Found it!
In ./package/public-zyxel/libzcfg_fe_dal/patches/322-ZYXEL_ENHANCE_CLI_move_dhcp_option_60_61_encode_decode_from_GUI_to_DAL_FrankFang.patch, the function 'int opt61ValEncode' is defined (no corresponding function exists in the original source file targeted by the patch). It is
+int opt61ValEncode(char *iaid, char *duid, char *encVal, int tag){
+ if(encVal)
+ strcpy(encVal,"");
+
+ //*(iaid+4)='\0';
+
+ int strLen = 1+4+2+(strlen(duid)/2);
+ char tagStr[2]={0};
+ char hexLen[2]={0};
+
+ intToHexStr(tag,tagStr);
+ strcat(encVal,tagStr);
+
+ intToHexStr(strLen,hexLen);
+ strcat(encVal,hexLen);
+
+ strcat(encVal,"ff");
+ strcat(encVal,iaid);
+ strcat(encVal,"0002");
+ strcat(encVal,duid);
+
+ return 1;
+}
Rather than messing around trying to make patches of patches, a suitable modification to this file would be to replace the above with
+int opt61ValEncode(char *iaid, char *duid, char *encVal, int tag){
+ if(encVal)
+ strcpy(encVal,"");
+
+ //*(iaid+4)='\0';
+
+ int strLen = strlen(duid)/2;
+ char tagStr[2]={0};
+ char hexLen[2]={0};
+
+ intToHexStr(tag,tagStr);
+ strcat(encVal,tagStr);
+
+ intToHexStr(strLen,hexLen);
+ strcat(encVal,hexLen);
+
+ //strcat(encVal,"ff");
+ //strcat(encVal,iaid);
+ //strcat(encVal,"0002");
+ strcat(encVal,duid);
+
+ return 1;
+}
Which simply removes the parts of the code which insert 0xff, the IAID, 0x00 and 0x02. It also modifies the string length computation such that it gives the right value with all the other stuff removed.
So @lurch, do you want me to go ahead and build this for you, bearing in mind I have absolutely no way of testing it so flashing such a firmware will be at your own risk? Also, the firmware source on github linked above is not the latest, so it might be better to request the latest one from here
https://www.zyxel.com/us/en/form/gpl_oss_form.shtml (I can't do this as it needs the router's serial number).
