View Single Post
Don't know if the algorithm is cracked yet, but it doesn't matter. Turns out ZyXEL delivers the necessary code with the routers :-) And some smart guy figured out how to call into those libraries using any serial number of your choice.

I packaged the bare minimum for running the tool here: https://get.dyn.mork.no/zyxel_pwgen.tar.gz

Note that this was intended for the NR7101 which uses one of the other algorithms, so the included getsupervisor.sh script won't work without modifications. But you can easily adapt it for the VMG8825. Just pick the "New algorithm supervisor password" instead of the "Old algorithm supervisor password" used by the NR7101. The password is valid for the "root" console user as well as the "supervisor" GUI user.

Simple recipe:

Kode

wget https://get.dyn.mork.no/zyxel_pwgen.tar.gz
tar zxvf zyxel_pwgen.tar.gz
cd zyxel_pwgen
qemu-arm-static -E SERIAL=S192V26012345 -E LD_PRELOAD=./libhook.so ./getpassword|grep 'New algorithm supervisor'
where "S192V26012345" is your VMG8825 serial number. The only prerequisite is qemu-arm-static which should be readily available in your favourite Linux distro. See the getsupervisor.sh script for installation hints.