12-27-2024, 06:36 AM
(12-26-2024, 05:53 AM)Have Blue Wrote: This has probably already been discovered by others, but it looks like the first 5 characters only consist of a-j, so it seems to be an alpha substitution for 0-9, making the keyspace: -1 abcdefghij -a 3 ?1?1?1?1?1?d?d?d?d?d
After looking a little bit closer at your dir-605L data, it looks to be very much in the family of the 640L
The 640L takes a hexadecimal hash, and plucks letters from them (0..F) followed by modulus 10. (Hex value % 10)
Which means that values 0..5 (and a..f) are almost twice as likely of showing up, versus chars '6789' and 'ghij' and that is reflected by the data you collected.
d-link cleverly uses a few variants of the algo for each model, so tracking the exact algo down will be a bit tricky but it might be possible with enough data....