[FEATURE] ZXHN F601C decoding support

[CATSOFTNET]

I would like the ZTE F601C v9.0 router to be supported!
I have tried using auto.py on any cfg.bin file but I get Unable to find valid key for payload. Says its Payload Type 5
I have the file extracted from a NAND dump from this ONT. Happy to provide any files to help with this issue. Thanks!

SN: ZTEGD82C29DA
MAC: 14CA5639FE60

db_default_cfg.xml

[CarlosAPSouza]

I would like the ZTE F601C v9.0 router to be supported! I have tried using auto.py on any cfg.bin file but I get Unable to find valid key for payload. Says its Payload Type 5 I have the file extracted from a NAND dump from this ONT. Happy to provide any files to help with this issue. Thanks!

SN: ZTEGD82C29DA MAC: 14CA5639FE60

db_default_cfg.xml

Send the firmware dump for analysis in order to try and discover the key and IV.

[CATSOFTNET]

OK, sure, here is it. I just changed the extension from 7z to zip to upload it. This ONT is from ISP Digi Romania.

dump.7z.zip

[CarlosAPSouza]

I would like the ZTE F601C v9.0 router to be supported! I have tried using auto.py on any cfg.bin file but I get Unable to find valid key for payload. Says its Payload Type 5 I have the file extracted from a NAND dump from this ONT. Happy to provide any files to help with this issue. Thanks!

SN: ZTEGD82C29DA MAC: 14CA5639FE60

db_default_cfg.xml

db_default_cfg_dec.xml

The file you sent is not a backup of the equipment. The backup is located in the /userconfig directory.

[CarlosAPSouza]

Do you have a dump of the zxhn h1601 router?

[CATSOFTNET]

The file you sent is not a backup of the equipment. The backup is located in the /userconfig directory.

Yes, I just sent one of the cfg files that I couldn't decrypt. I think I was interested in db_default_Romania_cfg.xml.

Do you have a dump of the zxhn h1601 router?

Sorry, no, the only other ZTE I have is an F618 with firmware from 2020 and that one is decryptable. But I will keep my eye on more ZTE ONT's. Do you know of an easy way to change the SN or enable Telnet from the Web interface?

[CATSOFTNET]

Perhaps this firmware will be of some help.

Zxhnh1600_hv70_fv700p4_etl_firmware.zip

[CarlosAPSouza]

The file you sent is not a backup of the equipment. The backup is located in the /userconfig directory.

Yes, I just sent one of the cfg files that I couldn't decrypt. I think I was interested in db_default_Romania_cfg.xml.

Do you have a dump of the zxhn h1601 router?

Sorry, no, the only other ZTE I have is an F618 with firmware from 2020 and that one is decryptable. But I will keep my eye on more ZTE ONT's. Do you know of an easy way to change the SN or enable Telnet from the Web interface?

Okay, the db_default_Romania_cfg.xml file has been decrypted.

db_default_Romania_cfg_dec.xml

[CATSOFTNET]

OK, thank You!

[CATSOFTNET]

I have another dump from ZTE H3601, the db_user_cfg.xml cant be decrypted. Says it's Payload type 4. Dump and info in the archive. Maybe of some help.

H3601.zip

[CarlosAPSouza]

I have another dump from ZTE H3601, the db_user_cfg.xml cant be decrypted. Says it's Payload type 4. Dump and info in the archive. Maybe of some help.

H3601.zip

Do you have the backup file?

[CATSOFTNET]

Sure, is just extracted from the nand dump.

db_backup_cfg.xml

[CarlosAPSouza]

Sure, is just extracted from the nand dump.

db_backup_cfg.xml

Did you retrieve this file using Telnet?
It fails to extract zlib.

[CATSOFTNET]

No, extracted from the NAND with binwalk, just like the other one.

[CarlosAPSouza]

No, extracted from the NAND with binwalk, just like the other one.

If you have access to the serial connection, use TeraTerm to dump the partition that stores the backup data (mtd4).
Use the commands below:
nand read 0x42000000 0x300000 0x200000
md.b 0x42000000 0x200000
Note: Enable TeraTerm's logging feature and check the box to record screen data; this will make exporting the information easier.
Note 2: Edit the number of lines from 11111111 to 99999999 to avoid data loss. After generating the log, attach it here.
Note 3: Do not use the computer while executing the second command to avoid data loss.

[CATSOFTNET]

Sorry, no Telnet on the device, cant enable it with zte_modem_tools either. Tried ZTETelnet also, but no luck. SN is in the archive.