I have this file from my router its backup of user config,I suppose its compresed with zlib and encrypted with AES. Utility which is resposible to compress it and encrypt it is called cspd. In side cspd there is function called
dbcCfgFileDecry in which Im interested, If anyone could help me identify how this function decrypt config file I would be most grateful.I can run gdbserver on router with cspd as argument but it just exit, I also tried to attach to existing cspd proces (there is several of them) but router just crashes.
EDIT: I just found that inside
encry function there is
CSPDBGetFileEncryKey so the key is stored inside DB ?? There is also utility on router caled sendcmd which is responsable in manipulating of DB. If I run sendcmd with
sendcmd 1 DB I get
fc [bin-file-name]:compress user config to bin-file-name fuc [bin-file-name]:uncompress bin-file-name to user config decry : cfg decry
I did tried it but it does not work