Nokia G-1425G-B Backup Decryption Tool

pip install pycryptodome

python Nokia_G-1425G-B_Backup_Decryption_Tool.py -u config.cfg

import io
import sys
import zlib
import struct
import base64
import binascii
import datetime
import hashlib
import secrets

bigEndian = True
encryptedCfg = False

def u32(val):
    return struct.unpack(">I" if bigEndian else "<I", val)[0]

def p32(val):
    return struct.pack(">I" if bigEndian else "<I", val)

def checkEndian(cfg):
    if cfg[0:4] == b"\x00\x12\x31\x23":
        return True
    elif cfg[0:4] == b"\x23\x31\x12\x00":
        return False
    else:
        return None

class RouterCrypto:
    def __init__(self):
        from Crypto.Cipher import AES
        key = "3D A3 73 D7 DC 82 2E 2A 47 0D EC 37 89 6E 80 D7 2C 49 B3 16 29 DD C9 97 35 4B 84 03 91 77 9E A4"
        iv = "D0 E6 DC CD A7 4A 00 DF 76 0F C0 85 11 CB 05 EA"
        self.cipher = AES.new(
            bytes(bytearray.fromhex(key)), AES.MODE_CBC, bytes(bytearray.fromhex(iv))
        )

    def decrypt(self, data):
        output = self.cipher.decrypt(data)
        padLen = ord(output[-1:])
        if padLen <= 0 or padLen > 16:
            return None
        padBytes = output[-padLen:]
        validPad = all(padByte == padLen for padByte in padBytes)
        if validPad:
            return output[:-padLen]
        else:
            return None

    def encrypt(self, data):
        padNum = 16 - (len(data) % 16)
        data += chr(padNum).encode() * padNum
        return self.cipher.encrypt(data)

class PKCSPassCrypto(RouterCrypto):
    def __init__(self, pkcsPass, pkcsSalt):
        from Crypto.Cipher import AES
        from hashlib import pbkdf2_hmac
        keyLen = 32
        ivLen = 16
        if not isinstance(pkcsPass, bytes):
            pkcsPass = pkcsPass.encode()

        pkcs = pbkdf2_hmac("sha256", pkcsPass, pkcsSalt, 10, dklen=keyLen + ivLen)
        keyBytes = pkcs[:keyLen]
        ivBytes = pkcs[keyLen:]
        self.cipher = AES.new(keyBytes, AES.MODE_CBC, ivBytes)

pkcsPasswords = ["S23l7nZm47XyMGs6y6oJpN9CR4nbfIZHJ4VRwp7HcdV6o2YvUmeNYFlz08Otwz78"]

if len(sys.argv) == 3 and sys.argv[1] == "-u":
    cf = open(sys.argv[2], "rb")
    cfgData = cf.read()
    bigEndian = checkEndian(cfgData)
    if bigEndian is None:
        decrypted = None
        try:
            decrypted = RouterCrypto().decrypt(cfgData)
            bigEndian = checkEndian(decrypted)
        except ValueError:
            pass

        if bigEndian is None:
            print("[ERROR] Invalid configuration file/magic detected. Exiting..."); exit()

        print("[INFO] Encrypted configuration detected.")
        cfgData = decrypted
        encryptedCfg = True

    if bigEndian:
        print("[INFO] Big-endian CPU detected.")
    else:
        print("[INFO] Little-endian CPU detected.")

    dataSize = u32(cfgData[0x04:0x08])
    largeHeader = False
    if dataSize == 0:
        dataSize = u32(cfgData[0x08:0x0C])
        largeHeader = True

    if dataSize == 0:
        print("[ERROR] Configuration data size is zero! Exiting..."); exit()

    fwMagic = 0
    if largeHeader:
        fwMagic = u32(cfgData[0x20:0x24])
    else:
        fwMagic = u32(cfgData[0x10:0x14])
    print(f"[INFO] Firmware magic value = {hex(fwMagic)}")

    compressed = []
    if largeHeader:
        compressed = cfgData[0x28 : 0x28 + dataSize]
    else:
        compressed = cfgData[0x14 : 0x14 + dataSize]

    checksum = 0
    if largeHeader:
        checksum = u32(cfgData[0x10:0x14])
    else:
        checksum = u32(cfgData[0x08:0x0C])

    if binascii.crc32(compressed) & 0xFFFFFFFF != checksum:
        print("[ERROR] CRC32 checksum validation failed. Exiting..."); exit()

    uncompSize = 0
    if largeHeader:
        uncompSize = u32(cfgData[0x18:0x1C])
    else:
        uncompSize = u32(cfgData[0x0C:0x10])

    xmlData = None
    try:
        xmlData = zlib.decompress(compressed)
        pkcsPass = None
    except zlib.error:
        encData = None
        pkcsSalt = None
        tryPasswords = []
        if compressed[0] == 0xFF:
            tryPasswords = pkcsPasswords
            with io.BytesIO(compressed) as payload:
                payload.seek(1)
                pkcsSalt = payload.read(8)
                encData = payload.read()

        for currPass in tryPasswords:
            decryptor = PKCSPassCrypto(currPass, pkcsSalt)
            compressed = decryptor.decrypt(encData)
            if compressed is None:
                continue

            try:
                xmlData = zlib.decompress(compressed)
                pkcsPass = currPass
            except zlib.error:
                pass

        if xmlData is None:
            if len(tryPasswords):
                print("[ERROR] All known encryption passwords exhausted."); exit()
            else:
                raise

    if len(xmlData) != uncompSize:
        print("[WARNING] Uncompressed size does not match the header value!")

    outFilename = f"config-{datetime.datetime.now().strftime('%d%m%Y-%H%M%S')}.xml"
    if xmlData[0] != ord("<"):
        outFilename = outFilename.replace(".xml", ".ini")

    with open(outFilename, "wb") as of:
        of.write(xmlData)
    print(f"[INFO] Unpacked successfully as: {outFilename}")
   
    recompInfo = f"-{'pb' if bigEndian else 'pl'}"
    if largeHeader:
        recompInfo += "64"
    if encryptedCfg or pkcsPass:
        recompInfo += "e"
        if pkcsPass:
            recompInfo += pkcsPass
    cf.close()

elif len(sys.argv) == 4 and (sys.argv[1][:3] == "-pb" or sys.argv[1][:3] == "-pl"):
    try:
        fwMagic = int(sys.argv[3], 16)
        p32(fwMagic)
    except ValueError:
        print("[ERROR] Invalid magic value specified. Please provide a valid 32-bit hex value."); exit()

    bigEndian = sys.argv[1][:3] == "-pb"
    largeHeader = sys.argv[1][3:5] == "64"
    encryptedCfg = False
    paramLen = 3 + (2 if largeHeader else 0)
    if len(sys.argv[1]) > paramLen and sys.argv[1][paramLen] == "e":
        encryptedCfg = True
        paramLen += 1

    pkcsPass = None
    if encryptedCfg and len(sys.argv[1]) > paramLen:
        pkcsPass = sys.argv[1][paramLen:]
        encryptedCfg = False

    outFilename = f"config-{datetime.datetime.now().strftime('%d%m%Y-%H%M%S')}.cfg"
    with open(sys.argv[2], "rb") as xf:
        xmlData = xf.read()

    compressed = zlib.compress(xmlData)
    extraDecompLen = 1 if pkcsPass else 0
    if pkcsPass:
        with io.BytesIO() as payload:
            payload.write(b"\xFF")
            pkcsSalt = secrets.token_bytes(8)
            payload.write(pkcsSalt)
            cryptor = PKCSPassCrypto(pkcsPass, pkcsSalt)
            payload.write(cryptor.encrypt(compressed))
            compressed = payload.getvalue()

    cfgData = p32(0x123123) + p32(0) if largeHeader else p32(len(compressed))
    cfgData += p32(binascii.crc32(compressed) & 0xFFFFFFFF)
    cfgData += p32(len(xmlData) + extraDecompLen)
    cfgData += p32(fwMagic) + (p32(0) if largeHeader else b"")
    cfgData += compressed

    if encryptedCfg:
        cfgData = RouterCrypto().encrypt(cfgData)

    with open(outFilename, "wb") as of:
        of.write(cfgData)

    print(f"[INFO] Packed successfully as: {outFilename}")

elif len(sys.argv) == 3 and (sys.argv[1] == "-d" or sys.argv[1] == "-e"):
    decryptMode = sys.argv[1] == "-d"
    if decryptMode:
        print(f"[INFO] Decrypted output:\n{RouterCrypto().decrypt(base64.b64decode(sys.argv[2])).decode('UTF-8')}")
    else:
        print(f"[INFO] Encrypted output:\n{base64.b64encode(RouterCrypto().encrypt(sys.argv[2].encode())).decode('UTF-8')}")