paytonImageEditor

Cisco SPA232D firmware editor

GPL

SPA112_SPA122_SPA232D_gpl_pkg-4.zip

Build custom firmware

$ cd CustomFW
$ sudo tar xf squashfs-root.tar.xz
$ ./build.sh

You can find a pre-built custom firmware with only telnet enabled here

Flash CustomFW

Flash the custom firmware like an official update through the web interface

Telnet

You can now connect to telnet:

$ telnet 192.168.15.1 23000

(No login)

You must connect via LAN port.

Firmware structure

Header modules are present twice.

| Size (byte) | Type | Name | Description | | :----------: | ---- | ---- | ------- | | 136 | Firmware Header | Firmware Header | Header of the entire firmware image | | 128 | Module Header | Module 1 header | Copy of Module 1 header | | 128 | Module Header | Module 2 header | Copy of Module 2 header | | 128 | Module Header | Module N header | Copy of Module N header | | 128 | Module Header | Module 1 header | | | Module 1 size | Module Data | Module 1 data | | | 128 | Module Header | Module 2 header | | | Module 2 size | Module Data | Module 2 data | | | 128 | Module Header | Module N header | | | Module N size | Module Data | Module N data | |

Firmware Header

| Size (byte) | Type | Name | Description | | :----------: | ---- | ---- | ------- | | 16 | Byte array | Magic | Eg: PAYTOND FiRmWaRe | | 32 | Byte array | Signature | Not used |
| 16 | Byte array | Digest | MD5 of Firmware Header + Modules Headers |
| 16 | Byte array | Randseq | Not so random |
| 4 | Unsigned BE Int | Firmware Heder Size | Eg: 136 | | 4 | Unsigned BE Int | Module Header Size | Eg: 128 | | 4 | Unsigned BE Int | Firmware size | Entire firmware image size | | 32 | Byte array | Version | Eg: 1.4.1 | | 4 | Unsigned BE Int | Modules number | Number of modules present in this firmware image | | 4 | Unsigned BE Int | Flash type | Eg: 0x137a80 | | 4 | Unsigned BE Int | Slic type | Eg: 0x1eaea3a |

Randseq

1. Zero out Signature, Digest and Randseq in Firmware Header
2. Concat Firmware Header and all Modules Headers
3. Initialize a counter to 19
4. For each bytes
   • sum the counter to the byte
   • keep only first 8 bits
   • increment counter by 19
5. MD5 of the resulting bytes Digest is computed on

Digest

1. Write Randseq in Firmware Header
2. MD5 Digest of Firmware Header + Modules Headers

Module Header

| Size (byte) | Type | Name | Description | | :----------: | ---- | ---- | ------- | | 4 | Unsigned BE Int | Always zero | Eg: 0x00000000 | | 4 | Byte array | Module Magic | Eg: RSFw |
| 1 | Unsigned Int | Module type | Used to identify bootloader, filesystem, etc. |
| 1 | Unsigned Int | Module instance | |
| 2 | Byte array | Reserved | | | 4 | Unsigned BE Int | Module Header Size | Eg: 128 | | 16 | Byte array | Module Digest | MD5 of module data | | 4 | Unsigned BE Int | Module size | Entire firmware image size | | 4 | Unsigned BE Int | Module Checksum | Not used | | 32 | Byte array | Module version | Eg: 1.0 | | 52 | Byte array | Reserved | | | 4 | Unsigned BE Int | Module Header Checksum | Sum of all bytes of this header (without this filed) |