I have tried to follow this guide but libxmlapi.so didn't have the required ATP_GetInfo1 function so i moved to the next file libhttpapi.so it had


so i copied the first two .

then ATP_GetInfo3 from libcfmapi.so file

then ATP_GetInfo4 from libmsgapi.so file .... and when i tried to run the script decode_keystore.py but it gave me

ValueError: Input strings must be a multiple of 16 in length

.... and i think because the values wasn't in the same length

The firmware file

  • Make sure your strings are 240 characters in length.
    – Madushan
    Jul 6 '19 at 5:45
  • @Madushan how while there are not !
    – mina nageh
    Jul 7 '19 at 1:02

I mailed Nirsoft RouterPassView tool creator for about a month and he figured the way to decrypt it after so many tries ... and it wasn't the way that you mentioned in the article at all but it was in one of the mentioned files libcfmapi.so

and finally when he figured it out he said

It's from the strings I found, but I had to put them in different order: (look in the colored chars): enter image description here

the order he used was for the key you take one character from all the first four strings then the second then third till the end of these stings after the equal mark and repeat and for the IV you did the same for the last four strings so it results into this

IV: F64D19C622D7C01176C3F02E0E941F31

Key (AES128) : B5662E0C6DEC255FD25A159A6CB3E454

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.