I am trying to modify the backup file of this router in order to change some configurations.
Here is the structure I have until now:
16 bytes of the header, zlib compressed xml with the configuration and 32 more bytes of unknown data.
This is the header:
- offset - 0 1 2 3 4 5 6 7 8 9 A B C D E F 0123456789ABCDEF
0x00000000 0012 3123 0000 8e3a 7866 4ae5 0006 7255 ..1#...:xfJ...rU
At offset 0x4 is the length of the zlib data and at offset 0x8 is the crc32 checksum of the same data.
And these are the 32 bytes at the end of the file:
- offset - 0 1 2 3 4 5 6 7 8 9 A B C D E F 0123456789ABCDEF
0x00008e39 77da 46e5 2d71 285e c377 6691 c1b5 c1ff w.F.-q(^.wf.....
0x00008e49 0f7d ba8c 4b83 ff1f 30ce 8c1b f381 8a0c .}..K...0.......
I tried to change the xml, update the length and the crc32, leaving the unknown bytes the same but the router did not reset its configuration.
I can confirm it did not work because when I use the unmodified backup file it resets the password for the admin account.
PS: I can't make the file public because it contains sensitive information