reyee_decrypt

Adaptive decryption of Ruijie ReyeeOS firmware and configuration backups, and recovery of plaintext passwords from configurations.

Usage

python3 reyee_decrypt.py <input> [output directory]

<input> is auto-detected, supporting the following types:

Input	Example
Firmware tar package	AP_3.0(1)..._with_boot_encrypto_v1.tar.gz
Firmware extracted directory	..._with_boot_encrypto_v1/
Encrypted install bin	..._install_encrypto_v1.bin / ..._install_encrypto_v2.bin
Encrypted u-boot	u-boot-*_encrypto_v2
Configuration backup	backup-*.tar.gz

Output is written to <same name>_decrypt/ (or the directory specified by the second argument):

<name>_decrypt/
├── images/         Firmware: decrypted install / u-boot
├── rootfs/         Firmware: unpacked root filesystem
├── config/         Configuration backup: unpacked configuration
├── passwords.txt   Configuration backup: recovered passwords
└── summary.txt     Version / architecture / manifest / directory tree

Dependencies

pip3 install pycryptodome
pip3 install PySquashfsImage

Features

• Firmware v1 (self-inverse XOR stream cipher), v2 (AES-256-CBC) decryption
• Configuration backup config_encrypto (AES-128/256-CBC) decryption
• Password recovery: AES ciphertext, plaintext, Ruijie Type-7
• squashfs unpacking (PySquashfsImage, pure Python, cross-platform)
• Protection against directory traversal and symlink escape when extracting tar

License

MIT