// select a target on the left_
_._ _,-'""`-._
(,-.`._,'( |\`-/|
`-.-' \ )-`( , o o)
`- \`_`"'-
TP-Link uses a limited set of OUI families. Enter a MAC to identify it and derive the per-device config key (HMAC-SHA256(MAC, chip target_info)). Firmware images are bootloader-keyed — not MAC-derived — so this is for config-backup decryption / device-ID.
Enter a router's MAC (the BSSID is broadcast). tpbreak identifies the vendor, derives the default SSID (MAC-based, always accurate), and classifies the factory WPA password scheme from what the firmware actually does: derivable (mac/serial/fixed — a real weakness, change it) vs random-label (per-unit, printed on the sticker — not in firmware, not crackable from the MAC). This is weakness assessment — it won't invent a password for a scheme that isn't derivable.
Per-vendor decryption keys, all recovered from the vendors' own published binaries — TP-Link RSA blobs (libsecurity/slpupgrade), D-Link's SHRS AES key (imgdecrypt), QNAP's PC1 ASCII secrets, and Synology's XChaCha20 masters (RE'd from get_keys). Searchable by vendor, key, or device family.
Streams each vendor's own public CDN firmware and decrypts it on the fly. Every key here was recovered from material the vendors themselves publish — no signing, no piracy. tpbreak resolves the formats below:
| TP-Link camera / hub / lock / Cloud router | RSA-2048 + AES | auto |
| TP-Link SG managed switch | DES-CBC (strip-128) | auto |
| D-Link DIR / COVR / DAP (SHRS) | AES-128-CBC | auto |
| QNAP QTS / QuTS NAS (icpnas) | PC1 stream cipher | auto |
| Synology DSM NAS (.pat / .spk) | XChaCha20-Poly1305 + Ed25519 | auto |
| GL.iNet OpenWrt router (sysupgrade) | none — plaintext tar → squashfs | auto |
| D-Link DIR-X / EAGLE PRO (encrpted_img) | AES-256-CBC (static key) | auto |
| Dahua camera / NVR / XVR (.bin) | DH→PK zip / AES-128 | auto |
| Buffalo LinkStation / TeraStation NAS | ZipCrypto (fixed password) | auto |
| Wecon LX/PI HMI (.osf3 / WSFI) | AES-256-CFB (custom SHA KDF) | auto |
| Samsung Tizen TV (upgrade.msd, 2016-2020) | AES-128-CBC (per-chassis md5 passphrase) | auto |
| Nokia GPON SFP ONT (G-010S-A/P) | none — plaintext uImage + squashfs | auto |
| Realtek RTL960x GPON ONT (V2801F / DFP-34X / GPON657) | none — plaintext uImage + squashfs | auto |
| TP-Link EAP config backup | HMAC-SHA256(MAC, chip-info) | BYO MAC |
| encrypted EAP / vacuum firmware | bootloader/HW key | BYO dump |
Each vendor's key comes from its own published binary: TP-Link's libsecurity, D-Link's imgdecrypt, QNAP's hardcoded ASCII secrets, Synology's get_keys() table reverse-engineered out of synofwupgrade. NAS images (QNAP/Synology) are x86_64/ARM Linux; the cameras stay hardware-bound. For security research.