commit a4f0a1a9dedefbd5795203613590757393c2531d Author: Erick Ahmed Date: Sat Apr 18 10:15:33 2026 +0200 Initial dump diff --git a/README.md b/README.md new file mode 100644 index 0000000..229fe0c --- /dev/null +++ b/README.md @@ -0,0 +1,171 @@ +#################################################################################### Contenuto archivio + +Nell'archivio troverete i seguenti file + + Leggimi.txt - Questo file + + zyxel-qemu.bat - batch esecuzione QEMU + qemu - file configurazione QEMU + rootfs.ext2 - contiene il filesystem del router + zImage - kernel di Linux + vexpress-v2p-ca9.dtb - serve nell'architettura ARM e Linux. + + genpass - script Linux per la gestione dei parametri + +Nota: il file 'genpass' non serve come file ma è stato inserito solo come studio dello script Linux + +L'uso dell'emulatore richiede obbligatoriamente l'installazione di QEMU. + + +#################################################################################### Installazione QEMU in Windows + +Scaricate la versione più recente dal sito + +https://qemu.weilnetz.de/w32/ - Applicazione per Windows a 32bit (funziona anche su Windows a 64bit) +https://qemu.weilnetz.de/w64/ - Applicazione per Windows a 64bit + +Installate l'applicazione. + + +- Installazione QEMU in Linux (Ubuntu/Debian) + +sudo apt-get install qemu-system-arm + + +#################################################################################### Uso emulatore Zyxel + +Scaricate l'archivio dell'emulatore. + +Decomprimete l'archivio in una cartella. + +In Windows lanciate il batch 'zyxel-qemu.bat' + + +#################################################################################### Info pacchetto emulatore + +Nelle cartelle + + /opt/zyxel + +ci sono le librerie estratte dal firmware distribuito dalla Zyxel + + /opt/genpass/ + +c'è la libreria libhook.so che serve per sopperire alla mancanza della flash del router in modo che il seriale invece che leggerlo sulla flash lo legge da una variabile d'ambiente + +Il file + + getpassword + +è il binario che chiama le funzioni dentro le librerie della Zyxel per fargli calcolare la password ed una volta prese le stampa a schermo. +Mentre lo script + + genpass + +è quello che mette insieme il tutto. + + +#################################################################################### Modifiche al file rootfs.ext + +Per montare il file immagine rootfs.exet2 in modifica serve un Linux e le utility relative alla gestione ext2/ext3. + +I comandi da dare sono + +- Creazione cartella espansione file contenuti in rootfs.ext + + sudo mkdir /mnt/rootfs + +- Montaggio file system rootfs.ext + + sudo mount -t ext2 root.ext2 /mnt/rootfs + +il file 'genpass' è nel percorso '/mnt/rootfs/opt/genpass/' + +Si fanno le modifiche del caso es. copia nuovo file genpass) + +Finite le modifiche si salva il nuovo file rootfs.ext dando il comando + + sudo umount /mnt/rootfs + +e si possono rimuovere i file in /mnt/rootfs + + sudo rm -rf /mnt/rootfs + + +#################################################################################### Info sul numero seriale + +Il seriale del modem è composto + + da una prima lettera S + + da un seconda parte costituita da tre cifre + + da una terza parte rappresentata da una lettera maiuscola + + da una quarta parte numerica di 8 cifre + + +#################################################################################### Uso emulatore Zyxel + +Una volta che il sistema è avviato vi troverete davanti la classica console Unix/Linux. + +root@VMG8825-B50B-emul login: + +Potete entrare inserendo + + user = root + password = root + +Volendo potete usare anche l'accesso via SSH sulla porta 2222. +In pratica qemu-system-arm (lanciato tramite il batch) si mette in ascolto sulla porta 2222 e ridirige la connessione sulla porta 22 del router emulato. + +Una volta avuto accesso senza dover cambiare cartella basta dare il comando + + genpass SerialeModem + +dove + + SerialeModem è il seriale del modem (es. S182V12345678) + + +La risposta al comando genpass sarà del tipo + + Old algorithm supervisor password: cdef644b + New algorithm supervisor password: 7QrscaaYya + + Old algorithm admin password param 1: WJNCRMTT + Old algorithm admin password param 2: K9KydTzT + Old algorithm admin password param 3: S9KcdTeT + + New algorithm admin password param 1: WJNCRMTT + New algorithm admin password param 2: K9KydTzT + + New algorithm admin wind password param 2: K9KydTzT73 + New algorithm admin wind password param 1: WJNCRMTTQ3 + + Old algorithm admin wind password param 2: K9KydTzT73 + Old algorithm admin wind password param 1: WJNCRMTTQ3 + Old algorithm admin wind password param 3: + + Wifi password param 2 e 1: MPPGPCJ444MXGU34 + Wifi password param 0: C9D4CB2BADE5618AD92BEC2AC7 + Wifi password param 1: CFC9887CA2 + Wifi password param 2 e 0: SPP6WCJ444SX6U34 + Wifi password param 2 e 2: 8PPXWCJ4448XXU34 + Wifi password param 2 e 3: apprwcjpppaxrunp + Wifi password param 2 e 4: SPP6WCJ444SX6U34 + Wifi password param 2 e 5: hPPNWCJ444hXNU34 + + +#################################################################################### Uscita dall'emulazione + +Una volta effettuato il login per uscire digitare + +root@VMG8825-B50B-emul:~# exit + +quando appare + +VMG8825-B50B-emul login: + +chiudere la finestra DOS aperta + diff --git a/genpass b/genpass new file mode 100644 index 0000000..87861a3 --- /dev/null +++ b/genpass @@ -0,0 +1,121 @@ +#!/bin/sh + +scriptcommand=genpass +runcommand=getpassword + +batchdate="26.10.2021" + +programtitle1="**** Zyxel VMG8823/8825" +programtitle2="**** Calculate admin/supervisor/wifi password by serial number" +programtitle3="**** Script by maximux/bovirus v. $batchdate" + +# mask for check first part of serial nuimber +serialstartok1="172" +serialstartok2="182" +serialstartok3="190" +serialstartok4="192" + +# mask for check midlle part of serial nuimber +serialmiddleok1="H" +serialmiddleok2="S" +serialmiddleok3="V" +serialmiddleok4="Y" + +# default value for the operation +debug=0 +exec=1 +error=0 + +echo "" +echo "$programtitle1" +echo "$programtitle2" +echo "$programtitle3" +echo "" + +if [ $# -eq 0 ]; then + error=1 # no modem serial number provided +else + + export SERIAL=$1 + SERIAL=$(echo "$SERIAL" | tr '[:lower:]' '[:upper:]') + seriallenght=${#SERIAL} + serialsubstring1=$(echo $SERIAL | cut -c1-1) # extract first part of modem serial + serialsubstring2=$(echo $SERIAL | cut -c2-4) # extract secndo part of modem serial + serialsubstring3=$(echo $SERIAL | cut -c5-5) # extract third part of modem serial + serialsubstring4=$(echo $SERIAL | cut -c6-13) # extract fourth part of modem serial + + #----------------------------------------------- check serial lenght of 13 charcaters + if [ $seriallenght -ne 13 ]; then + if [ $error -eq 0 ]; then + error=2 + fi + fi + + #----------------------------------------------- check that first character is S + if [ "$serialsubstring1" != "S" ]; then + if [ $error -eq 0 ]; then + error=3 + fi + fi + + #----------------------------------------------- check che 2nd part is all numeric + if ! [ "$(echo $serialsubstring2 | grep -E "^[0-9]{1,}$")" ]; then + if [ $error -eq 0 ]; then + error=4 + fi + fi + + #----------------------------------------------- check che 3rd part is a letter + + if ! [ "$(echo $serialsubstring3 | grep -E "^[A-Z]{1,}$")" ]; then + if [ $error -eq 0 ]; then + error=5 + fi + fi + + #----------------------------------------------- check that 4th part is all numeric + if ! [ "$(echo $serialsubstring4 | grep -E "^[0-9]{1,}$")" ]; then + if [ $error -eq 0 ]; then + error=6 + fi + fi +fi + +if [ $error -ne 0 ]; then + if [ $error -ne 1 ]; then + echo "-----------------------------------------" + echo " Modem serial number = "$SERIAL + echo "-----------------------------------------" + echo "" + fi + echo "error = $error" + echo "" + echo "error 1 = no serial number provided" + echo "error 2 = serial number lenght is not 13 characters" + echo "error 3 = character n. 1 of serial number is not 'S'" + echo "error 4 = characters n. 2-3-4 of serial number are not numbers" + echo "error 5 = character n. 5 of serial number is not a letter" + echo "error 6 = characters from 6 to 13 of serial number are not numbers" + echo "" + echo "-----------------------------------------" + echo "" + echo "command syntax:" + echo "" + echo " genpass ModemSerialNumber" + echo "" + echo "ModemSerialNumber is a 13 character string" + echo "" + echo "Example: genpass S123V12345678" +else + echo "-----------------------------------------" + echo " Modem serial number = "$SERIAL + echo "-----------------------------------------" + if [ $exec -eq 1 ]; then + export LD_LIBRARY_PATH=/opt/zyxel/lib:/opt/zyxel/lib/private:/opt/zyxel/lib/public:/opt/zyxel/usr/lib + export LD_PRELOAD=/opt/genpass/libhook.so + /opt/genpass/$runcommand + fi +fi +echo "" +echo "" + diff --git a/qemu b/qemu new file mode 100644 index 0000000..0640f6d --- /dev/null +++ b/qemu @@ -0,0 +1,14 @@ +#!/bin/bash +MYDIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )" +cd $MYDIR +export QEMU_AUDIO_DRV="none" +qemu-system-arm -M vexpress-a9 \ + -cpu cortex-a9 \ + -m 512 \ + -nographic \ + -kernel $MYDIR/zImage \ + -drive file=$MYDIR/rootfs.ext2,index=0,media=disk,format=raw,if=sd \ + -dtb $MYDIR/vexpress-v2p-ca9.dtb \ + -net nic \ + -net user,hostfwd=tcp::2222-:22 \ + -append "rw console=ttyAMA0 console=tty root=/dev/mmcblk0" diff --git a/rootfs.ext2 b/rootfs.ext2 new file mode 100644 index 0000000..cac4059 Binary files /dev/null and b/rootfs.ext2 differ diff --git a/start-emu.sh b/start-emu.sh new file mode 100755 index 0000000..51b2a9d --- /dev/null +++ b/start-emu.sh @@ -0,0 +1,3 @@ +#!/bin/bash +qemu-system-arm -M vexpress-a9 -cpu cortex-a9 -m 512 -nographic -kernel zImage -drive file=rootfs.ext2,index=0,media=disk,format=raw,if=sd -dtb vexpress-v2p-ca9.dtb -net nic -net user,hostfwd=tcp::2222-:22 -append "rw console=ttyAMA0 console=tty root=/dev/mmcblk0" + diff --git a/vexpress-v2p-ca9.dtb b/vexpress-v2p-ca9.dtb new file mode 100644 index 0000000..f5e80cf Binary files /dev/null and b/vexpress-v2p-ca9.dtb differ diff --git a/zImage b/zImage new file mode 100644 index 0000000..0e9959c Binary files /dev/null and b/zImage differ diff --git a/zyxel-qemu.bat b/zyxel-qemu.bat new file mode 100644 index 0000000..1a44208 --- /dev/null +++ b/zyxel-qemu.bat @@ -0,0 +1,55 @@ +@ECHO OFF +SET QEMU-OPTIONS=-M vexpress-a9 -cpu cortex-a9 -m 512 -nographic -kernel zImage -drive file=rootfs.ext2,index=0,media=disk,format=raw,if=sd -dtb vexpress-v2p-ca9.dtb -net nic -net user,hostfwd=tcp::2222-:22 -append "rw console=ttyAMA0 console=tty root=/dev/mmcblk0" +SET EMULATOR-VERSION=07.09.2020 +IF EXIST "C:\Program Files\qemu\qemu-system-arm.exe" ( + SET QEMU-EXE=C:\Program Files\qemu\qemu-system-arm.exe + SET QEMU-PLATFORM=64bit + goto start +) + +IF EXIST "C:\Program Files (x86)\qemu\qemu-system-arm.exe" ( + SET QEMU-EXE=C:\Program Files (x86)\qemu\qemu-system-arm.exe + SET QEMU-PLATFORM=32bit + goto start +) +goto no.QEMU + +:start +CLS +ECHO ************************************************* +ECHO * * +ECHO * Zyxel software emulator based on QEMU * +ECHO * * +ECHO * by maximuz and bovirus - version : %EMULATOR-VERSION% * +ECHO * * +ECHO ************************************************* +ECHO. + +if not exist "%QEMU-EXE%" goto no.QEMU + +ECHO *** QEMU exe file = %QEMU-EXE% +ECHO *** QEMU platform = %QEMU-PLATFORM% +ECHO *** QEMU run options = %QEMU-OPTIONS% +ECHO. + +"%QEMU-EXE%" %QEMU-OPTIONS% + +goto end + +:no.QEMU +ECHO File '%QEMU-EXE%' not available. +ECHO. +ECHO Please check that QEMU %QEMU-PLATFORM% is installed. +ECHO. + +:end +ECHO. +ECHO #### Presss any key to continue #### +PAUSE >NUL + +ECHO. +ECHO. +SET QEMU-EXE= +SET QEMU-PLATFORM= +SET QEMU-OPTIONS= +SET EMULATOR-VERSION=