DX5401 ATEN/ATSE

lexyz5401

Hi all!

I'm trying to make some changes to the bootloader of the DX5401-B0, but I cannot set the debug flag to 1.
When I type ATSE DX5401_B0, it gives me this code: 2501000E090013009C030490330691452269
Which code can I use to run ATEN 1 command and enable debug mode?

Thank you for your help!

rb1963

@lexyz5401

What firmware version you have?
Is it a custoim firmware (customzied by ISP) or a stock firmware?
Where did you take this firmware?

Are you trying to acecss via serialconsole?
Thanks.

lexyz5401

@rb1963 Thanks for your reply! This is an ISP customized firmware, but I've seen this algorithm with stock firmware as well, also in other recent devices such as VMG8825-T50, WX5600 and EX5601. I don't think the algorithm is different across ISPs. I'm indeed trying to access via serial console.

This question is over a year old, but I haven't found the answer yet. All help is appreciated!

tonygibbs16

Hello @lexyz5401

I think that https://forum.kitz.co.uk/index.php?topic=13939.30 at the Kitz forum might have some information to help you.

The ATEN 1 command needs a password with it, that is generated from the output of the ATSE command.

Kind regards,

Tony.

lexyz5401

Hi @tonygibbs16,

Thanks for your reply! Unfortunately, the router used there uses the old algorithm which provides a 12 character seed. I followed the steps anyway, but no luck. The procedure is probably the same, but the password generator doesn't work with the 36 character seed the ATEN 1 command gives me.

I hope someone manages to crack the code.

tonygibbs16

Hello @lexyz5401

You're welcome.

Maybe the decoder linked from https://th0mas.nl/2020/03/26/getting-root-on-a-zyxel-vmg8825-t50-router/#tangent-1-the-_encrypt_-algorithm will help.

Kind regards,

Tony

lexyz5401

@tonygibbs16 I found this website a while ago and it was very helpful getting root access, but it doesn't unlock the bootloader. However, he might be able to help out so I'll try to contact him. If I gain access, I'll let you know.