Here's a quick method of checking if the ROM-D has been cleared --
- Login as admin
- At the busybox shell prompt, issue the command hexdump -C /dev/mtdblock3
If the following is displayed, then the ROM-D has been cleared --
$ hexdump -C /dev/mtdblock3
00000000 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff |................|
*
00100000
$
Please note that the above is a valid method for the VMG1312-B10D but I also expect it to work on other ZyXEL VMGxxxx devices.
I see this but it seems not all is what it seems.
This is what I have managed to do.
I created a new account, which added the firmware upgrade option, but no options to disable tr options.
I flashed a firmware from zyxel's site and selected reset to defaults as well, I assumed an entire new firmware would fix all this.
However after the flash it was locked again.
Remade a new user account and firmware upgrade is visible but no tr options.
Made a new admin account, same as admin except firmware upgrade visible but no TR options (or VOIP).
I ran your hexdump command which shows the exact output you pasted.
I have ran the save_default clean (which worked after I flashed new firmware) and did a pin reset, but still a restricted interface.
To get all the menus for the admin user you can also just export the router config from the GUI and then add under privileges:
Then just reimport the config and all the menus options will be there!
interesting but is no privileges section in my exported config.
I suspoect your trick has been closed off in the newer firmware, as I see this line
"Privilege":"_encrypt_QYgPXv7+tjfYdxBKWq1gpoRpSktHo7\/nOHxelBC44t0=",
Seems they now encrypted the field.