From a3f6e0b0db2e509e19d9d6ef79a0e8d611a10061 Mon Sep 17 00:00:00 2001
From: reaae4 <reaae4@icloud.com>
Date: Sat, 29 Mar 2025 02:10:28 +0100
Subject: [PATCH 1/2] Add support for xgspon to cigpassword_gpon

---
 assets/js/cigpassword.js | 26 ++++++++++++++++++++++----
 1 file changed, 22 insertions(+), 4 deletions(-)

diff --git a/assets/js/cigpassword.js b/assets/js/cigpassword.js
index 7fbcf0fa..df866964 100644
--- a/assets/js/cigpassword.js
+++ b/assets/js/cigpassword.js
@@ -6,16 +6,30 @@ function hexToBytes(hex) {
     return bytes;
 }
 
-function cigpassword_gpon(ont_serial, ont_user) {
+function cigpassword_gpon(ont_serial, ont_user, length = 0, xgspon = false) {
     const hardcoded_key = '01030a1013051764c8061419b49d0500';
     const hardcoded_seed = '2345679abcdefghijkmnpqrstuvwxyzACDEFGHJKLMNPQRSTUVWXYZ';
 
     let ont_vendor = ont_serial.substring(0, 4).toUpperCase();
     let ont_id = ont_serial.substring(4).toLowerCase();
+
+    if (xgspon) {
+        ont_id = ont_id.toUpperCase();
+    }
+
     let formatted_serial = `${ont_vendor}${ont_id}`;
 
-    let key_bytes = CryptoJS.enc.Hex.parse(hardcoded_key);
-    let hmac = CryptoJS.HmacMD5(`${formatted_serial}-${ont_user}`, key_bytes);
+    let key_bytes = new Uint8Array(hardcoded_key.match(/.{1,2}/g).map(byte => parseInt(byte, 16)));
+    if (length > 0) {
+        key_bytes[15] = length;
+    }
+
+    let formatted_serial_user = formatted_serial;
+    if (ont_user) {
+        formatted_serial_user += `-${ont_user}`;
+    }
+
+    let hmac = CryptoJS.HmacMD5(formatted_serial_user, CryptoJS.lib.WordArray.create(key_bytes));
     let pw_md5_hmac = hexToBytes(hmac.toString(CryptoJS.enc.Hex));
 
     let output = Array(pw_md5_hmac.length);
@@ -24,5 +38,9 @@ function cigpassword_gpon(ont_serial, ont_user) {
         output[i] = hardcoded_seed[pw_md5_hmac[i] % 0x36];
     }
 
-    return output.join('');
+    if (length > 0) {
+        return output.slice(0, length).join('');
+    } else {
+        return output.join('');
+    }
 }

From 7367ad8af6dd2c6102a2c4aa2a39966016815139 Mon Sep 17 00:00:00 2001
From: reaae4 <reaae4@icloud.com>
Date: Sun, 13 Apr 2025 13:07:27 +0200
Subject: [PATCH 2/2] Use cigpassword_gpon in cig_password_xgspon.html

---
 _includes/cig_password_xgspon.html | 14 +++++---------
 1 file changed, 5 insertions(+), 9 deletions(-)

diff --git a/_includes/cig_password_xgspon.html b/_includes/cig_password_xgspon.html
index 5e49d231..f8fdc357 100644
--- a/_includes/cig_password_xgspon.html
+++ b/_includes/cig_password_xgspon.html
@@ -28,6 +28,8 @@
             <label for="result" class="form-label">Password</label>
         </div>
     </form>
+    <script src="https://cdnjs.cloudflare.com/ajax/libs/crypto-js/4.2.0/crypto-js.min.js"></script>
+    <script type="text/javascript" src="/assets/js/cigpassword.js"></script>
     <script>
         var cigPassword = document.getElementById('cig-password');
         cigPassword.addEventListener('submit', (event) => {
@@ -36,16 +38,10 @@
                 event.preventDefault();
             } else {
                 const data = new URLSearchParams(new FormData(cigPassword));
-                var url = new URL("https://cigpassword.hack-gpon.org/xgspon/");
-                url.search = data.toString();
-                fetch(url, {mode: 'cors'}).then(response => response.json()).then(json => {
-                    document.getElementById('result').value = json.password;
-                    document.getElementById('username').value = json.username;
-                }).catch((error) => {
-                    document.getElementById('result').value = "Error!"
-                });
+                document.getElementById('result').value = cigpassword_gpon(data.get("serial"), null, data.get("password_len"), true);
+                document.getElementById('username').value = data.get("serial");
             }
             [...cigPassword.elements].map(e => e.parentNode).forEach(e => e.classList.toggle('was-validated', true));
         });
     </script>
-</div>
\ No newline at end of file
+</div>