How to compute the password to unlock the protected debug-mode AT-commands of a Zyxel Prestige 941 Cable Modem/Router

Symtom: Some of the debug-mode commands (boot commands) of the Zyxel P941 do not work. The response is always "ERROR".

Hardware: Zyxel Prestige 941 cable router.
Note: Some other Zyxel Prestige modems/routers (e.g. 642 and 650) use the same password algorithm.

Software: Zyxel-Firmware: Bootbase version V1.6.

Cause: Some of the debug-mode AT-commands are protected and must be enabled using a randomly generated password.

Solution: Use the "ATSE" command to display the seed of the password generator. Compute the password and enter the password with the command "ATEN 1,password". After that, "ATHE" (help) will include the protected commands in the list.

The following formula can be used to compute the password:

a = first 3 bytes of seed value
b = a + 0x10F0A563
c = (last byte of seed value) AND 7
password = (b ROR c)  XOR a

Note: ROR is a 32-bit rotate-right operation.

I don't publish the source code or a program to compute the password, because the protected debug-mode AT commands of the Router should be used by experts only.

Author: Christian d'Heureuse (chdh@inventec.ch, www.source-code.biz)
Index