Re: [Unlock] Another UIP1868P unlock thread in VOIP Tech Chat http://www.dslreports.com/forum/r22643335 en Thu, 18 Mar 2010 06:34:08 EDT Thu, 18 Mar 2010 06:34:08 EDT Re: [Unlock] Another UIP1868P unlock thread http://www.dslreports.com/forum/remark,22651491 toro : As far as flashing the firmware goes, all the P8 adapters I've seen (3 or 4 models) have an option to do so right in the web interface and don't ask for any password. Doesn't this one have it too ?
I think a bigger problem would be to obtain a firmware that gives the user access to the SIP settings.]]> http://www.dslreports.com/forum/remark,22651491 Fri, 03 Jul 2009 19:51:26 EDT Re: [Unlock] Another UIP1868P unlock thread http://www.dslreports.com/forum/remark,22651222 rcilink :
said by aszabados See Profile :

Yeah, I saw that in another thread about the DTA-310, which is why I labeled it that way. Theoretically, if there is advanced functionality (such as IDE - not likely, just saying) present, it should show up in the JTAG chain.
That "proprietary" port on the VoIP board is known as the Host Interface. You need a HOST cable, connected to a STIC box, connected to your PC... so you can burn firmware directly to the device.

I have not been able to obtain this cable and STIC box device. It was something Netergy sold as part of a development kit... way back when.
See link: »www.design-reuse.com/news/5917/n···ogy.html

Netergy was a division of 8x8, the division that made the Audacity T2U DSP, etc.

I don't know today where it is, but Myson Century and LeadTek had been making devices using the same T2U DSP model.

Maybe if there were any interest in this, we could get 8x8 to re-issue a development kit (I'm sure it would be a cost involved, but still...).

Also, if they make it licensed similar to the Apple iPhone, they could retain rights to apps or firmware designed using this kit.]]> http://www.dslreports.com/forum/remark,22651222 Fri, 03 Jul 2009 18:44:43 EDT Re: [Unlock] Another UIP1868P unlock thread http://www.dslreports.com/forum/remark,22651028 aszabados :
said by rcilink See Profile :

If you find this to really be a JTAG interface, let me know.
I've been a bit busy, but did build a simple JTAG cable for this connector based on Lattice documentation. If this approach doesn't work I might have to order the buffered Lattice cable (it's about 50 bucks, though, compared to my $7 home-brew).

said by rcilink See Profile :

I have both the UIP1868P and UIP1868G devices. Yes, the "G" (generic) version firmware is very different.
Unfortunately, I don't have access to a -G version of the UIP. Is the VoIP board in these two the same, i.e. are the -P and the -G versions truly the same hardware, just with different firmware?

said by toro See Profile :

BTW, the connector that you labeled as "probably proprietary" is part of all the Packet 8 adapters, including the ones in the "old generation" like DTA310, BPA410, etc
Yeah, I saw that in another thread about the DTA-310, which is why I labeled it that way. Theoretically, if there is advanced functionality (such as IDE - not likely, just saying) present, it should show up in the JTAG chain.]]> http://www.dslreports.com/forum/remark,22651028 Fri, 03 Jul 2009 18:01:33 EDT Re: [Unlock] Another UIP1868P unlock thread http://www.dslreports.com/forum/remark,22645378 mazilo :
said by toro See Profile :

In the case of the UIP1868V (made for Vonage) the PCB and the components used are very similar to the Motorola VT2142 made for Vonage.
I believe you meant UIP1869V. :D]]> http://www.dslreports.com/forum/remark,22645378 Thu, 02 Jul 2009 14:09:11 EDT Re: [Unlock] Another UIP1868P unlock thread http://www.dslreports.com/forum/remark,22643737 toro : From what I've noticed so far, the Uniden UIP1868 phones are basically made of two parts: the phone part which is on one PCB, connected to the VoIP part which is on another PCB.
The only connections between the two are for power and phone lines and it almost looks like the VoIP PCB is not made by Uniden. Even the power adapter gives two separate voltages, one for the phone part and the other for the VoIP part.
In the case of the UIP1868V (made for Vonage) the PCB and the components used are very similar to the Motorola VT2142 made for Vonage. All the web pages are also extremely similar except for background color and a logo. Much of the knowledge we have for Vonage CYT devices applies to this (CYT unlocker, unlocking by JTAG).
As for the UIP1868P, the PCB and components used are very similar to other packet 8 devices. I am not sure who makes the Packet 8 VoIP adapters recently (maybe themselves ?) So if one were to unlock this, I am pretty confident that the knowledge would apply to other recent packet 8 adapters.
BTW, the connector that you labeled as "probably proprietary" is part of all the Packet 8 adapters, including the ones in the "old generation" like DTA310, BPA410, etc]]> http://www.dslreports.com/forum/remark,22643737 Thu, 02 Jul 2009 08:50:07 EDT Re: [Unlock] Another UIP1868P unlock thread http://www.dslreports.com/forum/remark,22643335 rcilink : If you find this to really be a JTAG interface, let me know. I have both the UIP1868P and UIP1868G devices. Yes, the "G" (generic) version firmware is very different.

The version of Asterisk running here is still 1.09 and strangely, the UIP1868P is more reliable working with it than the unlocked "G" unit. Some of the issues I had with the generic version had to do with device crash/lockups and requiring cold restart of the phone.

No, the Packet8 firmware will not use the 2nd FXS port. I think it had to do with a performance issue, dont remember anymore.]]> http://www.dslreports.com/forum/remark,22643335 Thu, 02 Jul 2009 03:37:19 EDT [Unlock] Another UIP1868P unlock thread http://www.dslreports.com/forum/remark,22643262 aszabados : OK, so I have a UIP 1868P that I want to unlock (and use with another provider) just like the guys here:

»[Unlock] Question about UIP1868P

and here

»[Equipment] Can unlock Uniden UIP1868 ?

Now, simply uploading the generic firmware via the web interface doesn't work, the Packet8 loader will not accept it - I assume there is some sort of checksum'ing going on. One could probably reverse engineer this but that seems like a lot of work in non-mainstream binary code.

As an alternative, cgigate mentioned in one of the threads, that one way to upload the generic firmware was via desoldering the flash chip, flashing it in a programmer and resoldering it. This is a really daunting task if one doesn't have special equipment. I also consider this pretty much a non-starter.

Now, looking at the UIP-1868's circuit board, I noticed a few of neat things:

0) the UIP-1868P is pretty much a standard POTS Uniden 5.8 GHz wireless basestation bolted on top of a Uniden DTA motherboard. There are only 2 (!) wires connecting the phone part to the DTA. The only other connection is the power supply.

1) there is a button close to the middle that looks like the reset button on some Mac motherboards. It seems to act as a second reset switch similar to the one in the back of the device. Not earth-shattering, but hey.

2) a second FXS port (just break off the plastic that covers it). Don't know if this can be configured with Packet8 firmware.

3) A Centilium CT-GWM7002-TP-AA. This is a DSP for VoIP applications, I believe; deals with the various codecs, converts from analog phone to VoIP and vice versa, deals with all the DTMF magic.

But most interestingly:

4) A Lattice ispMACH LC4032V controller very close to the flash chip

and finally...

5) an 8-pin header really close to the Lattice ispMACH that looks suspiciously like a 8x1 JTAG connector.

Now, JTAG is a way to talk to controllers on a very low level and it is very useful for flashing firmware (people use this method to unbrick WRT54g routers after firmware uploads gone bad). Usually all that is needed is a very basic cable that connects to the parallel port on a PC (I built one of these for a bricked WRT54g once).

Fortunately, Lattice is extremely generous in offering software and technical information on how to interact with is chip. As luck would have it, Lattice refers to an 8x1 JTAG connector in its literature.

This leads me to believe that one can probably relatively easily tell the ispMACH to dump, erase and load the flash memory as one pleases, circumventing packet8's firmware loader.

I have attached a gross overview of the the circuit board. I will take some better pictures as I progress with this.

If anyone has experience with the programming/control of the Lattice chip this could probably speed things up quite a bit.
Click for full size
It's just a DTA under there
]]> http://www.dslreports.com/forum/remark,22643262 Thu, 02 Jul 2009 02:45:37 EDT