Here's my stab at the reverse, it doesn't work, so doesn't break any rules HAHAHA
It's either taking the MAC or the IMEI as the input, depending on the password type requested.
The type also defines the order of the parts in the charset, upper first, or numbers first etc.
It can also pull the charset from NVRAM in a new twist. So if the default characters are for example in that region of the world not good, in can specify it's own.
Note the depressing sounding salts. Although that's probably lost in translation. "It'll be better tomorrow...." (It's not good today)
Upstream of the algo there is an example seed of 6 numbers separated by colons (1:81:11:11:21:21). Could be the mac, no idea if it is upper or lower case hex, or a decimal representation.
Lastly I'll attach a picture that includes the MAC as well as the IMEI if you want to experiment with the format of the MAC.
Code:
function pwd=zte_mf293n(mac);
numbers='2345678';
uppers='ABCDEFGHJKLMNPQRSTUVWXYZ';
lowers='abcdefghjkmnprstuvwxyz';
symbols='!@#%^()-_=+./?{}~';
salt1='ZTE''s future';
salt2='will be better!';
for n=1:6,
mac_bytes{n}=upper(mac(n*2-1:n*2));
end
mac_string=mac_bytes{1};
for n=2:6,
mac_string=[mac_string ':' mac_bytes{n}];
end
imei='863397051153050';
input_string1=[mac salt1];
input_string2=[mac salt2];
digest1=hasher(input_string1,'MD5');
digest2=hasher(input_string2,'MD5');
digest_sum=sum([digest1 digest2]);
charset=[numbers uppers lowers]; %which order?????
cs_len=length(charset);
pwd='';
for n=1:16,
pwd(n)=charset(1+mod(double(digest1(n))+digest_sum,cs_len));
end
