siva
join:2008-08-28
Mentor, OH
| [Unlock] BPG510 firmware checksum
I will be getting a BPG510 ATA. I would like to unlock it to use it with my Asterix server. I haven't found any unlocked firmware for this.
If anyone is interested in updating the firmware, here are some details.
The firmware is compiled for CS6220 system on chip.
The first 2 bytes in the firmware is the checksum.
If you want to update the firmware, Calculate the checksum without the first 2 bytes and than insert the checksum.
Here is the code for calculating checksum.
I am using boost crc library to calculate the checksum.
I am using cygwin to compile and I was able to verify firmware checksum for a couple of firmware versions.
// Boost CRC example program file ------------------------------------------//
// Copyright 2003 Daryle Walker. Use, modification, and distribution are
// subject to the Boost Software License, Version 1.0. (See accompanying file
// LICENSE_1_0.txt or a copy at .)
// See for the library's home page.
// Revision History
// 17 Jun 2003 Initial version (Daryle Walker)
#include // for boost::crc_32_type
#include // for EXIT_SUCCESS, EXIT_FAILURE
#include // for std::exception
#include // for std::ifstream
#include // for std::ios_base, etc.
#include // for std::cerr, std::cout
#include // for std::endl
// Redefine this to change to processing buffer size
#ifndef PRIVATE_BUFFER_SIZE
#define PRIVATE_BUFFER_SIZE 1024
#endif
// Global objects
std::streamsize const buffer_size = PRIVATE_BUFFER_SIZE;
//crc-16 standard
//typedef boost::crc_optimal crc_my_type;
//crc-ccitt standard
//typedef boost::crc_optimal crc_my_type;
//modified crc-ccitt standard
typedef boost::crc_optimal crc_my_type;
// Main program
int
main
(
int argc,
char const * argv[]
)
try
{
crc_my_type result;
for ( int i = 1 ; i argc ; ++i )
{
std::ifstream ifs( argv[i], std::ios_base::binary );
if ( ifs )
{
do
{
char buffer[ buffer_size ];
ifs.read( buffer, buffer_size );
result.process_bytes( buffer, ifs.gcount() );
} while ( ifs );
}
else
{
std::cerr "Failed to open file '" argv[i] "'."
std::endl;
}
}
std::cout std::hex std::uppercase result.checksum() std::endl;
return EXIT_SUCCESS;
}
catch ( std::exception &e )
{
std::cerr "Found an exception with '" e.what() "'." std::endl;
return EXIT_FAILURE;
}
catch ( ... )
{
std::cerr "Found an unknown exception." std::endl;
return EXIT_FAILURE;
} |
|
rcilink
Premium
join:2003-12-15
Manchester, NH
| Now you need to unpack the firmware and then you get the sip.r0 and downldr.r0 binaries.. That's where the fun is.
I have not tested it, but I would imagine that you may find luck loading a Leadtek firmware on this device.
The Leadtek firmware is really unlocked and will work with most SIP services. |
|
siva
join:2008-08-28
Mentor, OH
| How do I unpack the firmware? Is it like a filesystem?
The closest equipment from Leadtek is BVA8053RL. I was able to find firmware files for BVA8053R on leadtek ftp site.
»ftp://ftp.leadtek.nl/mirror/voip/
The files from leadtek look like unpacked files (.r0 files )
How do I pack them for the BPG510?
Thanks,
Siva |
|
chawarma
join:2007-08-07
Montreal-Nord, QC | reply to siva
I am not familiar with C++, and I m very old to learn it  . Do you use CRC-16 or CRC-32 to calculate the 2 bytes (checksum). |
|
Quattrohead
join:2005-02-09
1 edit | There are going to be lots of these on the market now that people have used their 1 year up at P8 and moved on. P8 don't want the units back. |
|
hellosiva
@sbcglobal.net
| reply to chawarma
said by chawarma  :I am not familiar with C++, and I m very old to learn it . Do you use CRC-16 or CRC-32 to calculate the 2 bytes (checksum). It is a modified version of CRC-16 (CCITT version). |
|
chawarma
join:2007-08-07
Montreal-Nord, QC
| reply to siva
I'm doing something wrong !!!!! I'm using a software (Hex Workshop) to calculate the CRC-16 (CCITT version), but I get a wrong result. This is what I did:
1) download the firmware "ftp://ftp.leadtek.nl/mirror/voip/sip_bva8053r_rt_voi22.zip"
2) unzip the file and extract "sip_bva8053r_rt_voi22.r0"
3) load the firmware file (1572864 bytes) into the software,
4) cut off the first 2 bytes (62 04) so now the file is (1572862 bytes),
5) excecute the CRC-16 (CCITT version) checksum
6) the result is (10 57) instead of (62 04). |
|
siva
join:2008-08-28
Mentor, OH
| How do you load the firmware file into the software?
Have you tried loading the sip_bva8053r_ar18e.zip directly into BPG510? That looks more closer (in hexedit) to the original firmware file from packet8. The file AR18D-E-release-notes.pdf claims that the firmware works with 8053RL which is BPG510.
The CRC-16(CCITT) slightly modified. I am attaching the compiled C++ program. You can run it on a command line with the file name as the argument.
|
|
chawarma
join:2007-08-07
Montreal-Nord, QC
| reply to siva
Thank you siva for the program, It did the job well. I 'll try to translate it to Delphi, because I'm more familiar with it.
I don't remember if I tried loading the sip_bva8053r_ar18e.zip into a BPG510 but all I can remember is that the loader in Packet8 doesn't accept
leadtek firmware. Now, we have to substitute the loader in the leadtek firmware with the one in Packet8 firmware. I hope that I'll find my notes that I wrote a year ago |
|
Quattrohead
join:2005-02-09 | If you need a tester, I will donate my time and device to try it, no harm in bricking mine if it does not work out !!! |
|
boatman9
join:2003-07-28
Portland, OR
| reply to siva
Well, I just received a BPG510 and tried to load Leadtek firmware. Neither sip_bva8053r_rt_voi22.r0 nor sip_bva8053r_ar18e.r0 would load. Are we sure that the BPG510 is really a re-branded BVA8053R? If it is in fact a BVA8053R then I must have encountered the checksum issue. Anyone have firmware that will load into this unit? |
|
hiradttx
join:2002-03-08
Parlin, NJ
|  
Here is what the inside looks like |
Any suggestions to bring it back to life?  Can anything be connected to read and flash the chip? |
|
