173 lines
4.3 KiB
Markdown
173 lines
4.3 KiB
Markdown
# Archive Contents
|
||
|
||
The archive contains the following files:
|
||
|
||
- `README.md` - This file
|
||
- `zyxel-qemu.bat` - QEMU execution batch file
|
||
- `qemu` - QEMU configuration file
|
||
- `rootfs.ext2` - Contains the router's filesystem
|
||
- `zImage` - Linux kernel
|
||
- `vexpress-v2p-ca9.dtb` - Required for ARM architecture and Linux
|
||
- `genpass` - Linux script for parameter management
|
||
|
||
> **Note:** The `genpass` file is not meant to be used as a file but was included only for studying the Linux script.
|
||
|
||
Using the emulator requires QEMU to be installed.
|
||
|
||
---
|
||
|
||
# Installing QEMU
|
||
|
||
## On Windows
|
||
|
||
Download the latest version from:
|
||
|
||
- [32-bit version](https://qemu.weilnetz.de/w32/) – Works on 64-bit Windows as well
|
||
- [64-bit version](https://qemu.weilnetz.de/w64/)
|
||
|
||
Then install the application.
|
||
|
||
## On Linux (Ubuntu/Debian)
|
||
|
||
Run the following command:
|
||
|
||
```bash
|
||
sudo apt-get install qemu-system-arm
|
||
```
|
||
|
||
---
|
||
|
||
# Using the Zyxel Emulator
|
||
|
||
1. Download the emulator archive.
|
||
2. Extract the archive into a folder.
|
||
3. On Windows, run the batch file `zyxel-qemu.bat`.
|
||
|
||
---
|
||
|
||
# Emulator Package Information
|
||
|
||
- **`/opt/zyxel`** – Contains libraries extracted from the firmware distributed by Zyxel.
|
||
- **`/opt/genpass/`** – Contains the `libhook.so` library, which compensates for the lack of router flash memory. It allows the serial number to be read from an environment variable instead of from flash.
|
||
|
||
- **`getpassword`** – A binary that calls functions inside Zyxel's libraries to calculate the password and prints it to the screen.
|
||
- **`genpass`** – A script that ties everything together.
|
||
|
||
---
|
||
|
||
# Modifying the `rootfs.ext2` File
|
||
|
||
To mount and modify the `rootfs.ext2` image file, you need a Linux system with ext2/ext3 utilities.
|
||
|
||
## Steps
|
||
|
||
1. **Create a mount point:**
|
||
```bash
|
||
sudo mkdir /mnt/rootfs
|
||
```
|
||
|
||
2. **Mount the filesystem:**
|
||
```bash
|
||
sudo mount -t ext2 rootfs.ext2 /mnt/rootfs
|
||
```
|
||
The `genpass` file is located at `/mnt/rootfs/opt/genpass/`.
|
||
|
||
3. **Make your changes** (e.g., copy a new `genpass` file).
|
||
|
||
4. **Unmount the filesystem:**
|
||
```bash
|
||
sudo umount /mnt/rootfs
|
||
```
|
||
|
||
5. **Remove the mount point (optional):**
|
||
```bash
|
||
sudo rm -rf /mnt/rootfs
|
||
```
|
||
|
||
---
|
||
|
||
# Serial Number Format
|
||
|
||
The modem's serial number consists of:
|
||
|
||
| Part | Description | Example |
|
||
|------|------------------------------------|---------|
|
||
| 1 | Letter `S` | `S` |
|
||
| 2 | Three digits | `182` |
|
||
| 3 | One uppercase letter | `V` |
|
||
| 4 | Eight digits | `12345678` |
|
||
|
||
**Full example:** `S182V12345678`
|
||
|
||
---
|
||
|
||
# Using the Zyxel Emulator
|
||
|
||
Once the system has booted, you will see the classic Unix/Linux console:
|
||
|
||
```
|
||
root@VMG8825-B50B-emul login:
|
||
```
|
||
|
||
## Login credentials
|
||
|
||
- **Username:** `root`
|
||
- **Password:** `root`
|
||
|
||
> You can also use SSH access on port `2222`. QEMU (launched via the batch file) listens on port 2222 and forwards connections to port 22 of the emulated router.
|
||
|
||
## Generating passwords
|
||
|
||
After logging in, run the following command from any directory:
|
||
|
||
```bash
|
||
genpass <SerialNumber>
|
||
```
|
||
|
||
Replace `<SerialNumber>` with the modem's serial number (e.g., `S182V12345678`).
|
||
|
||
### Example output
|
||
|
||
```
|
||
Old algorithm supervisor password: cdef644b
|
||
New algorithm supervisor password: 7QrscaaYya
|
||
|
||
Old algorithm admin password param 1: WJNCRMTT
|
||
Old algorithm admin password param 2: K9KydTzT
|
||
Old algorithm admin password param 3: S9KcdTeT
|
||
|
||
New algorithm admin password param 1: WJNCRMTT
|
||
New algorithm admin password param 2: K9KydTzT
|
||
|
||
New algorithm admin wind password param 2: K9KydTzT73
|
||
New algorithm admin wind password param 1: WJNCRMTTQ3
|
||
|
||
Old algorithm admin wind password param 2: K9KydTzT73
|
||
Old algorithm admin wind password param 1: WJNCRMTTQ3
|
||
Old algorithm admin wind password param 3:
|
||
|
||
Wifi password param 2 e 1: MPPGPCJ444MXGU34
|
||
Wifi password param 0: C9D4CB2BADE5618AD92BEC2AC7
|
||
Wifi password param 1: CFC9887CA2
|
||
Wifi password param 2 e 0: SPP6WCJ444SX6U34
|
||
Wifi password param 2 e 2: 8PPXWCJ4448XXU34
|
||
Wifi password param 2 e 3: apprwcjpppaxrunp
|
||
Wifi password param 2 e 4: SPP6WCJ444SX6U34
|
||
Wifi password param 2 e 5: hPPNWCJ444hXNU34
|
||
```
|
||
|
||
---
|
||
|
||
# Exiting the Emulator
|
||
|
||
1. After logging in, type:
|
||
```bash
|
||
exit
|
||
```
|
||
|
||
2. When the login prompt appears again:
|
||
```
|
||
VMG8825-B50B-emul login:
|
||
```
|
||
close the DOS window.
|