O Canada! > Canadian > Canadian Broadband > How to Unlock a Spa 2102 locked with Primus

How to Unlock a Spa 2102 locked with Primus

I have worked for Primus for a few years. As per what we were told by management then, it is not possible to use the SPA2102 with another VOIP provider. To find the IP for the SPA, connect the ethernet port to your computer and in command promot enter the command: ipconfig

The gateway is the ip of the SPA.

Its possible if he can get non ISP firmware from cisco or another provider that doesnt lock it.

reply to pcouturier
that is the tipical answer of someone who worked in a sales related division. Someone who works in a technical position would be better off to answer this question, someone who can verify if a factory reset will drop the primus configration or is it burned in the rom?
--
Happiness is like peeing your pants... Everyone can see it, but only you can feel its Warmth!!

I used to work in technical support btw....

then why didn't you give the op the IVR command of the gateway ip? its easier

reply to Paolo
he needs admin password or a flash wont work.He needs to brute force it to get admin or somehow upload a cfg that over rides whats there but that to probably needs the admin pass

then imho its not worth it to waste time trying to do so. just sell it privately on kajiji or craigs list or hofo as a private sale to someone who wants to join primus for less than what primus offers to sell them for
--
Happiness is like peeing your pants... Everyone can see it, but only you can feel its Warmth!!

Nobody should ever buy their shit but from what I have read so far even if you bought your own they upload their own firmware that cripples it anyway.If you buy it and its paid for it should be a law to say unlock it.no if's and's or but's

OK, I think no body understood my question properly.
I am describing it in detail.

To unlock Any SPA 2102. You need to do following procedure.

1. First find out IP address of the server from where the Box accesses the .cfg file. ( .CFG file contains the information of password as well as another configuration for Voip service).
The main idea to know the IP address of the server is to fake the server at home and load our own .cfg file with defined or known password.

2. Once you load the file to the box , you can access your SPA 2102.

++ problem after loading configuration( .cfg) file++

After loading .cfg file, if you connect your box to the internet it start accessing the server and download .cfg file , which can lock your box again with the same service provider.

3. Now what is the procedure to know the IP of the server from where the Box accesses the .cfg file.

Connect your box to the router and capture traffic using the wire-shark program( I don't know how to do it actually, I am new to wire-shark , I stuck here that is why I have posted the question about wire-shark in the beginning, to know the server I.P.).

4. After knowing the server IP, you can configure your home network’s sub-net same as the server's sub-net. And make your computer as a server( I mean assign server address to your computer). And put .cfg file into your computer using --- . ( I forgot how I did it, but u can find in other forums).

5. After that you can connect your box to the router , it will download your own config file( with your own password). Once it download the file disconnect from internet and log in to the SPA 2102.

6. After that, configure with new provider's server( IP address)
Thats All

Now, My question is how to use wireshark to know the IP of Service provider, From where the BOx access .cfg file???????????????????????????

reply to andyb
Re: How to Unlock a Spa 2102 locked with Primus

(((( ALL DFTAIL GIVEN HERE IS FOR EDUCATION PURPOSE ONLY))))
OK, I think no body understood my question properly.
I am describing it in detail.

To unlock Any SPA 2102. You need to do following procedure.

1. First find out IP address of the server from where the Box accesses the .cfg file. ( .CFG file contains the information of password as well as another configuration for Voip service).
The main idea to know the IP address of the server is to fake the server at home and load our own .cfg file with defined or known password.

2. Once you load the file to the box , you can access your SPA 2102.

++ problem after loading configuration( .cfg) file++

After loading .cfg file, if you connect your box to the internet it start accessing the server and download .cfg file , which can lock your box again with the same service provider.

3. Now what is the procedure to know the IP of the server from where the Box accesses the .cfg file.

Connect your box to the router and capture traffic using the wire-shark program( I don't know how to do it actually, I am new to wire-shark , I stuck here that is why I have posted the question about wire-shark in the beginning, to know the server I.P.).

4. After knowing the server IP, you can configure your home network’s sub-net same as the server's sub-net. And make your computer as a server( I mean assign server address to your computer). And put .cfg file into your computer using --- . ( I forgot how I did it, but u can find in other forums).

5. After that you can connect your box to the router , it will download your own config file( with your own password). Once it download the file disconnect from internet and log in to the SPA 2102.

6. After that, configure with new provider's server( IP address)
Thats All

Now, My question is how to use wireshark to know the IP of Service provider, From where the BOx access .cfg file???????????????????????????

reply to kawwalli
I used to work somewhere where we had several large boxes of SPA2102, which were locked to someone we used to resell service from. We never figured out how to unlock them to put on the new config, to be fair we didn't really put too much effort into it. They were in that box for atleast 3 years, maybe longer

if you "work" for the provider, you can "push" a different firmware on the device or get access to the admin pass and clear the cfg and upg path. then manually load a custom firmware back on to it, this is what providers do when they buy another company out and want to amalgamate all the devices to a single firmware
--
Happiness is like peeing your pants... Everyone can see it, but only you can feel its Warmth!!

reply to balur
The following document describes strageties and technologies used by ISPs to remotely provision those SPA units:

»www.graphica.com.au/doco2.html

and specifically:

»www.graphica.com.au/linksys-spa-config.html

The Cisco Provisioning Guide (should point to a SPA_provisioning_v3.pdf document) gives the details of how it is done.

From a Wireshark point of view, you need to have promiscusous access to the packets going to/from the SPA unit. (either by having it connected to your computer or using a switch that allows one port to monitor the traffic of the other port.

Once you yave wireshark listening onto all of the traffic from the unit, power the unit on and see what it does.

If you have a DHCP server on your lan, you can configure parameter 66 (TFTP server as well as a file name) and after the SPA has gotten its DHCP offer, it will try to connect to the designated TFTP server and ask for the file (this is documented in that .pdf).

reply to kawwalli
Another stumbling block potentially: does the SPA required signed CFG files or some kind of authentication? If it does, your method won't work either. All our IP phone at work required that the config server be authenticated.

If you do a factory reset, it appears that the unit will accept an unsigned config.

Another thing you could try is to statically assign it an IP address via your DHCP server, and then tell your router to dismiss all packets coming from that IP address. This way, the router would not transmit any TFTP or HTTP or HTTPS request coming from the SPA 2102 unit and the unit would fail to obtain its config. You might then be able to configure it yourself. In the .PDF document I pointed to above, there is a means to get the factory reset.

If it is similar to the spa3012 with latest firmware it will ask for an admin password to do the full reset. I almost outsmarted myself with this one in my quest for security and had a stunned look until I remembered which box and directory I had hidden my super secret reminder in.

If the worst comes to worst there is a chap by the name of Dogface05 who frequents the dslr voip chat that can reportedly remotely unlock the wee beasts for a fee.

reply to Paolo

reply to Vomio
FIY just like Vomio said, Dogface05 unlocked my primus locked SPA in a few minutes, he is trust worthy.

I also recommend having your device professionally unlocked. His contact information is: DogFace05