Finished the full conversion and simplification of the default WIFI password generators for the ZyXEL VMG3312 (based on GPUhash_me on hashkiller) as well as the Zyxel VMG8823 (VMG8825, VMG4825, VMG3925, others???) from Lucio Corsa's Zykgen, to Matlab. Plum on Hashkiller has converted the second one to python3!
Either way, it now allows me to make rainbow tables for those modems. However, the goal was to try and modify them to the videotron charset and there I sadly struck out. That's got to be another algo...
One thing these two algos have in common is that it starts with an MD5 of the serial number, then does some string manipulations (insertions, addons) of the lower case hex-hash, before doing another MD5 of the resulting string.
The password is based on the second MD5, with some creative math or just pulled from the middle of the hex-hash.
There's really no guessing what these manipulations are, unless you have the algo pulled from the firmware. So little hope on discovering this from the stickers.
Either way, it now allows me to make rainbow tables for those modems. However, the goal was to try and modify them to the videotron charset and there I sadly struck out. That's got to be another algo...
One thing these two algos have in common is that it starts with an MD5 of the serial number, then does some string manipulations (insertions, addons) of the lower case hex-hash, before doing another MD5 of the resulting string.
The password is based on the second MD5, with some creative math or just pulled from the middle of the hex-hash.
There's really no guessing what these manipulations are, unless you have the algo pulled from the firmware. So little hope on discovering this from the stickers.