Topic 'Re: [Unlock] TUTORIAL: VONAGE WRTP54G WITH 5.01.04' in forum 'VOIP Tech Chat' - dslreports.com

Re: [Unlock] TUTORIAL: VONAGE WRTP54G/RTP300 WITH 5.01.04

Thu, 10 Feb 2011 00:13:29 EDT

screenname posted : I bought a used RTP300 with firmware 5.01.04 off CL. Tried the procedure but did not get any output at part 1 step 3...

Re: [Unlock] TUTORIAL: VONAGE WRTP54G/RTP300 WITH 5.01.04

Wed, 02 Feb 2011 16:01:58 EDT

marli2 posted : Hi.
i'd just joined to thank you for this, I really love when people amalgamte hacks together into howtos.
I'd like to thank all the hackers and coders who allowed me to replace my 5 boxes with 2.
again thankyou, this worked perfectly.
(unfortunatly my capasiter are apparently going so will only do 10baseT on ethernet :( :() oh well.

Re: [Unlock] TUTORIAL: VONAGE WRTP54G/RTP300 WITH 5.01.04

Sat, 25 Dec 2010 01:15:15 EDT

anon posted : I have a RTP300. I was able to get through the downgrade to version 1.00.62 (it previously had version 1.01.17). I then downloaded and ran CYT 4.6 after trying unsuccessfully to unlock with CYT 3.5 (still don't know why the newer version worked, but I'm not actually sure it did unlock, even though it told me that it had done so successfully and changed the password to Admin/Admin and user/user.)

I am not able to upload the modified version Linksys firmware 3.1.24 posted by Phoenix2088 a few pages back. First, I still need to use user/tivonpw to enter the firmware /upgrade.html page (admin/admin, user/user, and Admin/Admin do not work). Second, after uploading, the upgrade fails with "No/Invalid Magic number".

Ideas? :)

Re: [Unlock] TUTORIAL: VONAGE WRTP54G/RTP300 WITH 5.01.04

Wed, 22 Dec 2010 15:59:21 EDT

toro posted :

said by Pat O :

A side note which is only speculation but might help: when running the wr script, an Admin password is shown in the Ping response when it completes. I do not know if this password is “in the clear”, but if CYT continues to fail, you might try using that password for the Admin user when updating the firmware at the update.html page.

Nope, that is the encrypted factory password. It will not work for any of the login pages.
--
»www.voipfan.net

Re: [Unlock] TUTORIAL: VONAGE WRTP54G/RTP300 WITH 5.01.04

Wed, 22 Dec 2010 09:21:40 EDT

anon posted : It appears some latecomers experienced some of the same problems I did. I later had success.

When using CYT, it always hung up on “XML server started”. The Admin password on the router was not getting changed, and I was always getting a “bad username or password” when logging into the provider settings at »192.168.15.1/update.html.

I did not have access to shut down the firewall or antivirus on the PC I was using. I changed to another machine where I had these rights, and shut down those items. When running CYT 3.5, again it ran at “XML server started” for longer than a minute, but this time when I used escape to exit out, I received the success message that the Admin password had been changed. It had, and I was able to proceed with installing the latest firmware from the Linksys site which I had hex-modded per the provided instructions.

A side note which is only speculation but might help: when running the wr script, an Admin password is shown in the Ping response when it completes. I do not know if this password is “in the clear”, but if CYT continues to fail, you might try using that password for the Admin user when updating the firmware at the update.html page.

Thanks very much to all on this thread who contributed to this unlocking!!! Hope my notes help someone else.

Re: [Unlock] TUTORIAL: VONAGE WRTP54G/RTP300 WITH 5.01.04

Tue, 14 Dec 2010 13:33:44 EDT

toro posted : Oh, and one other thing, try a factory reset (hold down the reset button for 10 seconds). If it's coming from another company, maybe the router isn't even locked. Very few companies used customized RTP300s.
--
»www.voipfan.net

Re: [Unlock] TUTORIAL: VONAGE WRTP54G/RTP300 WITH 5.01.04

Tue, 14 Dec 2010 13:13:05 EDT

toro posted : Probably no, but there may be easier methods available for other routers. What firmware version do you have on yours and what provider is it coming from ?
--
»www.voipfan.net

Re: [Unlock] TUTORIAL: VONAGE WRTP54G/RTP300 WITH 5.01.04

Tue, 14 Dec 2010 11:20:10 EDT

hongo posted : Does this method work for non-Vonage Linksys RTP300 routers?

Re: [Unlock] TUTORIAL: VONAGE WRTP54G/RTP300 WITH 5.01.04

Sat, 09 Oct 2010 00:31:16 EDT

fun4stuff posted : ...................

Re: [Unlock] TUTORIAL: VONAGE WRTP54G/RTP300 WITH 5.01.04

Fri, 08 Oct 2010 21:04:10 EDT

toro posted : The only way a router made for Vonage would have firmware 3.x would be if someone has unlocked it already.
Have you actually tried to do a factory reset (hold reset for about 8 seconds) and then try to login to the VoIP settings ?
--
»www.voipfan.net

Re: [Unlock] TUTORIAL: VONAGE WRTP54G/RTP300 WITH 5.01.04

Fri, 08 Oct 2010 19:12:20 EDT

fun4stuff posted : you are right. it is an earthlink router. not sure how i made that mistake. thanks for your help! i got it working using the link you provided.

Re: [Unlock] TUTORIAL: VONAGE WRTP54G/RTP300 WITH 5.01.04

Fri, 08 Oct 2010 18:09:59 EDT

toro posted : As I said in my previous post, that is not a Vonage router, it's an Earthlink one.
A simple Google search for unlock earthlink wrtp54g reveals this thread: »[WRTP54G-ER] How to unlock and re-use this earthlink device.
--
»www.voipfan.net

Re: [Unlock] TUTORIAL: VONAGE WRTP54G/RTP300 WITH 5.01.04

Fri, 08 Oct 2010 18:04:12 EDT

fun4stuff posted : i have searched but can't seem to find how to do it. i think i am probably misunderstanding something. i have this router here:

»www.amazon.com/Cisco-WRTP54G-Wir···009P657S

wrtp54g locked for vonage. It says the firmware that is currently load is 3.1.27, but I can't seem to find anything about how to unlock this.... everything is for either 1.x or 5.x or about upgrading to 3.1.27-ET

Re: [Unlock] TUTORIAL: VONAGE WRTP54G/RTP300 WITH 5.01.04

Thu, 07 Oct 2010 19:30:57 EDT

toro posted : Since your firmware is 3.1.27 and not 5.01.04 as the thread implies, the information here doesn't apply to you. If you have a locked router it is mostly an Earthlink one, not from Vonage.
The procedure is different, register an account and search the forum.
--
»www.voipfan.net

Re: [Unlock] TUTORIAL: VONAGE WRTP54G/RTP300 WITH 5.01.04

Thu, 07 Oct 2010 19:05:30 EDT

fun4stuff posted : "127.0.0.1 &&sh /var/tmp/rf

You should now see a file transfer in progress under TFTP32. After the firmware has been transferred the power light on the WRTP54G will start to blink if everything is successful. DO NOT INTERRUPT THIS PROCESS. IT MAY TAKE UP TO 2-4 MINUTES TO COMPLETE."

I get through the first steps fine: I unlock it in the first 3 steps and am able to transfer the rf file over. But when I get to the step above nothing happens. Firmware continues to read 3.1.27. The lights don't blink. TFTP32 doesn't say anything about a file transfer. I am using the WRTP54G.thanks

Can ssh into the router as root. Now what?

Sat, 11 Sep 2010 01:26:01 EDT

kot posted : Ok, by painstakingly using the ping-hack, I was able to add an entry for myself into /var/tmp/passwd:

Admin:x:0:0:Root,,,:/:/bin/shmi:x:0:0:Misha,,,:/:/bin/sh

and /var/tmp/shadow:

Admin:ABDmMMxQD.w52:11876:0:99999:7:::mi:ABW9wzpK6VV4Q:11876:0:99999:7:::

and can now ssh into the box (RTP-300 running the 5.01.04 firmware) as user mi, password Admin (the account is alias for Admin, because the UID is zero). I get the shell prompt (ash). The box runs dropbear for ssh-server, thttpd for HTTP-server, something called lightbox, and a bunch of ggsip-processes (whatever they are).

What do I do now? How can I make the change permanent - currently I'm sure, I'll need to re-hack it after a reboot, as the files I modified will be overwritten?

How do I configure it to use a non-Vonage VoIP-provider?

Once properly modified, would I be able to dump the configuration outside so that it would be uploadable to another RTP-300? I'd be happy to let it lose on the P2P networks for the others...

Thanks a lot for advice!

Re: Unlock : VONAGE WRTP54G WITH 5.01.04

Fri, 16 Jul 2010 12:42:37 EDT

fergs posted : OK Success..

For some stupid reason the wireless was turning itself on while it was trying to downgrade the firmware.

All fixed now and now loaded the Firmware Version: 3.1.17

I read that this is the "current" version for all to use ??

Can someone clarify IF this is only for USA or worldwide as I'm "Down Under" in Australia..

Next please.. to look to the next firmware upgrade, whats the user name & Password ???

thanks & will report more soon.

Re: Unlock : VONAGE WRTP54G WITH 5.01.04

Fri, 16 Jul 2010 11:58:13 EDT

fergs posted :

said by toro:

Is your ethernet connection to the WRTP54G stable ? Many of those routers develop after a while issues with the ethernet switch (where the switch just can't keep the connection up). Setting the computer's ethernet adapter at 10Mb/s (instead of 100) seems to help in some cases.

Thanks for the tip

reduced nic to 10 Mbps 1/2 Duplex (Old Dell GX240 with XP Pro SP2 )

same result

Connection received from 192.168.15.1 on port 2050 [16/07 23:45:06.875]
Read request for file . Mode octet [16/07 23:45:06.906]
Using local port 1311 [16/07 23:45:06.921]
: sent 1 blk, 85 bytes in 0 s. 0 blk resent [16/07 23:45:06.937]
Rcvd DHCP Rqst Msg for IP 0.0.0.0, Mac 00:06:5B:7C:A2:69 [16/07 23:47:28.812]
Rcvd DHCP Rqst Msg for IP 0.0.0.0, Mac 00:06:5B:7C:A2:69 [16/07 23:47:33.484]
Rcvd DHCP Rqst Msg for IP 0.0.0.0, Mac 00:06:5B:7C:A2:69 [16/07 23:47:37.484]
Rcvd DHCP Rqst Msg for IP 0.0.0.0, Mac 00:06:5B:7C:A2:69 [16/07 23:47:45.484]
Connection received from 192.168.15.1 on port 2050 [16/07 23:49:20.812]
Read request for file . Mode octet [16/07 23:49:20.812]
Using local port 1407 [16/07 23:49:20.812]
: sent 1 blk, 101 bytes in 0 s. 0 blk resent [16/07 23:49:20.828]
Connection received from 192.168.15.1 on port 2051 [16/07 23:50:45.546]
Read request for file . Mode octet [16/07 23:50:45.562]
Using local port 1411 [16/07 23:50:45.562]
TIMEOUT waiting for Ack block #7086 [16/07 23:53:41.500]

** 1 thing I need clearing up please **

after getting CONSOLE_STATE unlocked am I supposed to power cycle the router ?? or is that point for those who are starting at step 4 regarding the unlocking the RTP300

Re: Unlock : VONAGE WRTP54G WITH 5.01.04

Fri, 16 Jul 2010 10:30:22 EDT

toro posted : Is your ethernet connection to the WRTP54G stable ? Many of those routers develop after a while issues with the ethernet switch (where the switch just can't keep the connection up). Setting the computer's ethernet adapter at 10Mb/s (instead of 100) seems to help in some cases.
--
»www.voipfan.net

Re: Unlock : VONAGE WRTP54G WITH 5.01.04

Fri, 16 Jul 2010 10:12:41 EDT

fergs posted : Hi all, Trying to unlock the WRTP54G ANY help appreciated as I'm in Australia & NO IDEA why this is even in the country in its current "Locked state".

Firmware Version: 5.01.04

I have no problem getting to this point .. CONSOLE_STATE unlocked.

then after starting step 4 Downgrading Firmware to 1.00.62 I do the 3 "ping steps" & this happens

Connection received from 192.168.15.1 on port 2050 [16/07 21:34:59.015]
Read request for file . Mode octet [16/07 21:34:59.046]
Using local port 1203 [16/07 21:34:59.078]
: sent 1 blk, 85 bytes in 0 s. 0 blk resent [16/07 21:34:59.078]
Connection received from 192.168.15.1 on port 2051 [16/07 21:37:52.828]
Read request for file . Mode octet [16/07 21:37:52.843]
Using local port 1209 [16/07 21:37:52.843]
: sent 1 blk, 101 bytes in 0 s. 0 blk resent [16/07 21:37:52.859]
Connection received from 192.168.15.1 on port 2052 [16/07 21:39:23.046]
Read request for file . Mode octet [16/07 21:39:23.046]
Using local port 1213 [16/07 21:39:23.062]
Ack block 7076 ignored (received twice) [16/07 21:39:55.781]
Ack block 7080 ignored (received twice) [16/07 21:40:52.875]
Ack block 7083 ignored (received twice) [16/07 21:41:25.109]
Ack block 7086 ignored (received twice) [16/07 21:42:27.140]
Ack block 7087 ignored (received twice) [16/07 21:42:35.578]
Ack block 7094 ignored (received twice) [16/07 21:44:18.734]
TIMEOUT waiting for Ack block #7102 [16/07 21:48:15.281]
Rcvd DHCP Rqst Msg for IP 0.0.0.0, Mac 00:06:5B:7C:A2:69 [16/07 22:08:58.890]
Rcvd DHCP Rqst Msg for IP 0.0.0.0, Mac 00:06:5B:7C:A2:69 [16/07 22:09:03.906]
Rcvd DHCP Rqst Msg for IP 0.0.0.0, Mac 00:06:5B:7C:A2:69 [16/07 22:09:11.890]
Rcvd DHCP Discover Msg for IP 0.0.0.0, Mac 00:06:5B:7C:A2:69 [16/07 22:09:40.515]
Client requested address 192.168.15.100 [16/07 22:09:40.515]
no more address or address previously allocated by another server [16/07 22:09:40.515]
Rcvd DHCP Rqst Msg for IP 0.0.0.0, Mac 00:06:5B:7C:A2:69 [16/07 22:09:40.593]

Can someone please help me unlock this unit.

Thanks in advance

Re: [Unlock] TUTORIAL: VONAGE WRTP54G/RTP300 WITH 5.01.04

Mon, 14 Jun 2010 15:05:56 EDT

frufru posted : Well i did have to hunt for the power brick in some cable boxes, but yeah sometimes you get good deals. I am however, quite disappointed as I thought this was a wireless AP which is somewhat more resaleable.

Personally I have no use for a SIP ATA. At home i use cel phones and at work its all cisco SCCP. Ebay says they are only worth 25 bucks anyway. I guess if i wanted to play around with asterisk or something i could use it for that, but i dont have the time.

Re: [Unlock] TUTORIAL: VONAGE WRTP54G/RTP300 WITH 5.01.04

Mon, 14 Jun 2010 14:22:32 EDT

toro posted :

said by frufru:

1) Purchased an RTP300 router at a garage sale for 1 dollar.

I'm jealous of all the people who find different ATAs for $1-5 at garage sales ;)
All I can find is useless junk.

Re: [Unlock] TUTORIAL: VONAGE WRTP54G/RTP300 WITH 5.01.04

Mon, 14 Jun 2010 14:11:10 EDT

frufru posted : Hi All! just wanted to reflect my experience.

1) Purchased an RTP300 router at a garage sale for 1 dollar.
2) Got it home and powered it up, find it locked down to vonage (whoever they are) and google out to find an unlock.
3) Find your pages, and try and perform the ping hack. Ping hack does not work for me! seems like the router will NOT talk to my tftp server (original firmware was 1.01.07)
4) Fire up the cyt35 program, and perform option 1.
5) option 1 WORKS! router now able to upload firmware with User/Password as Admin/Admin (case sensitive)
6) Download the updated 3.1.24 firmware from pheonix2088 (page 14)
7) flash firmware and it seems to all work! Voice tab states firmware as 3.1.22, but it opens up now. Rest of router states firmware as 3.1.24 so i assume its call good.

Thanks for the tutorial!

Re: [Unlock] TUTORIAL: VONAGE WRTP54G/RTP300 WITH 5.01.04

Sun, 30 May 2010 16:32:17 EDT

Phoenix2088 posted :

said by Tim jenson :

This work and its easy »thegeekoftheworld.com/unlock-rtp300/

This works too as it is an exact copy of my original post. ;)

Re: [Unlock] TUTORIAL: VONAGE WRTP54G/RTP300 WITH 5.01.04

Sat, 22 May 2010 18:39:23 EDT

anon posted : This work and its easy »thegeekoftheworld.com/unlock-rtp300/

Re: [Unlock] TUTORIAL: VONAGE WRTP54G/RTP300 WITH 5.01.04

Sat, 15 May 2010 08:57:33 EDT

ophelus posted :

said by Nulland:

I have been able to unlock my Vonage wrtp54g, thanks to Phoenix2088 and his detailed guide. It's now working well with fw ver 3.1.27 that I modified to load on the unit. It's available for download here:

»www.mediafire.com/file/cy4dilwyd···.27M.img

Yah, that's great.. I got nitzan to get it going on F9.. but problem is it really does't work.. I couldn't get it going for more then a second on voip.ms last time I wasted 3-5 hours on this thing.. it's just junk time to call it..

Re: [Unlock] TUTORIAL: VONAGE WRTP54G/RTP300 WITH 5.01.04

Thu, 13 May 2010 23:37:15 EDT

Nulland posted : I have been able to unlock my Vonage wrtp54g, thanks to Phoenix2088 and his detailed guide. It's now working well with fw ver 3.1.27 that I modified to load on the unit. It's available for download here:

»www.mediafire.com/file/cy4dilwyd···.27M.img

Re: [Unlock] TUTORIAL: VONAGE WRTP54G/RTP300 WITH 5.01.04

Sat, 08 May 2010 01:40:47 EDT

havarian posted : Thanks,
I managed to unlock the device, using disabled javascript, I managed to get the key which I used to encrypt the xml config file and feed it to the router

Re: [Unlock] TUTORIAL: VONAGE WRTP54G/RTP300 WITH 5.01.04

Fri, 07 May 2010 15:10:13 EDT

toro posted :

said by havarian:

yes, it's in a different folder, but always return file not found, either for root or for the folder.

I tried to spoof the tftp site and feed a plain xml file, but it doesn't accept plain xml file.

You won't be able to feed it your own XML it if you don't know the RC4 encryption key. Have you tried to leave one of the routers connected to the internet to see if it would get upgraded to 5.01.04 ?
If the router doesn't get upgraded, you can use either a JTAG to unlock it, or the original method with disabling Javascript found here »[Vonage] SIP credentials, RTP300, GPP_K?

Re: [Unlock] TUTORIAL: VONAGE WRTP54G/RTP300 WITH 5.01.04

Fri, 07 May 2010 14:59:44 EDT

havarian posted : yes, it's in a different folder, but always return file not found, either for root or for the folder.

I tried to spoof the tftp site and feed a plain xml file, but it doesn't accept plain xml file.

Re: [Unlock] TUTORIAL: VONAGE WRTP54G/RTP300 WITH 5.01.04

Fri, 07 May 2010 12:31:07 EDT

toro posted :

said by havarian:

It seems that vonage has removed the xml profile for my 2 brand new wrtp54g routers.
I always get tftp error file not found.

Did you use wireshark to find out what subdirectory it tries to download the xml from ? For CYT based devices the configuration is never in the roor.
As far as I remember the CYT unlocker doesn't work on firmware 1.00.20. The last time I unlocked one with that firmware, I left it connected to the internet for some time (I think it took like 10-15 minutes), it got upgraded to 5.01.04 and then I applied the normal unlocking procedure.

Re: [Unlock] TUTORIAL: VONAGE WRTP54G/RTP300 WITH 5.01.04

Fri, 07 May 2010 11:58:17 EDT

havarian posted : Re: [Unlock] TUTORIAL: VONAGE WRTP54G/RTP300 WITH 5.01.04

It seems that vonage has removed the xml profile for my 2 brand new wrtp54g routers.
I always get tftp error file not found.
both with firmware 1.00.20. so, I cannot unlock it
I tried ping hack but it didn't work, also I tried cyt46 without success.
Does anyone has any idea how to unlock the devices (FW 1.00.20)

Re: [Unlock] TUTORIAL: VONAGE WRTP54G/RTP300 WITH 5.01.04

Sat, 01 May 2010 13:29:55 EDT

Phoenix2088 posted : RTP300-NA Modified Firmware

I have received numerous requests for a modified version of the RPT300-NA firmware. Hopefully this will help those out that are unfamiliar with hex editors. I do not have a RTP300 to test this out on, so once again use this firmware at your own risk.

»rapidshare.com/files/382372295/r···FIED.zip

Re: [Unlock] TUTORIAL: VONAGE WRTP54G/RTP300 WITH 5.01.04

Fri, 30 Apr 2010 17:26:30 EDT

ophelus posted : Is anyone using this with voip.ms?

I hooked it up put in all the correct settings I believe (even turned on the NAT) not that it should mattered..

But I get dialtone and dialing out.. but it's not ringing.. I get busy via a landline and I get disconnect from sprint cell within 2 seconds of calling (which is also weird)

Any suggested settings..?? I got this working with future-nine but he had to login and do something really stupid he said that wasn't needed to get it up..

Re: [Unlock] TUTORIAL: VONAGE WRTP54G/RTP300 WITH 5.01.04

Tue, 13 Apr 2010 12:28:11 EDT

panamadan posted :

said by toro:

3.1.17 is in my opinion a pretty bad version with several issues.
For WRTP54G, the newest fw is 3.1.27. For RTP300, the newest is 3.1.24

OK, thanks again. I will go ahead and finish it with 3.1.27.
It sounds like that would be a good thing to do.

Re: [Unlock] TUTORIAL: VONAGE WRTP54G/RTP300 WITH 5.01.04

Tue, 13 Apr 2010 09:44:59 EDT

toro posted :

I thought that finally loading the regular 3.1.17-NA firmware, would give you a permanently unlocked device, but it sounds like that is not so.

Any 3.1.x firmware will give you a permanently unlocked device. The reason you need to modify it it's because it would not load directly on a Vonage router. There's a signature and a checksum that need to be changed in order for the firmware to load.

Is the 3.1.17-NA fw the latest current version for the WRTP54G?
If not, will upgrading to a newer fw version relock the device?

3.1.17 is in my opinion a pretty bad version with several issues.
For WRTP54G, the newest fw is 3.1.27. For RTP300, the newest is 3.1.24

Re: [Unlock] TUTORIAL: VONAGE WRTP54G/RTP300 WITH 5.01.04

Tue, 13 Apr 2010 09:32:40 EDT

panamadan posted :

said by GrauerFuchs:

Even in this thread, we're dealing with different firmwares and different devices (despite the topic name). Some need one version of a hack, some need another. Yes, the physical hardware of the WRTP54G and RTP300 is similar to the PAP2v2 (no NA model was ever made), so by design, CYT is the easiest and fastest method to unlock them. With many of these devices, they must be unlocked before the firmware can be upgraded.

None of the methods above are permanent, however. A factory reset will re-lock the box. For permanent unlocks, you can either use the modified firmware, or you can use the JTAG method to slowly overwrite the entire flash memory on the device and make it into a permanent NA box. Both of these risk bricking your box, and the JTAG method requires in-depth knowledge of the software and hardware as well as a few days' time to spare.

To break it all down, if you can use CYT and it works on your box, use it. If you want to make the change permanent, you'll need the modified unlocked firmware to load once it's unlocked.

Thanks for this clarification, and important information. It is very helpful.
I thought that finally loading the regular 3.1.17-NA firmware, would give you a permanently unlocked device, but it sounds like that is not so.
If only the modified fw version permanently unlocks the device, that is crucial to know and do.
Is the 3.1.17-NA fw the latest current version for the WRTP54G?
If not, will upgrading to a newer fw version relock the device?

Re: [Unlock] TUTORIAL: VONAGE WRTP54G/RTP300 WITH 5.01.04

Mon, 12 Apr 2010 06:41:32 EDT

GrauerFuchs posted : Even in this thread, we're dealing with different firmwares and different devices (despite the topic name). Some need one version of a hack, some need another. Yes, the physical hardware of the WRTP54G and RTP300 is similar to the PAP2v2 (no NA model was ever made), so by design, CYT is the easiest and fastest method to unlock them. With many of these devices, they must be unlocked before the firmware can be upgraded.

RC4 is the encryption used on the provisioning file. This was another method to unlock these devices, and to enable re-unlocks and remote provisioning. While it is falling out of style in hacking the boxes, it still has its uses.

The ping hack was a third method used to break into these boxes. It bypasses all the security put in place. It's awkward to use, but very effective when used on a vulnerable firmware version.

None of the methods above are permanent, however. A factory reset will re-lock the box. For permanent unlocks, you can either use the modified firmware, or you can use the JTAG method to slowly overwrite the entire flash memory on the device and make it into a permanent NA box. Both of these risk bricking your box, and the JTAG method requires in-depth knowledge of the software and hardware as well as a few days' time to spare.

To break it all down, if you can use CYT and it works on your box, use it. If you want to make the change permanent, you'll need the modified unlocked firmware to load once it's unlocked.

Re: [Unlock] TUTORIAL: VONAGE WRTP54G/RTP300 WITH 5.01.04

Fri, 09 Apr 2010 17:42:47 EDT

panamadan posted : Sorry about the RC4 part. I'm not sure where I read that now either.
I've been reading too many threads. Hence my confusion.
It seems the more I read, the more confused I get, when it should be the other way around...

All I want is the easiest way to unlock a WRTP54G, without bricking it.
Is the serial console needed for unlocking or using the device?
Are both the ping hack and the CYT parts of this tutorial necessary?
Did you omit or change either one, with success?
Is the procedure in this thread, in its entirety, the only way that works?
I think you indicated, probably so, but maybe not...

Thanks!

Re: [Unlock] TUTORIAL: VONAGE WRTP54G/RTP300 WITH 5.01.04

Fri, 09 Apr 2010 17:01:17 EDT

toro posted :

said by panamadan:

Is what I read correct then, that the Voip section of an unlocked WRTP54G is functionally the same as an unlocked PAP2?

Yes, that would be quite accurate.

I'm still confused about some other threads describing different procedures for unlocking this device. One is similar to this tutorial, but omits the ping hack part. Another one says that all you need to do is load the -NA firmware. That must be incorrect though, unless you know the Voip admin password.

Well, I guess you could try the other procedures if they look valid. And if they fail, try the one here. All I can tell you is that this forum has some members very experienced in hacking VoIP hardware and if an easier procedure existed, I am sure they wouldn't go through the trouble of creating a more difficult procedure.
There's one thing you can check though: do the other procedures make any mention of the firmware version ? Some people post an unlocking procedure and claim it works for any router and any firmware version. Many times when a hack was made public, Vonage patched it in the next available firmware. They probably don't run as many RTP300/WRTP54G any more to make it worth releasing another firmware version.

I'm also unsure what the part of this tutorial that mentions the RC4 decryption part, is all about. Is that part of the procedure for unlocking the WRTP54G, or something else?

I am not sure where you saw that ?
BTW, personally I use only a part of this hacking method, and only to unlock the serial console. From there, I use the serial console to flash the new firmware through the boot loader.

Re: [Unlock] TUTORIAL: VONAGE WRTP54G/RTP300 WITH 5.01.04

Fri, 09 Apr 2010 16:39:26 EDT

panamadan posted : Thanks for the clarification.
My comments about the PAP2 were referring to the unlocked-NA version of the PAP2.
Is what I read correct then, that the Voip section of an unlocked WRTP54G is functionally the same as an unlocked PAP2?

I'm still confused about some other threads describing different procedures for unlocking this device. One is similar to this tutorial, but omits the ping hack part. Another one says that all you need to do is load the -NA firmware. That must be incorrect though, unless you know the Voip admin password.

I'm also unsure what the part of this tutorial that mentions the RC4 decryption part, is all about. Is that part of the procedure for unlocking the WRTP54G, or something else?

Re: [Unlock] TUTORIAL: VONAGE WRTP54G/RTP300 WITH 5.01.04

Fri, 09 Apr 2010 16:00:24 EDT

toro posted :

said by panamadan:

Thanks for the password explanation.
It sounds like you are saying that doing a factory default reset, with the reset button, will not reset or clear the Voip password. Is that correct?

The factory reset (which can be achieved by holding down the reset button until the lights start flashing - about 8 seconds) will restore the VoIP password to the factory default, which is still unique for each router.

The WRTP54G is new to me, even though it is an older model.
I read somewhere though that the Voip section of the WRTP54G is essentially the same as a PAP2, which I also have, and am familiar with.

They are vastly different. The only thing similar is the web interface for the VoIP settings, but only after it's unlocked and loaded with firmware 3.1.xx

A factory default reset on a PAP2 does reset both the user and admin passwords. Hence my confusion.

Again, not 100% true. On PAP2s that were made custom for different VoIP companies (like Vonage, Voicewing, etc), resetting the device to the factory settings will lead to a locked adapter. Only the -NA version (non customized to a VoIP company) behaves the way you described.

To clarify the unlocking procedure then, the tutorial in this thread is if you don't know the Voip password, but if you do know it, or it is the default Admin/Admin, then all you need to do is upgrade the firmware to the NA version. Is that correct?

I think my previous answers pretty much cover this. The password for the Admin user is not Admin on a factory reset router.

Re: [Unlock] TUTORIAL: VONAGE WRTP54G/RTP300 WITH 5.01.04

Fri, 09 Apr 2010 15:51:36 EDT

toro posted :

said by daveinpoway:

Isn't the username for firmware updates "user"? I have seen "tivonpw" stated as a "universal" password that works for any serial number, but it doesn't do anything for my RTP300. Perhaps it did work with Vonage firmware versions earlier than 5.01.04; I don't know.

The user/tivonpw combination may have worked on the 1.00.xx versions of the firmware (it's been too long ago and I can't remember) but it definitely doesn't work in 5.01.04

Re: [Unlock] TUTORIAL: VONAGE WRTP54G/RTP300 WITH 5.01.04

Fri, 09 Apr 2010 15:38:36 EDT

panamadan posted :

said by toro:

Responding to both daveinpoway and panamadan

Each router has two sets of usernames and passwords. One is for accessing the router part (admin/admin after a factory reset) and one is for the VoIP section.
For the VoIP section each router has a unique password (the username is Admin). Even if someone could find the password for their router, it wouldn't work on another one. The whole purpose of this thread is to teach you how to unlock the router without knowing the VoIP password.

Thanks for the password explanation.
It sounds like you are saying that doing a factory default reset, with the reset button, will not reset or clear the Voip password. Is that correct?

The WRTP54G is new to me, even though it is an older model.
I read somewhere though that the Voip section of the WRTP54G is essentially the same as a PAP2, which I also have, and am familiar with.
A factory default reset on a PAP2 does reset both the user and admin passwords. Hence my confusion.

To clarify the unlocking procedure then, the tutorial in this thread is if you don't know the Voip password, but if you do know it, or it is the default Admin/Admin, then all you need to do is upgrade the firmware to the NA version. Is that correct?

Re: [Unlock] TUTORIAL: VONAGE WRTP54G/RTP300 WITH 5.01.04

Fri, 09 Apr 2010 15:18:11 EDT

daveinpoway posted : Isn't the username for firmware updates "user"? I have seen "tivonpw" stated as a "universal" password that works for any serial number, but it doesn't do anything for my RTP300. Perhaps it did work with Vonage firmware versions earlier than 5.01.04; I don't know.

Re: [Unlock] TUTORIAL: VONAGE WRTP54G/RTP300 WITH 5.01.04

Fri, 09 Apr 2010 14:02:08 EDT

toro posted : Responding to both daveinpoway and panamadan

Each router has two sets of usernames and passwords. One is for accessing the router part (admin/admin after a factory reset) and one is for the VoIP section.
For the VoIP section each router has a unique password (the username is Admin). Even if someone could find the password for their router, it wouldn't work on another one. The whole purpose of this thread is to teach you how to unlock the router without knowing the VoIP password.

Re: [Unlock] TUTORIAL: VONAGE WRTP54G/RTP300 WITH 5.01.04

Fri, 09 Apr 2010 12:53:35 EDT

panamadan posted : I'm working with a WRTP54G.
Doesn't doing a factory default reset, return the passwords to the default admin/admin?
Or is the current password needed to do the factory reset too?
My unit is not with me now, so I can't look at the setup screens to see.

Re: [Unlock] TUTORIAL: VONAGE WRTP54G/RTP300 WITH 5.01.04

Fri, 09 Apr 2010 11:56:27 EDT

daveinpoway posted : Having spent some time playing around with a (Vonage-locked) RTP300, the problem is what password to use to enable the firmware to be changed. I have tried all of the ones I have seen on the Internet; none of them will work. I tried calling Vonage to get a password, and, of course, the answer was "NO" (I expected this, but it was still worth trying).

If you have a password which will work on a Vonage RTP300 (with the 5.01.04 firmware), please let me know what it is.

Re: [Unlock] TUTORIAL: VONAGE WRTP54G/RTP300 WITH 5.01.04

Fri, 09 Apr 2010 09:27:47 EDT

panamadan posted :

said by GrauerFuchs:

It's been a while, but if I remember correctly, the new CYT ran smoothly under the console version of Wine.

OK, thanks.
I have installed Windows XP running as a guest VM with VirtualBox.
Will CYT work that way?

Also, I saw in another thread, that says all that is needed to do is to upgrade the firmware to the 3.1.17-NA version. It does not go through all of these other steps with the CYT program and the ping hack.

Will that work?

Re: [Unlock] TUTORIAL: VONAGE WRTP54G/RTP300 WITH 5.01.04

Wed, 07 Apr 2010 06:37:01 EDT

GrauerFuchs posted : It's been a while, but if I remember correctly, the new CYT ran smoothly under the console version of Wine.