Hi guys i have unpacked the firmware ZTE F680L v6.0 with binwalk -Me and have extracted the jffs2

You can find the firmware image here.

Inside we have an /etc folder with some db_default_cfg.xml which seem to encrypted with AES.

In the bin folder I also have a CSPD binary which seems to indicate that we might have some AES key to decrypt the xml files.

I was wondering if anyone already has been able to decrypt this xml file.

inside the cspd we have the following information

root@PSI-DEV:/media/jffs2-extracted/bin# binwalk -Me cspd

Scan Time:     2022-10-19 22:07:13 Target File:  
/media/jffs2-extracted/bin/cspd MD5 Checksum: 
e4305e01ac904ec26616be8c2a61febe Signatures:    391

-------------------------------------------------------------------------------- 0             0x0             ELF, 32-bit LSB executable, ARM, version
1 (SYSV) 1695018       0x19DD2A        Unix path: /usr/bin/P1006.dl >
/dev/lp%d 1695210       0x19DDEA        Unix path: /var/tmp/fw.bin
1734878       0x1A78DE        Unix path: /var/tmp/httplog.txt 1736358 
0x1A7EA6        Neighborly text, "neighbor_list" 1740704      
0x1A8FA0        Neighborly text, "neighbor list fail!%d, vap 0
%d,radio 1 %d, vap 1 %d" 1740905       0x1A9069        Unix path:
/var/tmp/mt7615e.dat 1745115       0x1AA0DB        Unix path:
/var/tmp/SingleSKU_%2s.dat 1745897       0x1AA3E9        Unix path:
/etc/wireless/mt7603e/RT2860AP.dat 1766727       0x1AF547        Unix
path: /var/tmp/db_encrycopy.bin 1769128       0x1AFEA8        Unix
path: /var/tmp/dtdns.conf 1774284       0x1B12CC        Unix path:
/var/tmp/fwurl_dns.oper 1774472       0x1B1388        Unix path:
/var/tmp/wancid_realname_map.conf 1774546       0x1B13D2        Unix
path: /var/tmp/resolv.conf 1774937       0x1B1559        Unix path:
/var/tmp/dnsdebug_level.conf 1775961       0x1B1959        Unix path:
/var/tmp/fwurl_dns.conf 1777929       0x1B2109        Unix path:
/var/nmbd/lib/nmbd.conf 1796803       0x1B6AC3        Unix path:
/var/tmp/b.txt 1798668       0x1B720C        Unix path:
/var/tmp/ftpuserinfo.log 1799222       0x1B7436        Unix path:
/var/tmp/testftpret 1799538       0x1B7572        Unix path:
/var/tmp/testFtpStausFile 1801512       0x1B7D28        Unix path:
/var/tmp/testFtpResultFile 1836646       0x1C0666        Unix path:
/var/tmp/igmp_proxy 1851733       0x1C4155        Unix path:
/var/tmp/ping%s.conf 1869744       0x1C87B0        Unix path:
/var/tmp/route_err.tmp 1874100       0x1C98B4        Unix path:
/var/iproute2/rt_tables 1877888       0x1CA780        Unix path:
/var/iproute2/wan_mark_map.conf 1877939       0x1CA7B3        Unix
path: /var/iproute2/wan_mark_map.conf) error. 1882439       0x1CB947  
Unix path: /var/samba/lib/smb.conf 1883709       0x1CBE3D        Unix
path: /var/samba/var/smbpasswd 1884563       0x1CC193        Unix
path: /var/samba/lib 1884639       0x1CC1DF        Unix path:
/var/samba/lib/lmhosts 1884934       0x1CC306        Unix path:
/var/run/smbd.pid 1896994       0x1CF222        Unix path:
/var/tmp/diaggetres 1897300       0x1CF354        Unix path:
/var/tmp/diagputres 1898321       0x1CF751        Unix path:
/var/tmp/tracerouteret 1899280       0x1CFB10        Unix path:
/var/tmp/traceroute.tmp 1910292       0x1D2614        Unix path:
/var/tmp/upgradeTmpFile 1912864       0x1D3020        Unix path:
1917855       0x1D439F        Unix path:
/etc/hardcodefile/dataprotocol 1924083       0x1D5BF3        Unix
path: /var/tmp/ppp/options.oe%d 1926054       0x1D63A6        Unix
path: /var/tmp/ppp/process.tmp 1928127       0x1D6BBF        Unix
path: /var/tmp/ppp 1929575       0x1D7167        Unix path:
1931643       0x1D797B        Unix path:
1934553       0x1D84D9        Neighborly text,
"neighbor_listan_multiap_get_sta_status" 1934699       0x1D856B       
Unix path:
1935018       0x1D86AA        Neighborly text, "neighbor_list
error!_multiap_stastat error!" 1945950       0x1DB15E        Unix
path: /var/tmp/special_resolv.conf 1981810       0x1E3D72        Unix
1984101       0x1E4665        Unix path:
/home/duanyuanyuan/wk_use/wangkai/Builds_/ZXHN_ZY279128-f680v6.0/csp/packages/scripts/../wlan/csp/cspd/source/wlan_diagnose.c 1986051       0x1E4E03        Unix path:
1992252       0x1E663C        SHA256 hash constants, little endian
1993566       0x1E6B5E        Unix path: /var/tmp/unsign-cfg 1995800  
0x1E7418        Unix path: /var/tmp/db_src_ 1996202       0x1E75AA    
Unix path: /var/tmp/db_backup_cfg.bin 1998469       0x1E7E85       
Unix path: /var/tmp/db_reload_cfg.xml 1998869       0x1E8015       
Unix path: /var/tmp/db_user_cfg.bin 1999215       0x1E816F        Unix
path: /var/tmp/db_backup_cfg.xml 1999265       0x1E81A1        Unix
path: /var/tmp/db_Decry_cfg.xml 1999375       0x1E820F        Unix
path: /var/tmp/sign-cfg 1999810       0x1E83C2        Unix path:
/var/tmp/unsign_cfg.bin 2000224       0x1E8560        Unix path:
/var/tmp/unversion_cfg.bin 2027276       0x1EEF0C        Digi
International firmware, load address: 0x00494D53, entry point:
0x54797065, 2027715       0x1EF0C3        Digi International firmware,
load address: 0x4C494451, entry point: 0x44696769, 2027728      
0x1EF0D0        Digi International firmware, load address: 0x00534C49,
entry point: 0x6461696C, 2027743       0x1EF0DF        Digi
International firmware, load address: 0x69740044, entry point:
0x6F6E6546, 2030630       0x1EFC26        Unix path:
/etc/hardcodefile/wlan 2034963       0x1F0D13        Unix path:
/etc/hardcodefile/tr069 2041395       0x1F2633        Unix path:
2049880       0x1F4758        Copyright string: "Copyright 1995-2017
Jean-loup Gailly and Mark Adler " 2052760       0x1F5298        CRC32
polynomial table, little endian 2056856       0x1F6298        CRC32
polynomial table, big endian 2063896       0x1F7E18        Copyright
string: "Copyright 1995-2017 Mark Adler " 2064920       0x1F8218      
Unix path: /etc/hardcodefile/webpri 2065414       0x1F8406        Unix
path: /etc/hardcodefile/oss 2073800       0x1FA4C8        Unix path:
/var/tmp/Tr069ClearEnvflag 2112546       0x203C22        Unix path:
2442360       0x254478        Neighborly text, "neighbor_list" 2534577
0x26ACB1        Neighborly text, "neighbor_listnewSend"
  • Why do you think, that xml is encrypted by AES? Do you know that xml can be stored in compiled representation (for example in android apk files)? Did you try to decompile it?
    – strannyi
    Oct 20 at 3:42
  • Have used RouterPassView to decrypt configs of ZTE modems. May work for you.
    – 0xec
    Oct 20 at 10:37
  • hi , thanks for replies guys, i have not decompiled it yet.. i tried to binwalk on it.. but was not found, i tried disassembler.io online but without success also.. i have not tried RouterPassView yet.. will try next.. Oct 20 at 13:14
  • Well i guess RouterPassView will not work, my antivirus detecting it as a virus... will keep trying options available. Oct 20 at 13:17
  • @strannyi because the ZTE manufacturer uses AES CBC encryption on this same router model.. for encrypting the backup config.bin generated on the ONT fiber device which we store on PC, there is a f608.py script already that decrypts this using AES key stored on the CSPD file.. the same one i tried to unpack via binwalk, and will now try to disassemble with idapro.. after decryption of config.bin it outputs a output.xml file decrypted with all configs from ONT device.. but inside jffs2 there are other custom xml files for different companies isp.. this ones in format xml, but still ciphered. Oct 20 at 13:21


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.