How to compute the password of Zyxel Prestige Modem/Router.
Posted: Monday,11-Aug-2003 10:41 am
How to compute the password to unlock the protected debug-mode AT-commands of a Zyxel Prestige 941 Cable Modem/Router
Symtom: Some of the debug-mode commands (boot commands) of the Zyxel P941 do not work. The response is always "ERROR".
Hardware: Zyxel Prestige 941 cable router.
Note: Some other Zyxel Prestige modems/routers (e.g. 645 and 650) use the same password algorithm.
Software: Zyxel-Firmware: Bootbase version V1.6.
Cause: Some of the debug-mode AT-commands are protected and must be enabled using a randomly generated password.
Solution: Use the "ATSE" command to display the seed of the password generator. Compute the password and enter the password with the command "ATEN 1,password". After that, "ATHE" (help) will include the protected commands in the list.
The following formula can be used to compute the password:
a = first 3 bytes of seed value
b = a + 0x10F0A563
c = (last byte of seed value) AND 7
password = (b ROR c) XOR a
Note: ROR is a 32-bit rotate-right operation.
CR
Symtom: Some of the debug-mode commands (boot commands) of the Zyxel P941 do not work. The response is always "ERROR".
Hardware: Zyxel Prestige 941 cable router.
Note: Some other Zyxel Prestige modems/routers (e.g. 645 and 650) use the same password algorithm.
Software: Zyxel-Firmware: Bootbase version V1.6.
Cause: Some of the debug-mode AT-commands are protected and must be enabled using a randomly generated password.
Solution: Use the "ATSE" command to display the seed of the password generator. Compute the password and enter the password with the command "ATEN 1,password". After that, "ATHE" (help) will include the protected commands in the list.
The following formula can be used to compute the password:
a = first 3 bytes of seed value
b = a + 0x10F0A563
c = (last byte of seed value) AND 7
password = (b ROR c) XOR a
Note: ROR is a 32-bit rotate-right operation.
CR