# Archive Contents

The archive contains the following files:

- `README.md`            - This file
- `zyxel-qemu.bat`       - QEMU execution batch file
- `qemu`                 - QEMU configuration file
- `rootfs.ext2`          - Contains the router's filesystem
- `zImage`               - Linux kernel
- `vexpress-v2p-ca9.dtb` - Required for ARM architecture and Linux
- `genpass`              - Linux script for parameter management

> **Note:** The `genpass` file is not meant to be used as a file but was included only for studying the Linux script.

Using the emulator requires QEMU to be installed.

---

# Installing QEMU

## On Windows

Download the latest version from:

- [32-bit version](https://qemu.weilnetz.de/w32/) – Works on 64-bit Windows as well
- [64-bit version](https://qemu.weilnetz.de/w64/)

Then install the application.

## On Linux (Ubuntu/Debian)

Run the following command:

```bash
sudo apt-get install qemu-system-arm
```

---

# Using the Zyxel Emulator

1. Download the emulator archive.
2. Extract the archive into a folder.
3. On Windows, run the batch file `zyxel-qemu.bat`.

---

# Emulator Package Information

- **`/opt/zyxel`** – Contains libraries extracted from the firmware distributed by Zyxel.
- **`/opt/genpass/`** – Contains the `libhook.so` library, which compensates for the lack of router flash memory. It allows the serial number to be read from an environment variable instead of from flash.

- **`getpassword`** – A binary that calls functions inside Zyxel's libraries to calculate the password and prints it to the screen.
- **`genpass`** – A script that ties everything together.

---

# Modifying the `rootfs.ext2` File

To mount and modify the `rootfs.ext2` image file, you need a Linux system with ext2/ext3 utilities.

## Steps

1. **Create a mount point:**
   ```bash
   sudo mkdir /mnt/rootfs
   ```

2. **Mount the filesystem:**
   ```bash
   sudo mount -t ext2 rootfs.ext2 /mnt/rootfs
   ```
   The `genpass` file is located at `/mnt/rootfs/opt/genpass/`.

3. **Make your changes** (e.g., copy a new `genpass` file).

4. **Unmount the filesystem:**
   ```bash
   sudo umount /mnt/rootfs
   ```

5. **Remove the mount point (optional):**
   ```bash
   sudo rm -rf /mnt/rootfs
   ```

---

# Serial Number Format

The modem's serial number consists of:

| Part | Description                        | Example |
|------|------------------------------------|---------|
| 1    | Letter `S`                         | `S`     |
| 2    | Three digits                       | `182`   |
| 3    | One uppercase letter               | `V`     |
| 4    | Eight digits                       | `12345678` |

**Full example:** `S182V12345678`

---

# Using the Zyxel Emulator

Once the system has booted, you will see the classic Unix/Linux console:

```
root@VMG8825-B50B-emul login:
```

## Login credentials

- **Username:** `root`
- **Password:** `root`

> You can also use SSH access on port `2222`. QEMU (launched via the batch file) listens on port 2222 and forwards connections to port 22 of the emulated router.

## Generating passwords

After logging in, run the following command from any directory:

```bash
genpass <SerialNumber>
```

Replace `<SerialNumber>` with the modem's serial number (e.g., `S182V12345678`).

### Example output

```
Old algorithm supervisor password: cdef644b
New algorithm supervisor password: 7QrscaaYya

Old algorithm admin password param 1: WJNCRMTT
Old algorithm admin password param 2: K9KydTzT
Old algorithm admin password param 3: S9KcdTeT

New algorithm admin password param 1: WJNCRMTT
New algorithm admin password param 2: K9KydTzT

New algorithm admin wind password param 2: K9KydTzT73
New algorithm admin wind password param 1: WJNCRMTTQ3

Old algorithm admin wind password param 2: K9KydTzT73
Old algorithm admin wind password param 1: WJNCRMTTQ3
Old algorithm admin wind password param 3:

Wifi password param 2 e 1: MPPGPCJ444MXGU34
Wifi password param 0:     C9D4CB2BADE5618AD92BEC2AC7
Wifi password param 1:     CFC9887CA2
Wifi password param 2 e 0: SPP6WCJ444SX6U34
Wifi password param 2 e 2: 8PPXWCJ4448XXU34
Wifi password param 2 e 3: apprwcjpppaxrunp
Wifi password param 2 e 4: SPP6WCJ444SX6U34
Wifi password param 2 e 5: hPPNWCJ444hXNU34
```

---

# Exiting the Emulator

1. After logging in, type:
   ```bash
   exit
   ```

2. When the login prompt appears again:
   ```
   VMG8825-B50B-emul login:
   ```
   close the DOS window.