Some feedback on this excellent script.
For the IPC, another way to get the HWID is the device type from version page but caveat.
Device Type IPC-HDW5541H-AS-PV
Mine is PAL, so HWID is actually: IPC-HDW5541HP-AS-PV
Tried this for several cams and works but sure it wont be all of them!
It's not working with my NVR, I get an error of: Data must be aligned to block boundary in ECB mode
Noted the file for NVR is 144Kb and IPC it's 140Kb.
Noted my file is 1 bytes too long so tried both subtracting that byte and adding another 15.
But neither seems to work with what I think my HWID is.
Added a file from another NVR, this one is smaller than IPC or first NVR. Same problem.
DHI-NVR5216-8P-I
V4.001.0000000.3, Build Date: 2020-10-22
Also, curious, where did "dh_string" come from ?
Thanks, appreciated.
Well, I could not find any logic into the key's either, the only thing I could find so far is the HWID, but then my "SD-xxx" with "SD" key came along and... yeah..
Not working on my NVR either, seems not to share same key generation (but did not spend so much time on that), I see your attachment has base64 encoded backup as well.
"dh_string" comes from Sonia, search for that the first word and you will find two identical strings, and you will end up in one of the keygeneration code.
The first char 'y' int the string was appended to the md5 in all cases what I have seen so far, and since it's a string, I just assuming it may use 0x01 after 'MWPZWJGS' (1 in the NVR base64 encoded) - but it does look the 'y' is fixed for most part where this encryption/decryption are used (not only backup config).
Note: This string do not exist in NVR 'Challenge".
Anyway, credit shall also go to
riogrande75, as he made me curious about this. (Thx Rio !)