04-13-2025, 07:41 PM
Hey all, it’s the weekend and here is that Python script that I promised! I worked on calculating the Start/End of the known Date Code blocks in the data set. I had a script to help with the actual calculations, but I did each one individually to oversee how everything was lining up.
Here’s the code I ended up with, I have named it Fios-F1nDr as a play on their SSID 😀
Output:
Using the script is pretty simple, just run it! The script will prompt you to "Enter one or more MAC addresses (comma-separated) or the path to a.csv file:”. As it says, it will accept a variety of inputs. You can type a single MAC address, a few MACs separated by a comma, or feed it a list of MACs from a comma separated .csv file. The script strips out the characters . - : so it will accept a variety of formats. If you give it a .csv file, it will prompt you for a save path, which will be something like "/path/fiender.csv”. The script will then use “ref_data_lines” as the data to calculate the information. Everything should be human readable and commented, but let me know if you have any questions. For future updates I will only post the new ref_data_lines because that should be all that needs changed.
Once I had the data and the script, I collected 25 new entries for the data base and checked them against the script. How did we do? OOF, only 36% of the new entries were calculated correctly. At least the correct hits show that we’re on the right path...
Correct = 9 (36%)
Incorrect = 10 (40%)
Unknown Block = 4 (16%)
Unknown Device = 1 (4%)
Not Enough data = 1 (4%)
This actually isn’t a bad thing though, the script is making some assumptions about each MAC block, and these entries provide us with new date codes. After working the new entries into the data, we test the script again. Much better, with 80% of the hits correct. The ones we’re missing are because we don’t have enough information to calculate the block space just yet. Sometimes just a single entry can remove a bunch of the unknown, which means that continuing to collect data will continue to improve the script. The good news is that this only really pertains to calculating the correct Serial Number, which doesn’t matter much at this point without a keygen algorithm. The script will still output everything we know, including the Password Keyspace as this info doesn’t actually change too much across devices. I will keep track of these stats as I continue to update the data base to see how close we’re getting to finding all of the blocks. Although we don’t have the algorithm, all we need to do is drop it into the script and we have a complete recovery tool!
Correct = 20 (80%)
Incorrect = 0 (0%)
Unknown Block = 4 (16%)
Unknown Device = 0 (0%)
Not Enough data = 1 (4%)
Some other fun stats:
We have discovered 145 unique date codes. Here the date codes and the # of devices currently believed to be in each block. On average, a block contains 29336 devices, so a usually high number of devices could indicate that there is at least 1 missing date code. 0 devices means that we don’t know enough about that block yet. Current calculations predict ~4165721 devices total.
Here’s the code I ended up with, I have named it Fios-F1nDr as a play on their SSID 😀
Code:
import pandas as pd
import os
from tabulate import tabulate
def parse_ref_data(ref_data_lines):
ref_data = []
for line in ref_data_lines:
parts = line.split(',')
# Ensure parts has enough elements
if len(parts) < 11:
print(f"Skipping line due to insufficient data: {line}")
continue
ref_data.append({
'MAC_start': parts[0],
'MAC_end': parts[1],
'Serial_start': parts[2],
'Serial_end': parts[3],
'M2HR': parts[4] if parts[4] else "Unknown",
'W_format': int(parts[5]) if parts[5].isdigit() else None,
'W_len': int(parts[6]) if parts[6].isdigit() else None,
'A_format': int(parts[7]) if parts[7].isdigit() else None,
'A_len': int(parts[8]) if parts[8].isdigit() else None,
'Date': parts[9] if len(parts) > 9 else '',
'HW': parts[10] if len(parts) > 10 else '',
'Model': parts[11] if len(parts) > 11 else ''
})
return ref_data
def mac_to_hex(mac):
# Strip separators and convert to lowercase
mac = mac.replace(':', '').replace('.', '').lower()
return int(mac[-6:], 16)
def process_single_mac(mac, ref_data):
# Strip separators and convert to lowercase
mac_cleaned = mac.replace(':', '').replace('.', '').replace('-', '').lower()
# Check for valid prefix
valid_prefixes = ["04a222", "b8f853", "3cbdc5", "dcf51b"]
if mac_cleaned[:6] not in valid_prefixes:
return {"Model": "Unknown Device", "Calculated Serial": "Unknown Device"}
# Skip calculation for DCF51B prefix
if mac_cleaned[:6] == "dcf51b":
return {"Calculated Serial": "Not enough data", "Model": "E3200", "HW": 1104,
"W_format": 2, "W_len": "15", "A_format": 2, "A_len": 9}
# Find the relevant block
for block in ref_data:
mac_start_cleaned = block['MAC_start'].replace(':', '').replace('.', '').replace('-', '').lower()
mac_end_cleaned = block['MAC_end'].replace(':', '').replace('.', '').replace('-', '').lower()
# Compare cleaned MAC addresses
if mac_start_cleaned <= mac_cleaned <= mac_end_cleaned:
if block['Serial_start'] == "Unknown Block":
return {"Calculated Serial": "Unknown Block", "Model": block['Model'], "Hardware": block['HW'],
"W_format": block['W_format'], "W_len": block['W_len'], "A_format": block['A_format'], "A_len": block['A_len']}
# Skip calculation if M2HR is unknown
if block['M2HR'] == "Unknown":
return {"Calculated Serial": "Unknown", "M2HR": "Unknown", "Model": block['Model'], "HW": block['HW'],
"W_format": block['W_format'], "W_len": block['W_len'], "A_format": block['A_format'], "A_len": block['A_len']}
# Calculate Serial
serial_prefix = block['Serial_start'][0]
serial_start_cleaned = block['Serial_start'][1:]
mac_dec = mac_to_hex(mac)
mac_start_dec = mac_to_hex(block['MAC_start'])
serial_difference = (mac_dec - mac_start_dec) / int(block['M2HR'])
calculated_serial = serial_prefix + str(int(serial_start_cleaned) + serial_difference)
calculated_serial = calculated_serial[:16]
return {"MAC_start": block['MAC_start'], "MAC_end": block['MAC_end'], "M2HR": block['M2HR'], "Calculated Serial": calculated_serial,
"W_format": block['W_format'], "W_len": block['W_len'], "A_format": block['A_format'], "A_len": block['A_len'],
"Model": block['Model'], "Date": block['Date'], "HW": block['HW']}
return {"Model": "Unknown Device", "Calculated Serial": "Unknown Device"}
def process_csv_file(file_path, ref_data, save_location):
# Read the CSV file containing MAC addresses
df = pd.read_csv(file_path)
# Define the column titles for the output CSV
columns = ["MAC_input", "MAC_start", "MAC_end", "M2HR", "Calculated Serial", "W_format", "W_len", "A_format", "A_len", "Model", "Date Code (YYMMDD)", "HW"]
# Prepare a list to hold results
results = []
# Process each MAC address
for mac in df:
result = process_single_mac(mac.strip(), ref_data) # Ensure whitespace is stripped
result['MAC'] = mac # Include the original MAC address
# Format W_len and A_len using format_description
W_format = format_description(result.get("W_format", ""), is_wifi=True)
A_format = format_description(result.get("A_format", ""), is_wifi=False)
# Append the values in the order of the defined columns
results.append([
result.get("MAC", ""),
result.get("MAC_start", ""),
result.get("MAC_end", ""),
result.get("M2HR", ""),
result.get("Calculated Serial", ""),
W_format,
result.get("W_len", ""),
A_format,
result.get("A_len", ""),
result.get("Model", ""),
result.get("Date", ""),
result.get("HW", "")
])
# Convert results to DataFrame
results_df = pd.DataFrame(results, columns=columns)
# Save the DataFrame to a CSV file
results_df.to_csv(save_location, index=False)
print(str(len(results_df)) + " MACs proccessed, saved to " + save_location)
def format_description(format_type, is_wifi=True):
if is_wifi:
return "wnwnw" if format_type == 1 else "w?-w?-w? " if format_type == 2 else ""
else:
return "wnw" if format_type == 1 else "<A-Z><0-9>" if format_type == 2 else ""
def print_formatted_table(result):
print(" Fios-F1NdR")
# Organize the data into a table
table_data = [
["MAC Input", result.get("MAC", "")],
["MAC Block Start", result.get("MAC_start", "")],
["MAC Block End", result.get("MAC_end", "")],
["MAC 2 Hex Ratio", result.get("M2HR", "")],
["Calculated Serial", result.get("Calculated Serial", "")],
["Keyspace", "w = <word> n = <number>\n? = single digit at end of random word"],
["WiFi Pass Format", format_description(result.get("W_format", ""), is_wifi=True)],
["WiFi Pass Length", result.get("W_len", "")],
["Admin Pass Format", format_description(result.get("A_format", ""), is_wifi=False)],
["Admin Pass Length", result.get("A_len", "")],
["Model Type", result.get("Model", "")],
["Date Code (YYMMDD)", result.get("Date", "")],
["Hardware", result.get("HW", "")]
]
formatted_table = tabulate(table_data, tablefmt="grid")
print(formatted_table)
def main():
ref_data_lines = [
"04.A2.22.00.00.00,04.A2.22.AE.B8.7E,0,0,Unknown,1,0,1,0,0,0,Unknown",
"04.A2.22.AE.B8.89,04.A2.22.BA.30.A2,G401119042900000,G401119042968331,11,1,16,1,16,190429,1102,G3100",
"04.A2.22.BA.30.A6,04.A2.22.C3.3A.BB,G401119061100000,G401119061153855,11,1,16,1,16,190611,1103,G3100",
"04.A2.22.C3.3A.C6,04.A2.22.CB.A8.3C,G401119061800000,G401119061850210,11,1,16,1,16,190618,1103,G3100",
"04.A2.22.CB.5B.F0,04.A2.22.CB.5B.F2,E301119062000000,0,Unknown,1,16,1,16,190620,1102,E3200",
"04.A2.22.CB.E9.6C,04.A2.22.DB.74.3E,G401119062600000,G40111906292598,11,1,16,1,16,190626,1103,G3100",
"04.A2.22.D3.FF.3A,04.A2.22.DC.D2.DE,G401119071600000,G401119071652588,11,1,16,1,16,190716,1103,G3100",
"04.A2.22.DC.D2.E0,04.A2.22.DC.D2.E2,E301119072900000,0,Unknown,1,16,1,16,190729,1102,E3200",
"04.A2.22.DF.45.32,04.A2.22.DF.45.34,E301119073010000,0,Unknown,1,16,1,16,190730,1102,E3200",
"04.A2.22.DF.DB.E0,04.A2.22.DF.DB.E2,E301119073000000,0,Unknown,1,16,1,16,190730,1102,E3200",
"04.A2.22.E1.1D.12,04.A2.22.EA.27.27,G401119081000000,G401119081053855,11,1,16,1,16,190810,1103,G3100",
"04.A2.22.E2.B5.72,04.A2.22.E5.5E.A1,G401119073100000,G401119073115853,11,1,16,1,16,190731,1103,G3100",
"04.A2.22.E5.5E.A2,04.A2.22.F3.31.E2,G401119081300000,G401119081382368,11,1,16,1,16,190813,1103,G3100",
"04.A2.22.F3.31.E2,04.A2.22.F8.0B.14,G401119082300000,G401119082328886,11,1,16,1,16,190823,1103,G3100",
"04.A2.22.F8.0B.1F,04.A2.22.F8.3E.DB,G401119081300000,G401119081396619,0.000115284648277019,1,16,1,16,190813,1103,G3100",
"04.A2.22.F8.3E.DC,04.A2.22.FA.2B.90,0,0,Unknown,1,0,1,0,0,0,Unknown",
"04.A2.22.FA.2B.9A,04.A2.22.FB.F4.BF,G401119092000000,G401119092010639,11,1,16,1,16,190920,1103,G3100",
"04.A2.22.FB.F4.CA,04.A2.22.FF.FF.FF,0,0,Unknown,1,0,1,0,0,0,Unknown",
"B8.F8.53.00.00.00,B8.F8.53.02.AD.9B,0,0,Unknown,1,0,,0,0,0,Unknown",
"B8.F8.53.02.8D.41,B8.F8.53.05.93.61,G401119092620000,G401119092638016,11,1,16,1,16,190926,1103,G3100",
"B8.F8.53.05.93.61,B8.F8.53.07.27.6A,G401119101100000,G401119101109403,11,1,16,1,16,191011,1103,G3100",
"B8.F8.53.07.27.75,B8.F8.53.08.BF.CA,G401119101400000,G401119101409503,11,1,16,1,16,191014,1103,G3100",
"B8.F8.53.08.BF.D5,B8.F8.53.09.CF.B2,G401119101600000,G401119101606327,11,1,16,1,16,191016,1103,G3100",
"B8.F8.53.09.D0.15,B8.F8.53.0A.B2.DF,G401119101700000,G401119101705278,11,1,16,1,16,191017,1103,G3100",
"B8.F8.53.0A.B2.D6,B8.F8.53.0A.E0.54,0,0,Unknown,1,0,1,0,0,0,Unknown",
"B8.F8.53.0A.E0.55,B8.F8.53.0B.49.17,G401119101800000,G401119101802438,11,1,16,1,16,191018,1103,G3100",
"B8.F8.53.0B.49.0E,B8.F8.53.1C.67.5C,0,0,Unknown,1,0,1,0,0,0,Unknown",
"B8.F8.53.1C.67.5D,B8.F8.53.20.20.3D,G401119111200000,G401119111222176,11,1,16,1,16,191112,1103,G3100",
"B8.F8.53.20.20.3D,B8.F8.53.24.7C.D3,G401119110800000,G401119110825986,11,1,16,1,16,191108,1104,G3100",
"B8.F8.53.25.5A.AF,B8.F8.53.25.5A.BB,E301119111100000,0,Unknown,1,16,1,16,191111,1102,E3200",
"B8.F8.53.25.C1.09,B8.F8.53.28.DC.42,G401119111500000,G401119111518507,11,1,16,1,16,191115,1103,G3100",
"B8.F8.53.28.DC.49,B8.F8.53.2C.FC.75,G401119120200000,G401119120224580,11,1,16,1,16,191202,1103,G3100",
"B8.F8.53.2C.FC.75,B8.F8.53.2F.1D.C6,G401119120500000,G401119120512691,11,1,16,1,16,191205,1103,G3100",
"B8.F8.53.2F.1D.CD,B8.F8.53.34.F7.22,G401119120700000,G401119120734848,11,1,16,1,16,191207,1103,G3100",
"B8.F8.53.34.F7.2D,B8.F8.53.35.B1.B4,G401119121700000,G401119121704341,11,1,16,1,16,191217,1103,G3100",
"B8.F8.53.35.B1.BD,B8.F8.53.3B.0B.27,G401119120900000,G401119120931870,11,1,16,1,16,191209,1103,G3100",
"B8.F8.53.3B.0B.31,B8.F8.53.3C.A3.86,G401120010700000,G401120010709503,11,1,16,1,16,200107,1103,G3100",
"B8.F8.53.3C.A3.8B,B8.F8.53.3E.3B.EB,G401120010900000,G401120010909504,11,1,16,1,16,200109,1103,G3100",
"B8.F8.53.3E.3B.F1,B8.F8.53.40.1F.62,G401120011000000,G401120011011251,11,1,16,1,16,200110,1103,G3100",
"B8.F8.53.40.1F.65,B8.F8.53.43.05.09,G401120011300000,G401120011317260,11,1,16,1,16,200113,1103,G3100",
"B8.F8.53.43.05.11,B8.F8.53.44.90.98,G401120011600000,G401120011609205,11,1,16,1,16,200116,1103,G3100",
"B8.F8.53.44.90.9F,B8.F8.53.4C.AE.CE,G401120010200000,G401120010248365,11,1,16,1,16,200102,1103,G3100",
"B8.F8.53.4C.AE.D6,B8.F8.53.51.F0.93,G402120021000000,0,Unknown,1,16,1,16,200210,1104,G3100",
"B8.F8.53.51.B9.01,B8.F8.53.51.F7.F2,G402120022400000,0,Unknown,1,16,1,16,200224,1104,G3100",
"B8.F8.53.52.19.01,B8.F8.53.52.9E.82,G402120022500000,0,Unknown,1,16,1,16,200225,1104,G3100",
"B8.F8.53.52.E2.01,B8.F8.53.52.F7.12,G402120022600000,0,Unknown,1,16,1,16,200226,1104,G3100",
"B8.F8.53.54.6E.01,B8.F8.53.54.B6.FA,G402120022900000,0,Unknown,1,16,1,16,200229,1104,G3100",
"B8.F8.53.55.34.01,B8.F8.53.55.58.52,G402120030300000,0,Unknown,1,16,1,16,200303,1104,G3100",
"B8.F8.53.57.8C.41,B8.F8.53.57.D8.C2,G402120031000000,0,Unknown,1,15,1,16,200310,1104,G3100",
"B8.F8.53.59.7B.41,B8.F8.53.59.87.62,G402120031300000,0,Unknown,1,16,1,16,200313,1104,G3100",
"B8.F8.53.5A.41.41,B8.F8.53.5A.8A.C0,G402120031400000,0,Unknown,1,16,1,16,200314,1004,G3100",
"B8.F8.53.5B.CD.41,B8.F8.53.5F.4B.89,G402120031800000,G402120031828617,8,1,15,1,16,200318,1104,G3100",
"B8.F8.53.5F.4B.90,B8.F8.53.60.11.88,G402120040800000,G402120040806335,8,1,15,1,16,200408,1104,G3100",
"B8.F8.53.60.11.90,B8.F8.53.62.00.88,G402120040900000,G402120040915839,8,1,15,1,16,200409,1104,G3100",
"B8.F8.53.62.00.90,B8.F8.53.62.C6.88,G402120041200000,G402120041206335,8,1,15,1,16,200412,1104,G3100",
"B8.F8.53.62.C6.90,B8.F8.53.67.0D.C8,G402120032500000,G402120032535047,8,1,15,1,16,200325,1104,G3100",
"B8.F8.53.67.0D.D0,B8.F8.53.67.D3.C8,G402120050600000,G402120050606336,8,1,15,1,16,200506,1104,G3100",
"B8.F8.53.67.D3.D0,B8.F8.53.69.5F.C8,G402120050800000,G402120050812671,8,1,15,1,16,200508,1104,G3100",
"B8.F8.53.68.99.D0,B8.F8.53.68.B8.B1,G402120050900000,G402120050900989,8,1,15,1,16,200509,1104,G3100",
"B8.F8.53.69.5F.D0,B8.F8.53.6D.80.88,G402120051100000,G402120051133816,8,1,15,1,16,200511,1104,G3100",
"B8.F8.53.6D.80.90,B8.F8.53.70.35.88,G402120060600000,G402120060622176,8,1,15,1,16,200606,1104,G3100",
"B8.F8.53.70.35.90,B8.F8.53.72.0F.59,G402120052600000,G402120052634649,8,1,15,1,16,200526,1104,G3100",
"B8.F8.53.73.AA.58,B8.F8.53.73.B9.F9,G402120070200000,G402120070200501,8,1,15,1,16,200702,1104,G3100",
"B8.F8.53.74.70.58,B8.F8.53.75.36.50,G402120070300000,G402120070306335,8,1,15,1,16,200703,1104,G3100",
"B8.F8.53.75.36.58,B8.F8.53.77.52.70,G402120070500000,G402120070517284,8,1,15,1,16,200705,1104,G3100",
"B8.F8.53.77.52.78,B8.F8.53.7D.EB.B0,G402120062600000,G402120062654056,8,1,15,1,16,200626,1104,G3100",
"B8.F8.53.7D.EB.B8,B8.F8.53.7F.14.B0,G402120072300000,G402120072309503,8,1,15,1,16,200723,1104,G3100",
"B8.F8.53.7F.14.B8,B8.F8.53.85.C5.38,G402120071800000,G402120071854800,8,1,15,1,16,200718,1104,G3100",
"B8.F8.53.85.C5.40,B8.F8.53.8B.AB.A8,G402120081100000,G402120081148333,8,1,15,1,16,200811,1104,G3100",
"B8.F8.53.8B.AB.B0,B8.F8.53.95.FB.A8,G402120081200000,G402120081284479,8,1,15,1,16,200812,1104,G3100",
"B8.F8.53.95.FB.B0,B8.F8.53.9E.AF.28,G402120082000000,G402120082071279,8,1,15,1,16,200820,1104,G3100",
"B8.F8.53.9E.AF.32,B8.F8.53.A0.F4.30,E302120082400000,E302120082424789,6,1,15,1,16,200824,1103,E3200",
"B8.F8.53.A0.F4.34,B8.F8.53.A1.62.2C,G402120082800000,G402120082803519,8,1,15,1,16,200828,1104,G3100",
"B8.F8.53.A1.62.34,B8.F8.53.AA.85.1C,G402120083000000,G402120083074845,8,1,15,1,16,200830,1104,G3100",
"B8.F8.53.AA.85.1E,B8.F8.53.AD.F8.DA,E302120090800000,E302120090837706,6,1,15,1,16,200908,1103,E3200",
"B8.F8.53.AD.F8.DC,B8.F8.53.B6.85.24,G402120091500000,G402120091570025,8,1,15,1,16,200915,1104,G3100",
"B8.F8.53.B6.85.26,B8.F8.53.B7.01.8E,E302120091500000,E302120091505308,6,1,15,1,16,200915,1103,E3200",
"B8.F8.53.B7.01.8F,B8.F8.53.B7.98.C3,0,0,Unknown,1,0,1,0,0,0,Unknown",
"B8.F8.53.B7.98.C4,B8.F8.53.B8.06.BC,G402120101500000,G402120101503519,8,1,15,1,16,201015,1104,G3100",
"B8.F8.53.B8.06.C4,B8.F8.53.BB.08.BC,G402120101600000,G402120101624639,8,1,15,1,16,201016,1104,G3100",
"B8.F8.53.BB.08.C4,B8.F8.53.BB.76.BC,G402120101800000,G402120101803519,8,1,15,1,16,201018,1104,G3100",
"B8.F8.53.BB.76.C4,B8.F8.53.C0.9E.BC,G402120101900000,G402120101942240,8,1,15,1,16,201019,1104,G3100",
"B8.F8.53.C0.9E.C4,B8.F8.53.C2.56.C4,G402120102400000,G402120102414080,8,1,15,1,16,201024,1104,G3100",
"B8.F8.53.C2.56.C4,B8.F8.53.C5.D1.1C,G402120102500000,G402120102528491,8,1,15,1,16,201025,1104,G3100",
"B8.F8.53.C5.D1.20,B8.F8.53.CD.91.D0,G402120100700000,G402120100763510,8,1,15,1,16,201007,1104,G3100",
"B8.F8.53.CD.91.D2,B8.F8.53.CE.C3.5A,E302120100700000,0,6,1,15,1,16,201007,1103,E3200",
"B8.F8.53.CE.C3.60,B8.F8.53.B7.98.BE,0,0,Unknown,1,0,1,0,0,0,Unknown",
"B8.F8.53.CE.D4.C8,B8.F8.53.D3.58.68,G402120101300000,G402120101336980,8,1,15,1,16,201013,1104,G3100",
"B8.F8.53.D3.58.6A,B8.F8.53.D5.EC.64,E302120101500000,E302120101528159,6,1,15,1,16,201015,1103,E3200",
"B8.F8.53.D5.EC.68,B8.F8.53.D7.36.60,G402120111200000,G402120111210559,8,1,15,1,16,201112,1104,G3100",
"B8.F8.53.D7.36.68,B8.F8.53.DA.38.60,G402120111300000,G402120111324640,8,1,15,1,16,201113,1104,G3100",
"B8.F8.53.DA.38.68,B8.F8.53.DC.01.D0,G402120111700000,G402120111714637,8,1,15,1,16,201117,1104,G3100",
"B8.F8.53.DC.01.D2,B8.F8.53.DC.6F.CA,E302120111300000,E302120111304693,6,1,15,1,16,201113,1103,E3200",
"B8.F8.53.DC.6F.D0,B8.F8.53.E3.C6.D8,G402120111300000,G402120111360129,8,1,15,1,16,201113,1104,G3100",
"B8.F8.53.E3.C6.E0,B8.F8.53.EB.14.D8,G402120120200000,G402120120259839,8,1,15,1,16,201202,1104,G3100",
"B8.F8.53.EB.14.E0,B8.F8.53.F3.08.C8,G402120121000000,G402120121065150,8,1,15,1,16,201210,1104,G3100",
"B8.F8.53.F3.08.D0,B8.F8.53.F8.30.C8,G402120122300000,G402120122342240,8,1,15,1,16,201223,1104,G3100",
"B8.F8.53.F8.30.D0,B8.F8.53.FA.C4.C8,G402121011800000,G402121011821120,8,1,15,1,16,210118,1104,G3100",
"B8.F8.53.FA.C4.D0,B8.F8.53.FF.BF.F8,G402121010600000,G402121010640805,8,1,15,1,16,210106,1104,G3100",
"B8.F8.53.FF.BF.F9,B8.F8.53.FF.FF.FF,0,0,Unknown,1,0,1,0,0,0,Unknown",
"3C.BD.C5.00.00.00,3C.BD.C5.01.25.57,0,0,Unknown,1,0,1,0,0,0,Unknown",
"3C.BD.C5.01.25.58,3C.BD.C5.01.F5.78,G402121011510000,G402121011516660,8,1,15,1,16,210115,1104,G3100",
"3C.BD.C5.09.3B.F8,3C.BD.C5.0B.B4.78,G402121030100000,G402121030120240,8,1,15,1,16,210301,1104,G3100",
"3C.BD.C5.0B.B4.7A,3C.BD.C5.0B.BC.FD,E302121030300000,E302121030300364,6,1,15,1,16,210303,1103,E3200",
"3C.BD.C5.0C.30.38,3C.BD.C5.16.4A.C0,G402121021700000,G402121021782769,8,1,15,1,16,210217,1104,G3100",
"3C.BD.C5.16.4A.C8,3C.BD.C5.22.55.E0,G402121031200000,G402121031298659,8,1,15,1,16,210312,1104,G3100",
"3C.BD.C5.1E.E5.EA,3C.BD.C5.22.55.E6,E302121031200000,E302121031237546,6,1,15,1,16,210312,1103,E3200",
"3C.BD.C5.22.55.E8,3C.Bd.C5.2B.5B.E0,G402121033100000,G402121033173919,8,1,15,1,16,210331,1104,G3100",
"3C.BD.C5.2B.5B.E8,3C.BD.C5.31.1E.68,G402121041400000,G402121041447184,8,1,15,1,16,210414,1104,G3100",
"3C.BD.C5.31.1E.69,3C.BD.C5.35.36.88,0,0,Unknown,1,0,1,0,0,0,Unknown",
"3C.BD.C5.35.36.90,3C.BD.C5.3C.6B.58,G402121051500000,G402121051559033,8,1,15,1,16,210515,1104,G3100",
"3C.BD.C5.3C.6B.59,3C.BD.C5.37.5C.88,0,0,Unknown,1,0,1,0,0,0,Unknown",
"3C.BD.C5.37.5C.90,3C.BD.C5.3D.D3.38,G402121051800000,G402121051852950,8,1,15,1,16,210518,1104,G3100",
"3C.BD.C5.3D.D3.40,3C.BD.C5.42.27.40,G402121060700000,G402121060735456,8,1,15,1,16,210607,1104,G3100",
"3C.BD.C5.42.27.4C,3C.BD.C5.46.3E.C4,G402121062200000,G402121062233519,8,1,15,1,16,210622,1104,G3100",
"3C.BD.C5.46.3E.CC,3C.BD.C5.47.F6.C4,G402121071300000,G402121071314079,8,1,15,1,16,210713,1104,G3100",
"3C.BD.C5.47.F6.CC,3C.BD.C5.49.AE.C4,G402121072100000,G402121072114079,8,1,15,1,16,210721,1104,G3100",
"3C.BD.C5.49.AE.CC,3C.BD.C5.50.05.4C,G402121070100000,G402121070151920,8,1,15,1,16,210701,1104,G3100",
"3C.BD.C5.50.05.4C,3C.BD.C5.57.37.CC,G402121072000000,G402121072058960,8,2,15,2,9,210720,1104,G3100",
"3C.BD.C5.57.37.CE,3C.BD.C5.59.22.C0,E302121072000000,E302121072020947,6,2,15,2,9,210720,1103,E3200",
"3C.BD.C5.59.24.74,3C.BD.C5.60.3B.6C,G402121080200000,G402121080258079,8,2,15,2,9,210802,1104,G3100",
"3C.BD.C5.60.3B.74,3C.BD.C5.67.20.6C,G402121081100000,G402121081156479,8,2,15,2,9,210811,1104,G3100",
"3C.BD.C5.67.20.74,3C.BD.C5.69.B8.CC,G402121081160000,G402121081181259,8,2,15,2,9,210811,1104,G3100",
"3C.BD.C5.69.B8.D4,3C.BD.C5.71.07.FC,G402121082000000,G402121082059877,8,2,15,2,9,210820,1104,G3100",
"3C.BD.C5.71.08.00,3C.BD.C5.76.8D.C8,G402121082600000,G402121082645241,8,2,15,2,9,210826,1104,G3100",
"3C.BD.C5.76.8D.CD,3C.BD.C5.7D.27.A5,G402121090800000,G402121090854075,8,2,15,2,9,210908,1104,G3100",
"3C.BD.C5.7D.27.A6,3C.BD.C5.83.03.C6,0,0,Unknown,2,0,2,0,0,0,Unknown",
"3C.BD.C5.7E.9C.4C,3C.BD.C5.83.03.CC,G402121091600000,G402121091636080,8,2,15,2,9,210916,1104,G3100",
"3C.BD.C5.83.03.CE,3C.BD.C5.85.4C.A4,E302121091600000,E302121091624953,6,2,15,2,9,210916,1103,E3200",
"3C.BD.C5.85.4C.AA,3C.BD.C5.8C.CB.CB,0,0,Unknown,2,0,2,0,0,0,Unknown",
"3C.BD.C5.8C.CB.CC,3C.BD.C5.93.FF.94,G402121101500000,G402121101559001,8,2,15,2,9,211015,1104,G3100",
"3C.BD.C5.93.FF.9C,3C.BD.C5.9B.67.71,0,0,Unknown,2,0,2,0,0,0,Unknown",
"3C.BD.C5.9B.67.72,3C.BD.C5.A1.71.B2,G402121110500000,G402121110549480,8,2,15,2,9,211105,1104,G3100",
"3C.BD.C5.A1.71.B4,3C.BD.C5.A3.FE.22,E302121110500000,E302121110527837,6,2,15,2,9,211105,1103,E3200",
"3C.BD.C5.A3.FE.28,3C.BD.C5.AD.16.63,0,0,Unknown,2,0,2,0,0,0,Unknown",
"3C.BD.C5.AD.16.64,3C.BD.C5.AE.AE.34,E302122010100000,E30212201017400,6,2,15,2,9,220101,1103,E3200",
"3C.BD.C5.AE.AE.34,3C.BD.C5.B4.2D.5E,E302121122100000,E302121122160039,6,2,15,2,9,211221,1103,E3200",
"3C.BD.C5.B4.2D.62,3C.BD.C5.B5.09.9A,G402122021400000,G402122021407047,8,2,15,2,9,220214,1104,G3100",
"3C.BD.C5.B5.09.A2,3C.BD.C5.B5.E5.9A,G402122031000000,G402122031007039,8,2,15,2,9,220310,1104,G3100",
"3C.BD.C5.B5.E5.A2,3C.BD.C5.B8.0B.9A,G402122031100000,G402122031117599,8,2,15,2,9,220311,1104,G3100",
"3C.BD.C5.B8.0B.A2,3C.BD.C5.C1.ED.A2,G402122031500000,G402122031580960,8,2,15,2,9,220315,1104,G3100",
"3C.BD.C5.C1.ED.A4,3C.BD.C5.C2.40.1E,E302122031300000,E302122031303519,6,2,15,2,9,220313,1103,E3200",
"3C.BD.C5.C2.40.24,3C.BD.C5.C2.89.E6,E302122031400000,E302122031403147,6,2,15,2,9,220314,1103,E3200",
"3C.BD.C5.C2.89.EC,3C.BD.C5.CD.A1.19,0,0,Unknown,2,0,2,0,0,0,Unknown",
"3C.BD.C5.CD.A1.20,3C.BD.C5.CF.39.86,E302122052200000,E302122052217426,6,2,15,2,9,220522,1103,E3200",
"3C.BD.C5.CF.39.8C,3C.BD.C5.D2.C8.06,E302122091400000,E302122091438847,6,2,15,2,9,220914,1103,E3200",
"3C.BD.C5.D2.C8.0C,3C.BD.C5.DA.E1.12,E302122091500000,E302122091588450,6,2,15,2,9,220915,1103,E3200",
"3C.BD.C5.DA.E1.18,3C.BD.C5.DD.EE.86,E302122110900000,E302122110933341,6,2,15,2,9,221109,1103,E3200",
"3C.BD.C5.DD.EE.8C,3C.BD.C5.E5.83.97,0,0,Unknown,2,0,2,0,0,0,Unknown",
"3C.BD.C5.E5.83.98,3C.BD.C5.E8.34.8A,E302123011000000,E302123011029396,6,2,15,2,9,230110,1103,E3200",
"3C.BD.C5.E8.34.90,3C.BD.C5.F1.11.4A,E302123030400000,E302123030496800,6,2,15,2,9,230304,1103,E3200",
"3C.BD.C5.F1.11.50,3C.BD.C5.F1.E1.E2,E302123042100000,E302123042108899,6,2,15,2,9,230421,1103,E3200",
"3C.BD.C5.F1.E1.E8,3C.BD.C5.F4.B3.C2,E302123042600000,E302123042630800,6,2,15,2,9,230426,1103,E3200",
"3C.BD.C5.F4.B3.C8,3C.BD.C5.F8.7A.CA,E302123052000000,E302123052041260,6,2,15,2,9,230520,1103,E3200",
"3C.BD.C5.F8.7A.D0,3C.BD.C5.F8.A3.63,E302123080600000,E302123080601732,6,2,15,2,9,230806,1103,E3200",
"3C.BD.C5.F8.A3.64,3C.BD.C5.FF.FF.FF,0,0,Unknown,2,0,2,0,0,0,Unknown",
"DC.F5.1B.5F.EA.4F,DC.F5.1B.64.2B.10,Unknown,Unknown,0,2,16,2,9,223550,1103,Unknown",
"DC.F5.1B.64.2B.1A,DC.F5.1B.64.34.D5,E302123103100000,0,6,2,15,2,9,231031,1103,E3200",
"DC.F5.1B.64.54.5A,DC.F5.1B.64.57.B5,E302123110200000,0,6,2,15,2,9,231102,1103,E3200",
"DC.F5.1B.67.F4.7A,DC.F5.1B.68.6F.Ff,E302123113000000,0,6,2,15,2,9,231130,1103,E3200",
"DC.F5.1B.5D.64.60,DC.F5.1B.60.14.57,AA63332935300000,0,6,2,15,2,9,329353,1103,Unknown",
]
ref_data = parse_ref_data(ref_data_lines)
user_input = input("Enter one or more MAC addresses (comma-separated) or the path to a.csv file: ")
if user_input.lower().endswith('.csv'):
while not os.path.isfile(user_input) or not user_input.lower().endswith('.csv'):
user_input = input("Please enter a valid.csv file path: ")
save_location = input("Enter the save location for the output.csv file: ")
process_csv_file(user_input, ref_data, save_location)
else:
mac_addresses = user_input.split(',')
for mac in mac_addresses:
mac = mac.strip() # Remove any leading/trailing whitespace
result = process_single_mac(mac, ref_data)
result['MAC'] = mac # Include the original MAC address
# Print the result in a formatted table
print_formatted_table(result)
if __name__ == "__main__":
main()Output:
Code:
Fios-F1NdR
+--------------------+----------------------------------------+
| MAC Input | B8.F8.53.E2.EC.60 |
+--------------------+----------------------------------------+
| MAC Block Start | B8.F8.53.DC.6F.D0 |
+--------------------+----------------------------------------+
| MAC Block End | B8.F8.53.E3.C6.D8 |
+--------------------+----------------------------------------+
| MAC 2 Hex Ratio | 8 |
+--------------------+----------------------------------------+
| Calculated Serial | G402120111353138 |
+--------------------+----------------------------------------+
| Keyspace | w = <word> n = <number> |
| | ? = single digit at end of random word |
+--------------------+----------------------------------------+
| WiFi Pass Format | wnwnw |
+--------------------+----------------------------------------+
| WiFi Pass Length | 15 |
+--------------------+----------------------------------------+
| Admin Pass Format | wnw |
+--------------------+----------------------------------------+
| Admin Pass Length | 16 |
+--------------------+----------------------------------------+
| Model Type | G3100 |
+--------------------+----------------------------------------+
| Date Code (YYMMDD) | 201113 |
+--------------------+----------------------------------------+
| Hardware | 1104 |
+--------------------+----------------------------------------+Using the script is pretty simple, just run it! The script will prompt you to "Enter one or more MAC addresses (comma-separated) or the path to a.csv file:”. As it says, it will accept a variety of inputs. You can type a single MAC address, a few MACs separated by a comma, or feed it a list of MACs from a comma separated .csv file. The script strips out the characters . - : so it will accept a variety of formats. If you give it a .csv file, it will prompt you for a save path, which will be something like "/path/fiender.csv”. The script will then use “ref_data_lines” as the data to calculate the information. Everything should be human readable and commented, but let me know if you have any questions. For future updates I will only post the new ref_data_lines because that should be all that needs changed.
Once I had the data and the script, I collected 25 new entries for the data base and checked them against the script. How did we do? OOF, only 36% of the new entries were calculated correctly. At least the correct hits show that we’re on the right path...
Correct = 9 (36%)
Incorrect = 10 (40%)
Unknown Block = 4 (16%)
Unknown Device = 1 (4%)
Not Enough data = 1 (4%)
This actually isn’t a bad thing though, the script is making some assumptions about each MAC block, and these entries provide us with new date codes. After working the new entries into the data, we test the script again. Much better, with 80% of the hits correct. The ones we’re missing are because we don’t have enough information to calculate the block space just yet. Sometimes just a single entry can remove a bunch of the unknown, which means that continuing to collect data will continue to improve the script. The good news is that this only really pertains to calculating the correct Serial Number, which doesn’t matter much at this point without a keygen algorithm. The script will still output everything we know, including the Password Keyspace as this info doesn’t actually change too much across devices. I will keep track of these stats as I continue to update the data base to see how close we’re getting to finding all of the blocks. Although we don’t have the algorithm, all we need to do is drop it into the script and we have a complete recovery tool!
Correct = 20 (80%)
Incorrect = 0 (0%)
Unknown Block = 4 (16%)
Unknown Device = 0 (0%)
Not Enough data = 1 (4%)
Some other fun stats:
We have discovered 145 unique date codes. Here the date codes and the # of devices currently believed to be in each block. On average, a block contains 29336 devices, so a usually high number of devices could indicate that there is at least 1 missing date code. 0 devices means that we don’t know enough about that block yet. Current calculations predict ~4165721 devices total.
Code:
190429 68331
190611 53855
190618 50210
190620 0
190626 92598
190716 52588
190729 0
190730 0
190730 0
190810 53855
190731 15853
190813 82368
190823 28886
190813 96619
190920 10639
190926 38016
191011 09403
191014 09503
191016 06327
191017 05278
191018 02438
191112 22176
191108 25986
191111 0
191115 18507
191202 24580
191205 12691
191207 34848
191217 04341
191209 31870
200107 09503
200109 09504
200110 11251
200113 17260
200116 09205
200102 48365
200210 0
200224 0
200225 0
200226 0
200229 0
200303 0
200310 0
200313 0
200314 0
200318 28617
200408 06335
200409 15839
200412 06335
200325 35047
200506 06336
200508 12671
200509 00989
200511 33816
200606 22176
200526 34649
200702 00501
200703 06335
200705 17284
200626 54056
200723 09503
200718 54800
200811 48333
200812 84479
200820 71279
200824 24789
200828 03519
200830 74845
200908 37706
200915 70025
200915 05308
201015 03519
201016 24639
201018 03519
201019 42240
201024 14080
201025 28491
201007 63510
201007 0
201013 36980
201015 28159
201112 10559
201113 24640
201117 14637
201113 04693
201113 60129
201202 59839
201210 65150
201223 42240
210118 21120
210106 40805
210115 16660
210301 20240
210303 00364
210217 82769
210312 98659
210312 37546
210331 73919
210414 47184
210515 59033
210518 52950
210607 35456
210622 33519
210713 14079
210721 14079
210701 51920
210720 58960
210720 20947
210802 58079
210811 56479
210811 81259
210820 59877
210826 45241
210908 54075
210916 36080
210916 24953
211015 59001
211105 49480
211105 27837
220101 17400
211221 60039
220214 07047
220310 07039
220311 17599
220315 80960
220313 03519
220314 03147
220522 17426
220914 38847
220915 88450
221109 33341
230110 29396
230304 96800
230421 08899
230426 30800
230520 41260
230806 01732
223550 0
231031 0
231102 0
231130 0
329353 0