Unlocking Zyxel (Mediatek) Uboot

For Developers
1

I'm trying to unlock VMG8623-T50B, currently im locked out after pin hole reset so im trying to find the password to unlock additional commands.

Problem is that all available applications/scipts etc are expecting a SEED which has 12 chars length and mine has 36.

ZHAL> ?
ATEN    x[,y]         set BootExtension Debug Flag (y=password)
ATSE    x             show the seed of password generator
ATDC                  disable check model mechanism
ATSH                  dump manufacturer related data in ROM
ATRT    [x,y,z,u]     RAM read/write test (x=level, y=start addr, z=end addr, u=iterations)
ATGO                  boot up whole system
ATSR    [x]           system reboot
ATUR    x[,y]         upgrade RAS image (filename, partition number)


ZHAL> ATSH
Firmware Version       : V5.50(ABPM.2)C0
Bootbase Version       : V1.47 | 11/19/2021 18:51:46
Vendor Name            : Zyxel Communications Corp.
Product Model          : VMG8623-T50B
Serial Number          : S220Y29040717
First MAC Address      : F08756A12345
Last MAC Address       : F08756A12345
MAC Address Quantity   : 16
Default Country Code   : 00
Boot Module Debug Flag : 00
RootFS      Checksum   : 0424bfe9
Kernel      Checksum   : 9e335dee
Main Feature Bits      : 00
Other Feature Bits     :
8402e5a0: 04050f0d 00000100 00000000 00000000
8402e5b0: 00000000 00000000 00000000


ZHAL> ATSE VMG8623-T50B
2F02000809702519600A04100887DD192702


ZHAL> ATEN 1,1130A563
password is incorrect
2

Did you try without seed? On my GS1920, the password is more-or-less static if I do not run ATSE. That's not Mediatek, of course ...
See here: http://www.ixo.de/info/zyxel_uclinux/

3

i tried, it asks for ATSE first

ZHAL> ATEN 1,10F0A563
please run atse first
4

Does ATGU work?

5

No, only the commands in the first post are working

6

@Spyros Did you find a solution to this? I have the same problem. The seed is much longer than usual, like here: https://github.com/chear/SWNote/blob/master/ZyXEL.md.

7

Looks like the perfect website is down:

8

It's a locally hosted web page, so it was never public. I linked it here to illustrate what I was (and still am) looking for.

9

Same issue here. Need a generator with 36-digit seed number as input and 30-digit password as output. Any new findings so far by anyone?