If you want more fun with the saved nvram config files, check out http://www.nirsoft.net/utils/router_password_recovery.html http://www.nirsoft.net/utils/router

If you want more fun with the saved nvram config files, check out http://www.nirsoft.net/utils/router_password_recovery.html http://www.nirsoft.net/utils/router_password_recovery.html He's figured out many of their "encryption" methods. I've independently "cracked" most of the major ones as well, (including checksums/headers required to write back to the router). They're all pretty broken. PRNG key streams, simple bit swaps, XOR, encryption against a static key, etc. Fun stuff.