>> Decryption for ZTE H188A/H288A << ✔✔

Question

>> Decryption for ZTE H188A/H288A << ✔✔

HeXGmR opened this issue 2 years ago · 139 comments

HeXGmR commented 2 years ago

#Request

Hello :)

Can someone decrypt config file for ZTE H288A router

will be much appreciated
:)
config.zip

"I can help with SPI full flash firmware file if needed"

Answer 1 · 2022-10-20T21:13:42.000Z

Here's another one:
config.zip
Firmware: Wind

And another one:
config.zip
Firmware: Nova zxhnh288a_hv11_fv110_gr51t16_firmware.bin

Answer 2 · 2022-10-29T13:19:16.000Z

And another one: config.zip Firmware: Nova zxhnh288a_hv11_fv110_gr51t16_firmware.bin

the admin password for the linked firmware is user: forthnet pass: F0rth@c$n3t#
unfortunately this firmware encrypts the backed-up configs using a key derived from all possible device-specific infos, like mac + serial + longPassword (that can only be found in /var/tagparam.bin or by dumping full flash).
if you have a full flash dump and want to privately send it to me I can verify this and add support,
to confirm this is the method being used, you can try a config backed up from this firmware, and trying to restore to different unit of same model and firmware, it should reject it.

Answer 3 · 2022-10-29T13:56:41.000Z

Here's another one: config.zip Firmware: Wind

This one can be decrypted with latest master and using python3 examples/decode.py --signature H288A config.bin config.xml

Answer 4 · 2022-10-29T22:42:25.000Z

@rajkosto
sent you an e-mail.

Answer 5 · 2022-10-31T09:39:53.000Z

Bootloader password for H188A/H288A is Boot47516!

Answer 6 · 2022-11-01T10:15:31.000Z

Here's another one: config.zip Firmware: Wind

This one can be decrypted with latest master and using python3 examples/decode.py --signature H288A config.bin config.xml

I have the same firmware, but my config.bin cannot be decrypted. I tested the posted config and decrypts succesfully.

Do we have any solution to this? Also what we can do with the bootloader password?

Answer 7 · 2022-11-01T10:18:35.000Z

the config.zip that decrypts (from WIND firmware) is not from the firmware linked in that post (NOVA firmware).
that firmware has the complicated keygen i explained already. if you are using the linked firmware the solution is to dump your flash to get the tagparams (which is probably outside the scope of a normal user) and then supply all those params to the decode script after #53 is merged.
the bootloader can be used to reflash firmwares and some other things, if you have a UART to usb converter attached during boot

Answer 8 · 2022-11-01T13:55:02.000Z

the config.zip that decrypts (from WIND firmware) is not from the firmware linked in that post (NOVA firmware). that firmware has the complicated keygen i explained already. if you are using the linked firmware the solution is to dump your flash to get the tagparams (which is probably outside the scope of a normal user) and then supply all those params to the decode script after #53 is merged. the bootloader can be used to reflash firmwares and some other things, if you have a UART to usb converter attached during boot

I hope the user who sent you the full dump, helps you add support for this!!!

Can you extract the files from firmware and upload?

Answer 9 · 2022-11-02T22:00:27.000Z

anyone else stuck on the linked t16 NOVA firmware and REALLY wanting to encrypt/decrypt their config without a full flash dump can do this:
solder on a UART header like so https://images.sshnuke.net/2022-11-05_02-02-51_DuheYggJG.jpg
install Tera Term if on windows for a good serial client that has all the required features https://osdn.net/projects/ttssh2/releases/
use a usb to uart or similar device, note down its COM port, set the Tera Term serial options to be 115200 baud rate https://images.sshnuke.net/2022-11-02_23-02-01_Mp18NF1qi.png
during router power-on, you should see a bootloader prompt asking you to hit 1 to enter "boot" mode, enter 1 then
enter the bootloader password to get to the Bldr> prompt
enter xmdm 83FBC5C8 D4 in the prompt, hit enter
when the C characters start appearing, go to File->Transfer->XMODEM->Send in Tera term, and pick this file: https://files.sshnuke.net/83FBC5C8_dsaverifyfunc_ret0.bin
after it's uploaded the prompt will say "received error", this is normal, it always says this after a XMODEM upload
now connect an ethernet cable to any port on the router, set the ip to static 192.168.1.x/255.255.255.0 on your computer, and go to http://192.168.1.254 in firefox and upload the .bin file inside this archive: https://files.sshnuke.net/t16mod_fwupgrsignaes.7z (keep in mind doing a firmware flash via the bootloader will RESET your router to FACTORY defaults)
you should see messages like the following in your terminal:

START TO RECEIVE the FILE
...............................................................................................................................................
START TO CLOSE the FILE
Received file:
rcvdata_size = 14172912
start = 0x80020000

==>xpan...Find DSA
file: ../cspboot/verify_sign/blcm_dsa_verify_type.c function: dsa_verify  line: 349 error! answer = 0
Erasing flash:from a0000,len 3200000...

Writing csp kernel mem:80020000 to flash:0x01aa0000, len = 0x400000

Writing csp jffs mem:80420000 to flash:0x00aa0000, len = 0x9842f0

*** CSP Image flash done *** !
Failed to send response after firmware upload

after this the router will reboot and you will be in my custom version of the t16 nova firmware that has STANDARD signature-based config encryption (and also it has DSA signature checks removed on firmware upgrade, so you don't have to go through the bootloader patching procedure to flash modified firmwares anymore, can just do it from the webgui),
on this modified firmware, you can decrypt the config after backing it up like so:
python3 examples/decode.py config.bin config.xml
and then restore it after changing it and re-encrypting it like so:
python3 examples/encode.py --signature "H288A" --use-signature-encryption config.xml config_new.bin
to enable ssh you would change the config's SSH_Enable variable to 1 and SSH_ProcType to 0 (so it starts busybox instead of cliagent) and SSH_Level to 1 (so your ssh session runs as root)
once you have ssh, you can backup your flash by plugging in a usb stick into the router, typing mount to see what folder it ended up being (if it didnt mount, just mkdir /mnt/usb && mount /dev/sda1 /mnt/usb && cd /mnt/usb), cd-ing to that folder, and then doing cat /dev/mtd0 > mtd0.bin. now you have your tagparams (and every other) partition in case you need it (the file size of mtd0.bin should be 128MB) :)

Answer 10 · 2022-11-10T19:02:12.000Z

forget all that bootloader nonsense, i found out how to make a firmware flashable the easy way
just upload this (after extraction, of course) https://files.sshnuke.net/t16mod_signaes_newdefaults.7z using the firmware webgui
after the flash, the logo should change and the configs backed-up/restored should be easily decodable/encodeable using the basic commands
python3 examples/decode.py config.bin config.xml and
python3 examples/encode.py --signature H288A config.xml config2.bin

also, if you reset to factory defaults on this firmware:
the default webgui credentials will be admin/admin and ask you to change pass on login (user account is still there too)
ssh will be enabled with credentials root/admin and you will be put into a root busybox shell (so you can backup mtd)
telnet will be enabled with the default root/public user/pass and standard enable command with zte pass allows you to access the configuration

Answer 11 · 2022-12-04T08:53:49.000Z

Any fun with H288A V1.1.0_GR5.1T17 ? (Nova)

Answer 12 · 2022-12-04T09:16:01.000Z

Any fun with H288A V1.1.0_GR5.1T17 ? (Nova)

Do you got the update file .bin for T17 ?

Answer 13 · 2022-12-04T10:47:57.000Z

Any fun with H288A V1.1.0_GR5.1T17 ? (Nova)

Do you got the update file .bin for T17 ?

I only have the "config.bin" backup from it. Not the actual firmware.

Answer 14 · 2022-12-05T14:26:03.000Z

@HeXGmR https://github.com/MariosK239/Gr_ISP_Router_Firmware/tree/main/Nova/ZTE_ZXHN_H288A
This isnt it?

edit: my mistake! You said T17..

Answer 15 · 2022-12-08T21:35:28.000Z

Anybody who manage to get the admin's login ?

Answer 16 · 2022-12-08T23:43:51.000Z

Anybody who manage to get the admin's login ?

Same question, I have only user with limit access so I can't backup config file.

Answer 17 · 2022-12-09T11:20:03.000Z

Anybody who manage to get the admin's login ?

Same question, I have only user with limit access so I can't backup config file.
backup config seems to work on my NOVA thingy?!

Answer 18 · 2022-12-17T14:27:44.000Z

@varoudis
Hello can you send me a special login for this version to try it
zxhnh288a_hv11_fv110_gr51t14_firmware.bin

Answer 19 · 2022-12-21T17:57:25.000Z

Latest config.bin from Nova T17 version. Nothing seems to work. We need the new "root" pass...
config.zip

Answer 20 · 2022-12-21T19:11:46.000Z

firmware zte h288a t17

Answer 21 · 2023-03-18T04:35:35.000Z

So what, every time your ISP releases a new firmware and changes the admin pass to spite you users, you want me to trawl through and decrypt the firmware to get it out ? Here's the user credentials from zxhnh288a_hv11_fv110_gr51t17_firmware.zip:

<Tbl name="DevAuthInfo" RowCount="6">
<Row No="0">
<DM name="Enable" val="1"/>
<DM name="User" val="Nova_admin"/>
<DM name="Pass" val="dxEh-eNc.Lk7"/>
<DM name="ChgPwd" val="0"/>
</Row>
<Row No="1">
<DM name="Enable" val="1"/>
<DM name="User" val="user"/>
<DM name="Pass" val=""/>
</Row>

Answer 22 · 2023-03-18T17:00:09.000Z

Hello
I got the mtd0.bin from my router but I can't read it to get my user and password. please help me decrypt it. THANKS

Answer 23 · 2023-04-06T11:18:13.000Z

hello, can we finally expect a firmware for h188a and escape from isps? i have h188a, lmk if i can help.
i heard that h288a work fine on h188a but i dont wanna break something because there is no way back.

Answer 24 · 2023-04-06T11:29:11.000Z

do you have the same device? h188a?

a lot of people on yt sharing an open firmware for it, the only issue now for me is that i dont trust them

Answer 25 · 2023-04-06T11:38:02.000Z

this isnt how it works, in egypt we have 3 shit isps that provide only locked routers, i have got other firmware for other routers and they work, one from an isp called 3bb, and one was from huawei, probably they got leaked or someone was able to back it up and simply we can apply it over the same model. usually you do this for privacy reasons and mainly for egyptians, each router from each isp cant work on any other isp so they do this to make the router basically work on all isps.

actual zte firmware isnt provided by any isp, the isps here use their own firmware to do their nasty stuff. so no way to get it.

Answer 26 · 2023-04-06T11:44:00.000Z

sure, may i ask why?

Answer 27 · 2023-04-06T11:47:30.000Z

a lot of people do it. i should delete them and maybe share the firmware here?

Answer 28 · 2023-04-18T01:26:09.000Z

Hi Egyptian here:
I have ZTE H188A model and installed Nova firmware: here

This should work for Egyptian routers provided by any ISP with the same model_

I downloaded the latest version v7 for H288A firmware for my H188A from here

After that, you'll need to ask your ISP for your username and password.

Login with your default username and password on back of your router. if you're using zxhnh288a_hv11_fv110_gr51t17_firmware.bin

Now you'll log in to your router page > Internet > WAN > DSL tap > DSL Connection and

disable everything except Internet2_VDSL ( VDSL VPU ).
for the Service List keep INTERNET and TR069 only checked and uncheck the rest.
add the username and password you got from your ISP.
set VLAN to off
and now everything should be working.

screenshot from the DSL configuration:

Caution:

This firmware can only support one SSID network for 2.4 GH and one SSID for 5GH networks. so you'll have 2 networks instead of 8 in total
- if someone can solve this, please share what you reached to.

NOTE:

I started this process keeping in mind that I might lose my router and get a new one while it's already new.
The main reason I did that, was that I couldn't change my DNS from the routers page but I have to contact the support to do so for me.
The technical support has access to my router page and all the configurations and devices and has more options over what I can do with my router.

I want to Thank you for the firmware.

Answer 29 · 2023-05-10T20:56:13.000Z

I will use this framware zxhnh288a_hv11_fv110_gr51t17_firmware.bin and i cant login with default user name and password in router get way, please help me to login😢

Answer 30 · 2023-05-11T14:19:57.000Z

does using custom frimware for 188a on we egypt have any pros?

Answer 31 · 2023-05-11T15:48:25.000Z

Yap can config in eny isp

…

On Thu, May 11, 2023, 5:20 PM Ahmed Tohamy ***@***.***> wrote: does using custom frimware for 188a on we egypt have any pros? — Reply to this email directly, view it on GitHub <#43 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/A7X7JCH6AW63UNYVYZ33FN3XFTYRTANCNFSM5WR5UKVA> . You are receiving this because you commented.Message ID: ***@***.***>

Answer 32 · 2023-05-11T16:25:28.000Z

@khaled625 if you are talking about the login page for your router HTTP://192.168.1.1 then use the username and password on the back of your router.

or you might give this a try: user: forthnet pass: F0rth@c$n3t#

Answer 33 · 2023-05-11T17:28:08.000Z

Not working

…

On Thu, May 11, 2023, 7:25 PM Mustafa ***@***.***> wrote: @khaled625 <https://github.com/khaled625> if you are talking about the login page for your router HTTP://192.168.1.1 then use the username and password on the back of your router. — Reply to this email directly, view it on GitHub <#43 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/A7X7JCGYYJQ6V3PEAOKKDVTXFUHILANCNFSM5WR5UKVA> . You are receiving this because you were mentioned.Message ID: ***@***.***>

Answer 34 · 2023-05-11T17:28:42.000Z

I can open router getway admin and password not valid On Thu, May 11, 2023, 8:27 PM Khaled Aboud ***@***.***> wrote:

…

Not working On Thu, May 11, 2023, 7:25 PM Mustafa ***@***.***> wrote: > @khaled625 <https://github.com/khaled625> if you are talking about the > login page for your router HTTP://192.168.1.1 then use the username and > password on the back of your router. > > — > Reply to this email directly, view it on GitHub > <#43 (comment)>, > or unsubscribe > <https://github.com/notifications/unsubscribe-auth/A7X7JCGYYJQ6V3PEAOKKDVTXFUHILANCNFSM5WR5UKVA> > . > You are receiving this because you were mentioned.Message ID: > ***@***.***> >

Answer 35 · 2023-05-12T22:29:11.000Z

i have h188a V6 and it didnt accept ant firmware so can anyone help me to decode it or any firmware will work on it ?
config.zip

Answer 36 · 2023-05-30T20:44:01.000Z

hallo in die runde,
kann mir mal einer sagen, wie man das H288a im bringt Modus nutzen kann ich bekomme es einfach nicht hin. Also lan1 <> vdsl

Answer 37 · 2023-06-01T19:32:49.000Z

anyone else stuck on the linked t16 NOVA firmware and REALLY wanting to encrypt/decrypt their config without a full flash dump can do this: solder on a UART header like so https://images.sshnuke.net/2022-11-05_02-02-51_DuheYggJG.jpg install Tera Term if on windows for a good serial client that has all the required features https://osdn.net/projects/ttssh2/releases/ use a usb to uart or similar device, note down its COM port, set the Tera Term serial options to be 115200 baud rate https://images.sshnuke.net/2022-11-02_23-02-01_Mp18NF1qi.png during router power-on, you should see a bootloader prompt asking you to hit 1 to enter "boot" mode, enter 1 then enter the bootloader password to get to the Bldr> prompt enter xmdm 83FBC5C8 D4 in the prompt, hit enter when the C characters start appearing, go to File->Transfer->XMODEM->Send in Tera term, and pick this file: https://files.sshnuke.net/83FBC5C8_dsaverifyfunc_ret0.bin after it's uploaded the prompt will say "received error", this is normal, it always says this after a XMODEM upload now connect an ethernet cable to any port on the router, set the ip to static 192.168.1.x/255.255.255.0 on your computer, and go to http://192.168.1.254 in firefox and upload the .bin file inside this archive: https://files.sshnuke.net/t16mod_fwupgrsignaes.7z (keep in mind doing a firmware flash via the bootloader will RESET your router to FACTORY defaults) you should see messages like the following in your terminal:
START TO RECEIVE the FILE
...............................................................................................................................................
START TO CLOSE the FILE
Received file:
rcvdata_size = 14172912
start = 0x80020000

==>xpan...Find DSA
file: ../cspboot/verify_sign/blcm_dsa_verify_type.c function: dsa_verify  line: 349 error! answer = 0
Erasing flash:from a0000,len 3200000...

Writing csp kernel mem:80020000 to flash:0x01aa0000, len = 0x400000

Writing csp jffs mem:80420000 to flash:0x00aa0000, len = 0x9842f0

*** CSP Image flash done *** !
Failed to send response after firmware upload
after this the router will reboot and you will be in my custom version of the t16 nova firmware that has STANDARD signature-based config encryption (and also it has DSA signature checks removed on firmware upgrade, so you don't have to go through the bootloader patching procedure to flash modified firmwares anymore, can just do it from the webgui), on this modified firmware, you can decrypt the config after backing it up like so: python3 examples/decode.py config.bin config.xml and then restore it after changing it and re-encrypting it like so: python3 examples/encode.py --signature "H288A" --use-signature-encryption config.xml config_new.bin to enable ssh you would change the config's SSH_Enable variable to 1 and SSH_ProcType to 0 (so it starts busybox instead of cliagent) and SSH_Level to 1 (so your ssh session runs as root) once you have ssh, you can backup your flash by plugging in a usb stick into the router, typing mount to see what folder it ended up being (if it didnt mount, just mkdir /mnt/usb && mount /dev/sda1 /mnt/usb && cd /mnt/usb), cd-ing to that folder, and then doing cat /dev/mtd0 > mtd0.bin. now you have your tagparams (and every other) partition in case you need it (the file size of mtd0.bin should be 128MB) :)

Answer 38 · 2023-06-01T20:18:06.000Z

I ask you for help: I did everything according to rajkosto´s instruction to flash my ZTE H288A which I got from an Austrian ISP. While trying to upload the "t16mod_fwupgrsignaes.bin" via http://192.168.1.254 I get the error message "DSA verify failed !" (although uploading/sending "83FBC5C8_dsaverifyfunc_ret0.bin"-file with "xmdm 83FBC5C8 D4" > XMODEM was done).
The message in my "Tera Term"-terminal is the following:
...

bldr> xmdm 83FBC5C8 D4
CCCreceived error
bldr> START TO RECEIVE the FILE

START TO CLOSE the FILE
Received file:
rcvdata_size = 0
start = 0x80020000

Magic check erro!
START TO RECEIVE the FILE
................................................................................ ...
............................................................................................................................................................................................................................................................................................................................................
START TO CLOSE the FILE
Received file:
rcvdata_size = 14172880
start = 0x80020000

==>xpan...Find DSA
file: ../cspboot/verify_sign/blcm_dsa_verify_type.c function: dsa_verify line: 349 error! answer = 0
Verify err ret -1
DSA verify failed !
reset...

Failed to send response after firmware upload
BGA IC
Xtal:1
DDR3 init.
DRAMC init done.
Calculate size.
DRAM size=128MB
Set new TRFC.
ddr-1333

7516DRAMC V1.0 (0)
Press 'x' or 'b' key in 1 secs to enter or skip bootloader upgrade.
EN751627 at Wed Jul 8 16:45:26 CST 2020 version 1.1 free bootbase
board ip address:192.168.1.254
no_pci_found error case

*** Press 1 means entering boot mode***
*** Press 2 means entering testing mode***
*** Press 3 means entering norm mode***
..........................................................
==>xpan...Find DSA
Found image at 0x01aa0000
Found image at 0x01ea0000
==>
xpan...Find DSA
Get hardversion OK,bootPara.hardVersion = V1.1.0 !!!
****Try the second image...
bootpara-----> 0
decompress_addr 1ea0100 decompress_addr_end 22a0000
Decompress to 80002000 free_mem_ptr=80950000 free_mem_ptr_end=807B0000
75xx: 0x0
Uncompressing [LZMA] ... done.

Any solution proposals are greatly appreciated.

Answer 39 · 2023-06-05T07:12:33.000Z

hey all
can some one help me i am on [zxhnh288a_hv11_fv110_gr51t17_firmware.bin]
[New zxhn h288a firmware] and cannot find
the option convert WAN port to Ethernet , i need this option to connect from my ONU device Bridge to my router pleas if someone can help me >>>>>

Answer 40 · 2023-06-16T19:05:53.000Z

So what, every time your ISP releases a new firmware and changes the admin pass to spite you users, you want me to trawl through and decrypt the firmware to get it out ? Here's the user credentials from zxhnh288a_hv11_fv110_gr51t17_firmware.zip:
<Tbl name="DevAuthInfo" RowCount="6">
<Row No="0">
<DM name="Enable" val="1"/>
<DM name="User" val="Nova_admin"/>
<DM name="Pass" val="dxEh-eNc.Lk7"/>
<DM name="ChgPwd" val="0"/>
</Row>
<Row No="1">
<DM name="Enable" val="1"/>
<DM name="User" val="user"/>
<DM name="Pass" val=""/>
</Row>

really thankful you help me I tried them & finally my router open ,,,sorry about my English

Answer 41 · 2023-06-16T19:17:43.000Z

I will use this framware zxhnh288a_hv11_fv110_gr51t17_firmware.bin and i cant login with default user name and password in router get way, please help me to login😢

hi khaled625 i will help you----try---username ( Nova_admin ) & password ( dxEh-eNc.Lk7 )-- i tried and it work--you can contact me about mail if you have any questions

Answer 42 · 2023-06-16T19:21:56.000Z

سبحان العليم الظاهر الباطن.txt
very one has problem this work

So what, every time your ISP releases a new firmware and changes the admin pass to spite you users, you want me to trawl through and decrypt the firmware to get it out ? Here's the user credentials from zxhnh288a_hv11_fv110_gr51t17_firmware.zip:

thanks for rajkosto

Answer 43 · 2023-06-16T19:44:51.000Z

Can you help with the zte h288a router Cannot download the backup Download option is blocked Cannot log in to the router with the username and password user.

Answer 44 · 2023-06-17T10:35:16.000Z

hi prografor. about
Can you help with the zte h288a router Cannot download the backup Download option is blocked Cannot log in to the router with the username and password user.
sory I can't understand your problem exactly ---if you have no way to log your h288 you can make factory reset and try again

or you can ask rajkosto he is specialized and helpful

sory my English poo

Answer 45 · 2023-06-17T10:44:44.000Z

hi prografor. about Can you help with the zte h288a router Cannot download the backup Download option is blocked Cannot log in to the router with the username and password user. sory I can't understand your problem exactly ---if you have no way to log your h288 you can make factory reset and try again or you can ask [rajkosto](https://github.com/rajkosto) he is specialized and helpful sory my English poo I advise you reread. all the subject again. to get to know how can help you exactly #43 ‫في الجمعة، 16 يونيو 2023 في 10:45 م تمت كتابة ما يلي بواسطة ‪prografor‬‏ <‪ ***@***.***‬‏>:‬

…

Can you help with the zte h288a router Cannot download the backup Download option is blocked Cannot log in to the router with the username and password user. — Reply to this email directly, view it on GitHub <#43 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AXCIS6NCRVSLVA6YH7L76A3XLSZT7ANCNFSM5WR5UKVA> . You are receiving this because you commented.Message ID: ***@***.***>

Answer 46 · 2023-06-28T19:01:50.000Z

Hi @fego015
Thank you for answering my problem. There is no option to download the backup version, although I have become in the codes of the router. Log in with the name of the Support

Answer 47 · 2023-07-02T13:57:47.000Z

hi everyone
If you can help me
So what, every time my ISP releases a new firmware and changes the admin pass to spite me, l want you to trawl through and decrypt the firmware to get it out ? help me to find the user credentials from
huawei hg630 v2 firmware bin:
Hossam saied [https://mega.nz/file/Zsgh1ZCA#sry0YraL75y7CChTP3NGGugBzPFx_nLIWtsV4UcmaDM]

Answer 48 · 2023-07-23T20:00:08.000Z

Hi @fego015 Thank you for answering my problem. There is no option to download the backup version, although I have become in the codes of the router. Log in with the name of the Support

I have the same problem no option to download or upload the backup version
did you find a solution

Answer 49 · 2023-07-23T23:41:41.000Z

The solution found is to rewrite the SOFT on the chipset inside the router

Answer 50 · 2023-07-24T07:15:05.000Z

Hi Egyptian here: I have ZTE H188A model and installed Nova firmware: here

This should work for Egyptian routers provided by any ISP with the same model_

I downloaded the latest version v7 for H288A firmware for my H188A from here

After that, you'll need to ask your ISP for your username and password.

Login with your default username and password on back of your router. if you're using zxhnh288a_hv11_fv110_gr51t17_firmware.bin

Now you'll log in to your router page > Internet > WAN > DSL tap > DSL Connection and

disable everything except Internet2_VDSL ( VDSL VPU ).

for the Service List keep INTERNET and TR069 only checked and uncheck the rest.

add the username and password you got from your ISP.

set VLAN to off
and now everything should be working.

screenshot from the DSL configuration:

Caution:

This firmware can only support one SSID network for 2.4 GH and one SSID for 5GH networks. so you'll have 2 networks instead of 8 in total

if someone can solve this, please share what you reached to.

NOTE:

I started this process keeping in mind that I might lose my router and get a new one while it's already new.

The main reason I did that, was that I couldn't change my DNS from the routers page but I have to contact the support to do so for me.

The technical support has access to my router page and all the configurations and devices and has more options over what I can do with my router.

I want to Thank you for the firmware.

Hi fellow egyptian, im also glad someone got this gr firmware and it seems to to be getting updated every once in a while. However i see a lot of people having issues like cant login and stuff like that. This is what made me reply here to say that after my last comment/reply here, i went on yt as i said, and got another firmware provided and shared on yt but i have no idea of its origin. However its called SSH and its symbol is something "warning of deadly chemicals" anyway its working fine and i dont remember if i tried to have more than 1 5ghz ssid, but i think it can do that, its been running fine since i installed it, im considering this gr firmware because i see its origin so im less paranoid.

Answer 51 · 2023-07-24T16:40:52.000Z

The solution found is to rewrite the SOFT on the chipset inside the router

Hey i found solution i manage to enter different credential now i can change most of stuff also i have option to upload firmware

Answer 52 · 2023-08-05T14:04:36.000Z

Hi Egyptian here: I have ZTE H188A model and installed Nova firmware: here

This should work for Egyptian routers provided by any ISP with the same model_

I downloaded the latest version v7 for H288A firmware for my H188A from here

After that, you'll need to ask your ISP for your username and password.
Login with your default username and password on back of your router. if you're using zxhnh288a_hv11_fv110_gr51t17_firmware.bin
Now you'll log in to your router page > Internet > WAN > DSL tap > DSL Connection and

disable everything except Internet2_VDSL ( VDSL VPU ).

for the Service List keep INTERNET and TR069 only checked and uncheck the rest.

add the username and password you got from your ISP.

set VLAN to off
and now everything should be working.

screenshot from the DSL configuration:

Caution:

This firmware can only support one SSID network for 2.4 GH and one SSID for 5GH networks. so you'll have 2 networks instead of 8 in total

if someone can solve this, please share what you reached to.

NOTE:

I started this process keeping in mind that I might lose my router and get a new one while it's already new.

The main reason I did that, was that I couldn't change my DNS from the routers page but I have to contact the support to do so for me.

The technical support has access to my router page and all the configurations and devices and has more options over what I can do with my router.

I want to Thank you for the firmware.

Hi fellow egyptian, im also glad someone got this gr firmware and it seems to to be getting updated every once in a while. However i see a lot of people having issues like cant login and stuff like that. This is what made me reply here to say that after my last comment/reply here, i went on yt as i said, and got another firmware provided and shared on yt but i have no idea of its origin. However its called SSH and its symbol is something "warning of deadly chemicals" anyway its working fine and i dont remember if i tried to have more than 1 5ghz ssid, but i think it can do that, its been running fine since i installed it, im considering this gr firmware because i see its origin so im less paranoid.

I set up this SSH Firmware for the router H188a from Vodafone ISP to unlock it, after that the wifi stopped working and no firmware made wifi back to work, now I need to know if there any way to back up my router to the first firmware, the router Date FEB 2023 ISP Vodafone

Answer 53 · 2023-08-05T14:05:09.000Z

Hi Everyone,
I set up this Nova Firmware for the router H188a from Vodafone ISP to unlock it, after that the wifi stopped working and no firmware made the wifi back to work, now I need to know if there is any way to back up my router to the first firmware, the router Date FEB 2023 ISP Vodafone

Answer 54 · 2023-08-05T14:08:10.000Z

also i have flashed file BIN and CUE files for the original Vodafone firmware, but its too large more than 155mgb if there any way to convert those files to firmware please let me know the way,

Answer 55 · 2023-08-27T02:26:01.000Z

Hi all,
My isp went super crazy by providing full locked h288a With no way to configure anything ( no even static ip ). Im strugelling to get anything firmware on that brick , I have only the user login so the firmware upload/download doesn't show up. If anyone have a solution either to get the admin password or to put a different firmware on it will be great. Thanks

Answer 56 · 2023-08-27T02:26:24.000Z

The solution found is to rewrite the SOFT on the chipset inside the router

Hey i found solution i manage to enter different credential now i can change most of stuff also i have option to upload firmware

Can you explain ?

Answer 57 · 2023-08-27T02:33:26.000Z

Can you help with the zte h288a router Cannot download the backup Download option is blocked Cannot log in to the router with the username and password user.
ما تبقاش ترجم من عربية راح تا حد مفهمك

Answer 58 · 2023-09-08T20:18:30.000Z

I have V1.2.0P1_GR5 which seems to be different hw revision? would it be safe to attempt this? I have full eeprom dump available too.

Answer 59 · 2023-09-08T22:16:33.000Z

Please tell me how can i do that

Answer 60 · 2023-09-21T13:54:22.000Z

Hi all, My isp went super crazy by providing full locked h288a With no way to configure anything ( no even static ip ). Im strugelling to get anything firmware on that brick , I have only the user login so the firmware upload/download doesn't show up. If anyone have a solution either to get the admin password or to put a different firmware on it will be great. Thanks

"It has been 8 months now, and it seems that there is no hope except for changing your ISP provider or your internet subscription to acquire a different router. (Port forwarding, changing dns, changing ip address everyfthing is also disabled).", "ORANGE W9"

Answer 61 · 2023-09-22T07:19:08.000Z

Not directly related to a script issue, but since I made the change in fw with the one the the "new defaults", my H288A lost all settings (even TR-069 server/user/pass) so my VoiP and all the rest info where lost (my original fw was WND and not a GR one).

However I have an older exported user config.bin and I believe that the TR-069 server/user/pass, and the voip info are in there somewhere...but when I try to restore it to the moded fw I get "Integrity check failed".
So, is there any way to bypass the integrity check in order to upload it on the moded fw and create a new backup so that I will get the desired info? I highly doubt it, but thought to ask.

Answer 62 · 2023-10-01T15:28:07.000Z

Hello :)

Can someone decrypt config file for ZTE H288A router

will be much appreciated
my vodafone wan config backup.zip

Answer 63 · 2023-10-03T13:21:37.000Z

h188a we.zip
this is h188a firmware from an egyptian isp
can any one port wan setting from nova h288a to it to make it unlocked ??

Answer 64 · 2023-10-08T15:18:18.000Z

C:\Users\user\Desktop\zte-config-utility-master>py examples/encode.py --signature H288A test_config.xml test_config2.bin
Warning: no key provided!
Done!

Answer 65 · 2023-10-11T11:08:59.000Z

Hi Everyone, I set up this Nova Firmware for the router H188a from Vodafone ISP to unlock it, after that the wifi stopped working and no firmware made the wifi back to work, now I need to know if there is any way to back up my router to the first firmware, the router Date FEB 2023 ISP Vodafone

لقيت حل يا احمد انا معايا نفس الروتر

Answer 66 · 2023-10-19T14:32:08.000Z

Hello :)

Can someone decrypt config file for ZTE H288A router

will be much appreciated my vodafone wan config backup.zip

i just decoded the back up file that you attatch

Answer 67 · 2023-10-19T14:36:16.000Z

I have dn8245v-56 huawei router . it is locked by my isp , does any has afirmware to unlock it ?

Answer 68 · 2023-11-01T20:45:13.000Z

@mohamedebrah how were you able to decrypt the config file ?

i am trying on the h188a

Payload Type:       4 (ZLIB+AES256CBCDIFFIV)
Payload Start:      60
Decompressed size:  0 bytes
2nd last chunk:     0
Chunk size:         0 bytes
Payload CRC:        0
Header CRC:         0

No type 4 keygens matched the supplied/detected signature and parameters!

trying the serial number didn't work either.

Answer 69 · 2023-11-05T14:25:00.000Z

@mohamedebrah how were you able to decrypt the config file ?

i am trying on the h188a
Payload Type:       4 (ZLIB+AES256CBCDIFFIV)
Payload Start:      60
Decompressed size:  0 bytes
2nd last chunk:     0
Chunk size:         0 bytes
Payload CRC:        0
Header CRC:         0
No type 4 keygens matched the supplied/detected signature and parameters!

trying the serial number didn't work either.

send me your backup file and i will decrypt it

Answer 70 · 2023-11-05T16:27:49.000Z

send me your backup file and i will decrypt it

@mohamedebrah dude just show us how 🥺 i want to re-encrypt it afterwards to upload it again

here it's anyway ... change the extension back to .bin
Test.txt

Answer 71 · 2023-11-06T16:03:06.000Z

send me your backup file and i will decrypt it

@mohamedebrah dude just show us how 🥺 i want to re-encrypt it afterwards to upload it again

here it's anyway ... change the extension back to .bin Test.txt

here it is your file decryption

Answer 72 · 2023-11-07T11:41:17.000Z

@mohamedebrah i see thx a lot

won't show us how still ?

Answer 73 · 2023-11-07T12:28:47.000Z

Keeping information to yourself is not really the vibe I'm trying to promote here @mohamedebrah. Please consider sharing your knowledge.

Answer 74 · 2023-11-08T14:42:57.000Z

Keeping information to yourself is not really the vibe I'm trying to promote here @mohamedebrah. Please consider sharing your knowledge.

Iam using python in latest version in my decryption and installing pycryptodomex package that helps you alot in file decryption , if you want the way how to decrypt and the commands that you are using , here it is
commands.txt

Answer 75 · 2023-11-08T15:38:49.000Z

@mohamedebrah

9- Then execute the following command "py examples/decode.py --signature H288A config.bin config.xml"

10- you can use the model of any router you want to decrypt just write it instead of H288A

so why using a signature while the file i sent you has none ?

Answer 76 · 2023-11-11T19:58:06.000Z

not working for my isp (NOVA greece H288A)
error : Malformed decrypted payload, likely you used the wrong key!
this is my bin file ,have a try
config_H288A.txt

Answer 77 · 2023-11-11T20:18:16.000Z

nop the code is completely wrong. tested on a h268q (which is already decoded by rajkosto #47 ) and its not working. same error.

Answer 78 · 2023-11-27T16:25:33.000Z

i updated the firmware for zte h188a for many routers
but the wifi not working after firmware
i tried many firmware but the the same probleme
it worked fine for the old version of the router but the new verion cause the wifi not working

Answer 79 · 2023-12-02T15:57:00.000Z

i updated the firmware for zte h188a for many routers but the wifi not working after firmware i tried many firmware but the the same probleme it worked fine for the old version of the router but the new verion cause the wifi not working

the new firmware is not compatible with the chipset of your router wifi , all zte h188a vodafone routers from december 2022 has the same problem , you need to flash your router through aprogrammer with afirmware of anew vodafone version after dec 2022

Answer 80 · 2023-12-02T16:00:04.000Z

I has the new firmware version of vodafone h188a , you can flash it through aprogrammer , if you want , i can send it to you

Answer 81 · 2023-12-04T12:42:49.000Z

I has the new firmware version of vodafone h188a , you can flash it through aprogrammer , if you want , i can send it to you

please send it . thanks

Answer 82 · 2023-12-04T14:23:51.000Z

i updated the firmware for zte h188a for many routers but the wifi not working after firmware i tried many firmware but the the same probleme it worked fine for the old version of the router but the new verion cause the wifi not working

the new firmware is not compatible with the chipset of your router wifi , all zte h188a vodafone routers from december 2022 has the same problem , you need to flash your router through aprogrammer with afirmware of anew vodafone version after dec 2022

is there any way to run the router with WE firmware

Answer 83 · 2023-12-07T13:44:23.000Z

I has the new firmware version of vodafone h188a , you can flash it through aprogrammer , if you want , i can send it to you

please send it . thanks

As i told you , you can flash your router through aprogrammer , it is not asoftware that you can upload it through the browser
this the link of firmware / https://www.mediafire.com/file/0vhkouq7lq6kx95/dump+188+vodafone+dec.rar/file

Answer 84 · 2023-12-07T13:49:23.000Z

i updated the firmware for zte h188a for many routers but the wifi not working after firmware i tried many firmware but the the same probleme it worked fine for the old version of the router but the new verion cause the wifi not working

the new firmware is not compatible with the chipset of your router wifi , all zte h188a vodafone routers from december 2022 has the same problem , you need to flash your router through aprogrammer with afirmware of anew vodafone version after dec 2022

is there any way to run the router with WE firmware

this is aback up that make your router open
https://www.mediafire.com/file/9e2nsv8yvngf21v/vodafone+2022+h188a+open+backup.rar/file

Answer 85 · 2023-12-26T14:01:32.000Z

any thing I can do with H288A V1.2.0P2_INWI

Answer 86 · 2024-01-02T10:55:04.000Z

Is there any way to make vodafone H188A V2.1.1P3N1_VDF opened for all companies

Answer 87 · 2024-01-12T20:50:30.000Z

https://www.mediafire.com/file/0vhkouq7lq6kx95/dump+188+vodafone+dec.rar/file

Is this compatible with the Feb 2023 version?
I can try and get a programmer and use it.

Answer 88 · 2024-01-15T08:26:29.000Z

Is it possible to find out the login password of the administrator in the firmware dump itself? I am attaching a dump just in case
H288A.zip

Answer 89 · 2024-01-26T23:45:48.000Z

i need help
cofig file zero byte
when i backup from router the size is zero byte

Answer 90 · 2024-01-28T11:35:48.000Z

disable antivirus - firewall

Answer 91 · 2024-01-29T01:10:39.000Z

i disabled anti virus and noway
also when convert xmlfile(217kb) to bin file
the finally config zero byte i need 20kb config file not zero help me

Answer 92 · 2024-01-30T14:04:38.000Z

i updated the firmware for zte h188a for many routers but the wifi not working after firmware i tried many firmware but the the same probleme it worked fine for the old version of the router but the new verion cause the wifi not working

the new firmware is not compatible with the chipset of your router wifi , all zte h188a vodafone routers from december 2022 has the same problem , you need to flash your router through aprogrammer with afirmware of anew vodafone version after dec 2022

is there any way to run the router with WE firmware

this is aback up that make your router open https://www.mediafire.com/file/9e2nsv8yvngf21v/vodafone+2022+h188a+open+backup.rar/file

while editing username to be matched with my account gives me an error "Please enter a value composed of 0 ~ 9 or enter “internet@vodafone.com”"

Answer 93 · 2024-02-13T13:42:43.000Z

"Please enter a value composed of 0 ~ 9 or enter “internet@vodafone.com”"

it's expecting a landline phone number as per usual 🙄🙄

Answer 94 · 2024-02-26T21:50:48.000Z

Hi Everyone, I set up this Nova Firmware for the router H188a from Vodafone ISP to unlock it, after that the wifi stopped working and no firmware made the wifi back to work, now I need to know if there is any way to back up my router to the first firmware, the router Date FEB 2023 ISP Vodafone

لقيت حل يا احمد انا معايا نفس الروتر

ايه الاخبار وصلت لفين انا معايا نفس الراوتر واديته فريموير غلط ومش عارف اعمل معاه حاجة لو لقيت حل ياريت تلحقني

Answer 95 · 2024-02-28T01:31:07.000Z

NEW firmware zte-zxhn-h288a-Orange-maroc (2024)
https://www.mediafire.com/file/6llw6a3u3nu3958/firmware+zte+h288a+(2024).rar/file
PASSWORD RAR. STARSAT4K_5GHz(2024)

Answer 96 · 2024-02-28T21:06:06.000Z

I have H188A V2.0.1P6_Etis which works good with the provided flashable firmware , the problem now is that the firmware upgrade wnidow isn't visible in the settings

anyone can help with this?

Answer 97 · 2024-02-28T23:21:54.000Z

@CHC98R98 dude why u mentioning me, mention the dude u got the firmware from

Plus check your login only the admin has access to that page

Answer 98 · 2024-02-28T23:34:01.000Z

NEW firmware zte-zxhn-h288a-Orange-maroc (2024)
https://www.mediafire.com/file/6llw6a3u3nu3958/firmware+zte+h288a+(2024).rar/file
PASSWORD RAR. STARSAT4K_5GHz(2024)

is it suitable for h188a v2.1.1 ?

Answer 99 · 2024-02-28T23:47:10.000Z

@CHC98R98

Try Username: admin
Password: ETIS_02xxxxxx (your telephone number) or ETIS@011

Regards

Answer 100 · 2024-02-29T01:07:12.000Z

[ibrahimelmansory]
h188a v2.1.1؟

This is for the latest version of 2023. This update is for Orange in Morocco