I also share my matlab version of the QEMU keygen of the VMG8825 (without actually giving the algos for the admin and supervisor passwords.) I know there are a few people that are attempting to reverse all those different algorithms and I'll be happy to provide hints of any of the functions they don't have working correctly.
Code:
function qemu(sn);
if nargin<1
sn='S123Y12341234';
end
serial_value=str2num(sn(2:3)); % perhaps year code of the SN?
disp(['Old algo super ............ ' old_algo_super(sn)]);
disp(' ');
disp(['New algo super ............ ' new_algo_super(sn)]);
disp(' ');
disp(['Old algo admin zyxel 1 .... ' old_admin_zyxel_password(sn,1)]);
disp(['Old algo admin zyxel 2 .... ' old_admin_zyxel_password(sn,2)]);
disp(['Old algo admin zyxel 3 .... ' old_admin_zyxel_password(sn,3)]);
disp(' ');
if serial_value>=19
disp(['New algo admin zyxel 1 .... ' new_algo_admin(sn)]);
disp(['New algo admin zyxel 2 .... ' new_algo_admin_2(sn,8)]);
else
disp(['New algo admin zyxel 1 .... ' old_admin_zyxel_password(sn,1,8)]);
disp(['New algo admin zyxel 2 .... ' old_admin_zyxel_password(sn,2,8)]);
end
disp(' ');
disp(['Old algo admin wind 2 ..... ' old_admin_zyxel_password(sn,2,10)]);
disp(['Old algo admin wind 1 ..... ' old_admin_zyxel_password(sn,1,10)]);
disp(' ');
if serial_value>=19
disp(['New algo admin zyxel 2 .... ' new_algo_admin_2(sn,10)]);
disp(['New algo admin zyxel 1 .... ' new_algo_admin(sn,10)]);
else
disp(['New algo admin zyxel 2 .... ' old_admin_zyxel_password(sn,2,10)]);
disp(['New algo admin zyxel 1 .... ' old_admin_zyxel_password(sn,1,10)]);
end
%disp(['New algo admin zyxel 1 ' new_algo_admin(sn)]);
