many thanks goroh_kun (@goroh_kun)
ヘッダ（0x0 – 0xF) 除去したものを32byte単位でpadding
tofu@Tofu-H170W10 MINGW64 ~/router/nec/wg2600hp/wg2600hp_1_0_13 $ dd if=wg2600hp_1_0_13_noheader.bin of=wg2600hp_1_0_13_noheader.bin.pad bs=32 conv=sync 396727+0 records in 396727+0 records out 12695264 bytes (13 MB, 12 MiB) copied, 2.89493 s, 4.4 MB/s
キーを32byteで作成してhexな文字列で取り出し
tofu@Tofu-H170W10 MINGW64 ~/router/nec/wg2600hp/wg2600hp_1_0_13 $ echo -n "rotary" | dd bs=32 count=1 conv=sync > key.bin 0+1 records in 1+0 records out 32 bytes copied, 0.0061302 s, 5.2 kB/s tofu@Tofu-H170W10 MINGW64 ~/router/nec/wg2600hp/wg2600hp_1_0_13 $ busybox hexdump -v -e '1/1 "%02x"' key.bin 726f746172790000000000000000000000000000000000000000000000000000
バイナリファイルへの出力省略してワンライナーでも可。
tofu@Tofu-H170W10 MINGW64 ~/router/nec/wg2600hp2/wg2600hp2_1_0_5 $ echo -n "rotary" | dd bs=32 count=1 conv=sync 2> /dev/null | busybox hexdump -v -e '1/1 "%02x"' 726f746172790000000000000000000000000000000000000000000000000000
OpenSSLを用いてdecrypt
tofu@Tofu-H170W10 MINGW64 ~/router/nec/wg2600hp/wg2600hp_1_0_13 $ openssl enc -aes-256-cbc -d -in wg2600hp_1_0_13_noheader.bin.pad -out wg2600hp_1_0_13_noheader.bin.pad.dec -K 726f746172790000000000000000000000000000000000000000000000000000 -iv 0 -nopad
完了
tofu@Tofu-H170W10 MINGW64 ~/router/nec/wg2600hp/wg2600hp_1_0_13 $ busybox hexdump -n 128 -C wg2600hp_1_0_13_noheader.bin.pad.dec 00000000 55 53 42 20 41 54 45 52 4d 57 4c 33 30 35 30 00 |USB ATERMWL3050.| 00000010 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff |................| 00000020 00 00 ff ff 00 00 00 69 00 00 00 18 25 c3 00 00 |.......i....%...| 00000030 00 00 00 00 00 00 00 00 56 45 52 53 49 4f 4e 3a |........VERSION:| 00000040 20 33 2e 32 30 2e 36 37 0a 4f 45 4d 31 20 56 45 | 3.20.67.OEM1 VE| 00000050 52 53 49 4f 4e 3a 20 31 2e 30 2e 31 33 0a 43 6f |RSION: 1.0.13.Co| 00000060 70 79 72 69 67 68 74 28 63 29 20 4e 45 43 20 50 |pyright(c) NEC P| 00000070 6c 61 74 66 6f 72 6d 73 2c 20 4c 74 64 2e 20 32 |latforms, Ltd. 2| 00000080
