 meister_sdPremium
join:2006-01-29
La Mesa, CA
kudos:7 | reply to rcilink
Re: Made my own provision file I'm bringing my box to work to try some stuff. But I'm still on a box right now that won't let me load any file into it until I do the reset you told me to try. But what I was thinking is (1) Are we sure the file is RC4 from Vonage, and (2) I am going to put my own key into Provision.html and use that same key to encrypt a file and let it get uploaded to my box since you said there was an error in syslog about NOT having a key. I'll make one up.
I'll put the .bin file on rapidshare.de later today. |
|
| Are you using the right key? I downloaded the provision file with the default (as opposed to current) path and decrypted it with the default key. The result was a plaintext XML file. |
|
rcilinkPremium
join:2003-12-15
Manchester, NH
1 edit | Re: Provision XML decrypting is not working for me... Please correct the following steps, as this is not working for me.
1. download the ti001300000.xml file from ti.tftp.vonage.net. (Using the 'default' subdirectory defined in the Provision.html)
2. download rc4.c and compile it (mine is compiled on linux)
3. extract key from Provision.html in source view.
4. decrypt .xml file as follows:
# rc4 ABCABC-BIG-LONG-KEY-ABCABC outfile.xml
When I do these steps, the 'outfile.xml' is the same size as the ti001300000.xml file. It is not readable and it is not the same as the ti00130.. file.
So, if you would be kind enough to share what step we are missing, I know I would appreciate it.
Thanks! |
|
|
|
meister_sdPremium
join:2006-01-29
La Mesa, CA
kudos:7 | reply to scaredofvonage
Re: [Vonage] SIP credentials, RTP300, GPP_K? Here is the bin file:
»rapidshare.de/files/17661517/rtp···bin.html |
|
1 edit | $ tftp ti.tftp.vonage.net
tftp> bin
tftp> get /<default path>/ti<mac>.xml
Received 12152 bytes in 10.9 seconds
tftp> q
$ mv ti<mac>.xml ti<mac>.xml.crypt
$ ./rc4 <256bit default key> < ti<mac>.xml.crypt > ti<mac>.xml
The first few lines look like:
<provision version="2">
<options>
<reconfig/>
</options>
<settings>
<firmware>+XXXXXXXXXXXX/rt-11.1.0-r021-1.00.62-r060327.img</firmware>
<profileurl>tftp://ti.tftp.vonage.net:69,21,2400</profileurl>
<imageurl>http://httpconfig.vonage.net</imageurl>
<tftp>ti.tftp.vonage.net</tftp>
<tftpimg>ti.tftp.vonage.net</tftpimg>
<tftpports>69,21,2400</tftpports>
|
|
maziloFrom MaziloPremium
join:2002-05-30
Lilburn, GA
kudos:1
1 edit | said by czyc :
+XXXXXXXXXXXX/rt-11.1.0-r021-1.00.62-r060327.img Remember the above firmware version. This was the latest/current released by Vonage before this hacking begins. After the new firmwares are released, this hacking may and/or may no longer works!
--
Mazi (UK Non-Geo Phone: +44-703-194-2574) |
|
meister_sdPremium
join:2006-01-29
La Mesa, CA
kudos:7
1 edit | reply to czyc
said by czyc :
The first few lines look like:
Would you post your file here? Scrub it if you'd like by putting x's so we know what goes where. |
|
| reply to mazilo
Crap, i left my mac above. Any moderator around who can possibly remove it? |
|
rcilinkPremium
join:2003-12-15
Manchester, NH | OK, I am going to have to try the 'reset button' option, cuz this thing is not getting back to factory fresh or something.. ARGH.
I just tried again, and it lets me download a file, but it is different from the file you got. It is 6598 bytes. I tried using the key listed for the thing, and it won't open it up.
BTW, if you register here, you have the edit/delete option to fix your posting.. |
|
meister_sdPremium
join:2006-01-29
La Mesa, CA
kudos:7 | That is what happend to me. After the factory voice reset, I got entirely new keys so I am sticking with the facreset file/keys and leaving it off the net until I can decrypt mine also.
Anyone look at getting the bin uploaded to their rtp? |
|
maziloFrom MaziloPremium
join:2002-05-30
Lilburn, GA
kudos:1 | reply to czyc
said by czyc :
Crap, i left my mac above. Any moderator around who can possibly remove it? Don't worry, this has been taken care by the mod.
--
Mazi (UK Non-Geo Phone: +44-703-194-2574) |
|
maziloFrom MaziloPremium
join:2002-05-30
Lilburn, GA
kudos:1 | reply to meister_sd
said by meister_sd:That is what happend to me. After the factory voice reset, I got entirely new keys so I am sticking with the facreset file/keys and leaving it off the net until I can decrypt mine also. Remember, this is your device's factory default encryption key and be sure to keep a copy of it. Do do like some people who didn't bother to do so after unlocking their PAP2s.
Anyone look at getting the bin uploaded to their rtp? I have an expired Rapid share account. When I clicked to the link you provided, I got a message to ask me to renew my account. Anyway, I wondered what is the .bin file you had uploaded to Rapid Share site? Is it an RTP300 firmware? If so, why the version is 3.1.10?
--
Mazi (UK Non-Geo Phone: +44-703-194-2574) |
|
meister_sdPremium
join:2006-01-29
La Mesa, CA
kudos:7 | said by mazilo: Anyway, I wondered what is the .bin file you had uploaded to Rapid Share site? Is it an RTP300 firmware? If so, why the version is 3.1.10? This is what I was wondering. I found a reference on Google on provisioning your own rtp300 and the screen shots show a different firmware loaded. I'm thinking this is the true -na version. Here is where I got it.
»www.profiber.dk/media/router_opdatering.pdf
Take a look and you will see other screens that we don't have access to - that's why I think it's a true -na. Does anyone have a true -na to verify their version number?
If you want me to email it to you, it's just over 5 meg. PM me your email address and I'll send it. |
|
| reply to rcilink
Mod: thank you
said by rcilink:OK, I am going to have to try the 'reset button' option, cuz this thing is not getting back to factory fresh or something.. ARGH. I just tried again, and it lets me download a file, but it is different from the file you got. It is 6598 bytes. I tried using the key listed for the thing, and it won't open it up. BTW, if you register here, you have the edit/delete option to fix your posting.. Yeah, that'll teach me to be lazy. |
|
maziloFrom MaziloPremium
join:2002-05-30
Lilburn, GA
kudos:1 | reply to meister_sd
said by meister_sd:Take a look and you will see other screens that we don't have access to - that's why I think it's a true -na. Does anyone have a true -na to verify their version number? I don't see much of differences between my unlocked WRTP54G and the pages you had shown through the link, except my WRTP54G will still show the nasty message when I clicked the Voice menu. I hope you will also find the WRTP54G-NA firmware.
--
Mazi (UK Non-Geo Phone: +44-703-194-2574) |
|
meister_sdPremium
join:2006-01-29
La Mesa, CA
kudos:7 | So, along with Line 1 and Line 2 you have User 1 and User 2, along with the basic view and advanced view? |
|
rcilinkPremium
join:2003-12-15
Manchester, NH | reply to scaredofvonage
I downloaded the firmware listed here and... Found that it would not load on my device!
Not leaving it alone, I peaked inside to see the difference between my other firmwares..
I found the size was off, and the 'code' in the header did not allow my device to load this firmware. Then it was a matter of checksum fixing.
I guess I should have realized that this firmware was for the rtp300, not the wrtp54g! I figured it would work.. just not provide wireless capabilities. That is what it did.. It shut-off the wireless part.
Now I need to find this release for the WRTp54G and fix it up.. looks like a very nice release of firmware!
My wrtp54g is now running firmware version 3.1.10!
It still works like the router/firmware, but also looks like the PAP2 for the voice part!
So, I will patch the header of this firmware back to the rtp300 unit, and let others try it.. It completely unlocks the voice part.
Anyone have a rtp300 and want to try this? |
|
IPA
join:2002-09-21
Beaverton, OR
2 edits | reply to czyc
Oops... Nevermind  |
|
rcilinkPremium
join:2003-12-15
Manchester, NH
1 edit | reply to scaredofvonage
RTP300 firmware update RTP300-3-1-10.bin Here's the firmware update. It has the corrected filesize (padded with FF's) and re-checksum'd so it will work.
This firmware will load up your RTP300 unit with the latest in voice firmware (3.1.10) unlocked..
When you click on 'VOICE', you get the Voice menu, not a "contact your service provider"..
This one will only load on a RTP300 unit. I have tested it on a WRTP54G unit by modifying the hardware ID in the firmware, and it works! |
|
| I tried it on my rtp300 it won't take it :-( |
|
