

   exit
   

2. When the login prompt appears again:

   VMG8825-B50B-emul login:
   

   close the DOS window.