Topic 'Re: [Unlock] Unlocking Linksys SPA2102 adapter' in forum 'VOIP Tech Chat' - dslreports.com

Re: [Unlock] Unlocking Linksys SPA2102 adapter

Sat, 22 Dec 2012 08:40:08 EDT

pulsar777 posted : There is definitely no connector pins on board. I think the most important is, does this chip have In-Circuit-Programming capability or not. If it does not have this capability and therefore, must be removed from PCB to be READ, then it's just not worth the effort, as desoldering a chip, then soldering it back would be very difficult procedure without use an industrial equipment.

Re: [Unlock] Unlocking Linksys SPA2102 adapter

Sat, 22 Dec 2012 07:43:07 EDT

Stewart posted :

said by pulsar777:

yes, I see this. So, in this case the only way to get sip password would be hardware way, i.e. to to read MX29LV160ATTC-70 flash memory and dump it content.

Unfortunately, I know almost nothing about the internals of Linksys ATAs.

It might be difficult to read the device, e.g. it may not be set up for JTAG, or an in-circuit read may be thwarted by other connections to the required pins. Although of course you could physically remove it for reading, you'll need surface-mount rework equipment and a reasonably recent device programmer; perhaps you have that available at your workplace.

The next hurdle is that the data is likely compressed and/or utilizes an error-correcting code. It may take considerable effort to figure out how that works, and if it is non-standard, you would need to write your own decoder/uncompressor.

If you really want those credentials, IMO there are easier approaches; what's best for you is determined by your skill set and interests.

Re: [Unlock] Unlocking Linksys SPA2102 adapter

Sat, 22 Dec 2012 06:54:24 EDT

pulsar777 posted : yes, I see this. So, in this case the only way to get sip password would be hardware way, i.e. to to read MX29LV160ATTC-70 flash memory and dump it content.

Re: [Unlock] Unlocking Linksys SPA2102 adapter

Fri, 21 Dec 2012 21:13:24 EDT

Stewart posted : I'm glad to hear that you got it working.

One last comment: this scheme does not give you access to the SIP password for the existing account in Line 1. If you want that account to keep working, you need to be careful not to accidentally change it, because you have no way to restore the old setting. Be sure that that you don't set the Line 1 password from the web interface or from a config file, and that you don't perform a factory reset. This last one means that you should avoid making any changes, e.g. to the network settings, that could result in losing control of the device.

Re: [Unlock] Unlocking Linksys SPA2102 adapter

Fri, 21 Dec 2012 20:01:48 EDT

pulsar777 posted : I had problem to upload config file in the beginning, but I managed to solve it. The spa2102.cfg was in Current Directory, shown in Tftpd (in same dir with Tftpd). Tftpd32 shows an error in Log viewer window:

Read request for file . Mode octet [21/12 21:50:05.790]Error EACCESS on file \spa2102.cfg. Ext error The directory name is invalid. [21/12 21:50:05.790]

I changed in Tftpd32 settings the Base Directory from (.) dot to path to Tftpd folder, and also in 'TFTP Security' changed from Standard to None. This helped, config was uploaded and ATA is unlocked now. Thanks for your help!

Re: [Unlock] Unlocking Linksys SPA2102 adapter

Fri, 21 Dec 2012 11:31:52 EDT

Stewart posted :

said by pulsar777:

and the address of ATA web interface will be an IP address of Server interface from tftpd32?

Once the ATA has successfully read by TFTP (and presumably applied) your config file, you can restore your normal setup and access the ATA's web interface as usual.

The ATA's WAN address is normally what it got by DHCP. If you pick up the phone and dial **** (hear configuration menu prompt) and then 110#, you should hear the IP address spoken. If you open a web browser at that address with /admin/ (e.g. if address is 10.11.12.13, use 10.11.12.13/admin/) you should get a prompt for username (use admin) and password (use whatever you set).

If you don't get the prompt, confirm that you can ping the ATA. If not, check that ATA and PC are on the same subnet, etc. If you can ping it but not access the web page, dial **** then 7932#. If prompted for password, enter the admin password you set, followed by #. Enter 1# for value and 1 to save. Then, try to access the web page again.

If no luck, dial **** then 210# to hear the LAN address (defaults to 192.168.0.1). Temporarily connect a PC to the LAN port and try to access that address, e.g. 192.168.0.1/admin/ .

Re: [Unlock] Unlocking Linksys SPA2102 adapter

Fri, 21 Dec 2012 11:14:41 EDT

pulsar777 posted : and the address of ATA web interface will be an IP address of Server interface from tftpd32?

Re: [Unlock] Unlocking Linksys SPA2102 adapter

Fri, 21 Dec 2012 10:11:54 EDT

Stewart posted :

said by pulsar777:

How to upload this .cfg config into the ATA?

Put the text into a file named spa2102.cfg, which should be located in the directory specified by Current Directory on the Tftpd32 screen. For debugging, also start a Wireshark capture. Reboot ATA. If you have trouble, report what error is returned (as shown by Wireshark) and what, if anything, is logged on the Tftp server screen.

Re: [Unlock] Unlocking Linksys SPA2102 adapter

Fri, 21 Dec 2012 09:59:08 EDT

pulsar777 posted : How to upload this .cfg config into the ATA?

Re: [Unlock] Unlocking Linksys SPA2102 adapter

Thu, 20 Dec 2012 21:30:07 EDT

Stewart posted : This is looking good.

said by pulsar777:

If I upload new config, then the old settings (programmed manually) will be removed, and ATA will not work.

The config file should not wipe anything out. It will only change the parameters that are specified in the file. For example, this file:

should change the admin password to 1234 and leave everything else unchanged.

Re: [Unlock] Unlocking Linksys SPA2102 adapter

Thu, 20 Dec 2012 15:52:46 EDT

pulsar777 posted : I did test with cable modem unplugged from hub. It show TFTP server name with IP specified in dhcp server tab, and config file name /spa2102.cfg
But I dont know where I can get this file, and it settings. If I upload new config, then the old settings (programmed manually) will be removed, and ATA will not work.

Re: [Unlock] Unlocking Linksys SPA2102 adapter

Thu, 20 Dec 2012 12:00:23 EDT

Stewart posted : Just temporarily unplug the connection from cable modem to hub, start up the DHCP server on your PC, start a Wireshark capture, then reboot the ATA. Your DHCP server should answer the requests from the ATA and put option 66 in the ACK.

Once you have that working correctly, you should see the ATA then make a TFTP request to the address you send in the option 66. If it does, i.e. the provisioning settings were left at defaults by your provider, you should be able to send it a config file to reset the admin password or make any other desired changes.

To keep things simple, your TFTP server should assign an address to the ATA that is in the same subnet as the PC. (If the ATA gets a 10.x.x.x address and the PC has a 91.x.x.x address, the ATA won't be able to talk to the PC, with the cable modem disconnected.)

Re: [Unlock] Unlocking Linksys SPA2102 adapter

Thu, 20 Dec 2012 06:54:39 EDT

pulsar777 posted : my network is very simple, only ATA and one PC is connected to hub, and cable modem is connected to uplink port on a hub. PC have one network card. Private IPs assigned to ATA. There're also visible names of few .bin files, which belong to a cable config files, I guess. But one file named D3-SIP.bin

Re: [Unlock] Unlocking Linksys SPA2102 adapter

Wed, 19 Dec 2012 19:50:19 EDT

Stewart posted : The DHCP server that answered the ATA's request does not appear to be the one that you set up. It would be simplest if for this test, you disconnect your hub from the rest of your network, leaving only the ATA and your PC (that is running your DHCP server) connected.

Also, your network seems to be quite complicated, with both public (91.x.x.x) and private (10.x.x.x) on the same LAN. If your PC has more than one NIC, make sure that your DHCP server is bound to the correct interface. Or, temporarily disable any interfaces not used for this test.

Re: [Unlock] Unlocking Linksys SPA2102 adapter

Wed, 19 Dec 2012 16:20:13 EDT

pulsar777 posted : I did this, in tftpd32 dhcp "additional option" specified IP address of PC and port 66. Capture have 'Parameter request list' where specfied line 66=TFTP Server Name. But I didn't find address of this TFTP.

Re: [Unlock] Unlocking Linksys SPA2102 adapter

Tue, 18 Dec 2012 12:52:43 EDT

toro posted : You're not supposed to use your default DHCP server. You should have only the ATA and your computer connected to the network (hub) and let the ATA get an IP address from tftp32

Re: [Unlock] Unlocking Linksys SPA2102 adapter

Tue, 18 Dec 2012 12:15:08 EDT

pulsar777 posted : I'm not sure about this, added into DHCP tab tftpd32 settings from my default network adapter (IP address, subnet mask, default gateway) and the additional options. I'm not sure how this additional DHCP server can work at the same time with default DHCP?
I tried click Release settings on network adapter, this cause adapter to discard DHCP network settings, then disconnect from the network, but then network connection is lost.

Re: [Unlock] Unlocking Linksys SPA2102 adapter

Mon, 17 Dec 2012 19:40:52 EDT

Stewart posted :

said by pulsar777:

I filled DCHP tab of tftpd32 with details, add option you mentioned into the ini file, run it and sniffed traffic when ATA powered on, but didn't find anything that pointed to a .cfg file.

Please confirm that the DHCP ACK received by the ATA contained option 66 in the proper format.

Re: [Unlock] Unlocking Linksys SPA2102 adapter

Mon, 17 Dec 2012 15:39:26 EDT

pulsar777 posted : I filled DCHP tab of tftpd32 with details, add option you mentioned into the ini file, run it and sniffed traffic when ATA powered on, but didn't find anything that pointed to a .cfg file.

Re: [Unlock] Unlocking Linksys SPA2102 adapter

Mon, 17 Dec 2012 10:12:07 EDT

Stewart posted : Did you try to unlock or configure your SPA2102 with DHCP option 66? If so, what went wrong?

Re: [Unlock] Unlocking Linksys SPA2102 adapter

Mon, 17 Dec 2012 10:09:32 EDT

pulsar777 posted : this ata doesn't use config at all, as preconfigured manually?

Re: [Unlock] Unlocking Linksys SPA2102 adapter

Sun, 16 Dec 2012 09:47:23 EDT

toro posted : If you are thinking of getting the SIP credentials from the SPA, it's not possible. It will not give you the passsword(s).

Re: [Unlock] Unlocking Linksys SPA2102 adapter

Sun, 16 Dec 2012 06:45:23 EDT

pulsar777 posted : how works SIP authentication in SPA? I want move sip account from SPA to FritzBox 7140 wireless router which supports VoIP.

Re: [Unlock] Unlocking Linksys SPA2102 adapter

Fri, 14 Dec 2012 21:23:06 EDT

Stewart posted :

said by pulsar777:

I'm not sure how to configure tftpd32 DHCP server for that.

I've not used this myself, but the FAQ says you can edit the .ini file to e.g.:
AddOptionNumber1=66
AddOptionValue1=10.250.63.123
(Substitute actual address where TFTPD32 is running.)

You can look at the DHCP transactions with Wireshark to confirm that this is working as expected.

Re: [Unlock] Unlocking Linksys SPA2102 adapter

Fri, 14 Dec 2012 14:01:39 EDT

pulsar777 posted : I'm not sure how to configure tftpd32 DHCP server for that.

Re: [Unlock] Unlocking Linksys SPA2102 adapter

Thu, 13 Dec 2012 13:36:05 EDT

Stewart posted : When the ATA receives its IP address by DHCP, it looks for option 66 in the DHCP ACK. If this is present, it is taken as the IP address of a TFTP server, and the ATA (with default provisioning settings) will attempt to fetch a file named spa2102.cfg from that TFTP server.

If you are merely trying to see if this scheme is workable, you don't need to actually set up a TFTP server; just have the device fetch its IP address from a DHCP server that offers option 66. If you then see (e.g. with Wireshark) TFTP requests being made to the IP address in option 66, then you will know that provisioning by this means is possible.

Be careful not to set up the new DHCP server in conflict with your existing one. One way to avoid this is to bind the new server to a second NIC on your PC, to which the ATA is attached. If you have only one NIC, either disconnect from your normal LAN when doing this test, or temporarily disable the old DHCP server and set the new one to be compatible.

Re: [Unlock] Unlocking Linksys SPA2102 adapter

Thu, 13 Dec 2012 13:25:26 EDT

pulsar777 posted : but how to find TFTP server IP address?

Re: [Unlock] Unlocking Linksys SPA2102 adapter

Thu, 13 Dec 2012 12:40:05 EDT

toro posted : Interesting idea, never thought of this one.

Re: [Unlock] Unlocking Linksys SPA2102 adapter

Thu, 13 Dec 2012 12:32:45 EDT

Stewart posted : If your provider left the provisioning settings at factory default, either because he configured manually, or he did an autoprovision over his own LAN, then you should be able to get the device to pull a config file by TFTP, which would allow you to reset the admin password, or to set up Line 2 without disturbing the current config at all. This is activated by sending option 66 in the DHCP ACK.

If you don't already have suitable DHCP and TFTP servers, TFTPD32 should do the job.

»www.mik.ua/products/spa921/spa_p···uide.pdf
»tftpd32.jounin.net/tftpd32_faq.html

Re: [Unlock] Unlocking Linksys SPA2102 adapter

Thu, 13 Dec 2012 10:12:30 EDT

pulsar777 posted : the model is SPA2102. The SIP domain does not belong to the current provider that provide the service. Perhaps voip service and sip domain was inherited from previous ISP, they don't offer softphone or smartphone SIP apps. I have sip details except the passw.

Re: [Unlock] Unlocking Linksys SPA2102 adapter

Thu, 13 Dec 2012 09:07:48 EDT

Stewart posted :

said by toro:

The OP indicated that he actually has the SIP credentials.

Well,

said by pulsar777:

assuming that I will have the SIP credentials.

So I presume that he doesn't have them yet.

With the credentials, the solution seems simple: program them into the unlocked adapter, shut down the old one and test. Once it passes, the second line can be set up as desired, and when all is working correctly, the old adapter can be reset and repurposed, provided that it doesn't have "protect IVR factory reset" set.

Re: [Unlock] Unlocking Linksys SPA2102 adapter

Thu, 13 Dec 2012 08:50:54 EDT

toro posted :

said by Stewart:

A search for a weak SIP password, numeric or hex of up to 8 characters, failed.

The OP indicated that he actually has the SIP credentials.
--
Providers (through asterisk): voip.ms, freephoneline, smartcall.ro. Hardware: Vonage VDV21, Moto VT2x42, Linksys SPA series, Grandstream HT series, Panasonic KX-TGP5x0
»www.voipfan.net

Re: [Unlock] Unlocking Linksys SPA2102 adapter

Wed, 12 Dec 2012 23:31:47 EDT

Stewart posted : I tried to find some info from the capture, but had no luck:

The MAC address does not appear on Linksys site, so I assume that this is not a remotely customized unit. Please post exact model number (printed on bottom), e.g. SPA2102-EU.

The name sip.telenet.lv resolves to 193.111.244.67 and sip2.telenet.lv resolves to 193.111.244.69, but there were not any meaningful references to those names or addresses.

I also failed to find any posts about telenet.lv and VoIP, though I don't know Latvian or Russian; perhaps you can find something by searching in those languages.

A search for a weak SIP password, numeric or hex of up to 8 characters, failed.

The nonce indicates that Telenet is using a softswitch from Mera Systems (now Aloe Systems), but I failed to find any general provisioning info about them. I tried some plausible names, e.g. prov.telenet.lv, but none resolved.

Does Telenet offer a softphone or smartphone SIP app? If so, it should be easy to extract the SIP password.

Re: [Unlock] Unlocking Linksys SPA2102 adapter

Wed, 12 Dec 2012 15:29:23 EDT

pulsar777 posted : I can do this way, but using extra hardware with lot of wires on table isn't very good.

Re: [Unlock] Unlocking Linksys SPA2102 adapter

Wed, 12 Dec 2012 15:20:14 EDT

toro posted : So why not keep both ATAs and configure only the additional number(s) on the other one ?

Re: [Unlock] Unlocking Linksys SPA2102 adapter

Wed, 12 Dec 2012 15:15:48 EDT

pulsar777 posted : I want configure additional VoIP number in this ATA, but its locked.

Re: [Unlock] Unlocking Linksys SPA2102 adapter

Wed, 12 Dec 2012 15:10:34 EDT

toro posted : If you have the SIP credentials you can configure another ATA, but what would be the purpose for that if you have a working one already ? Usually you can't use the same credentials on two or more ATAs at the same time.
--
Providers (through asterisk): voip.ms, freephoneline, smartcall.ro. Hardware: Vonage VDV21, Moto VT2x42, Linksys SPA series, Grandstream HT series, Panasonic KX-TGP5x0
»www.voipfan.net

Re: [Unlock] Unlocking Linksys SPA2102 adapter

Wed, 12 Dec 2012 14:58:30 EDT

pulsar777 posted : so in this case ATA probably manually provisioned by ISP. Is it possible configure new (unlocked) ATA with that SIP credentials I have already?

Re: [Unlock] Unlocking Linksys SPA2102 adapter

Wed, 12 Dec 2012 12:42:58 EDT

toro posted : I'm afraid the ATA doesn't do any traffic other than SIP registrations (I attached the traces filtered to contain only the packets from the ATA). Edit: removed at OP's request.
Probably the provider has provisioned it manually. So no luck unlocking it with this method.
If it was provisioned automatically, usually the ATA would download its configuration about a minute after boot up and then periodically according to a parameter set in the Provisioning tab. You can try to leave the capture running longer, but I doubt you will see more info. If you don't want to capture the traffic from other devices in the network, you can set a filter like "host 10.250.63.39" before you start the capture.
--
Providers (through asterisk): voip.ms, freephoneline, smartcall.ro. Hardware: Vonage VDV21, Moto VT2x42, Linksys SPA series, Grandstream HT series, Panasonic KX-TGP5x0
»www.voipfan.net

Re: [Unlock] Unlocking Linksys SPA2102 adapter

Wed, 12 Dec 2012 12:20:23 EDT

pulsar777 posted : I attached another ones. ATA IP address 10.250.63.39
Is the D2.bin, D3-1n.bin, D3-3c.bin configs for cable modem?

Re: [Unlock] Unlocking Linksys SPA2102 adapter

Wed, 12 Dec 2012 08:59:18 EDT

toro posted : Can you start another capture, reboot the adapter and let the wireshark run longer (10-15 min) ? You only let it run for about 90 seconds and the only thing it capured was the DHCP transaction where the ATA got the IP address and then it registered to the VoIP provider.
--
Providers (through asterisk): voip.ms, freephoneline, smartcall.ro. Hardware: Vonage VDV21, Moto VT2x42, Linksys SPA series, Grandstream HT series, Panasonic KX-TGP5x0
»www.voipfan.net

Re: [Unlock] Unlocking Linksys SPA2102 adapter

Wed, 12 Dec 2012 08:49:46 EDT

pulsar777 posted : Well, finally I got the hub, connected ATA and PC, and captured the network traffic when the ATA is powered on. I can see some info, but I can no find path to server where ATA configuration file loaded during the boot. I am not sure, but config name seems is D3-3c.bin, that this name looks like cable modem config file, strange. I save capture, Ethereal default format. Can anybody help me?

Re: [Unlock] Unlocking Linksys SPA2102 adapter

Fri, 16 Nov 2012 17:59:04 EDT

toro posted : You can't capture the traffic made by the WAN interface if your computer is connected to the LAN port.
You can often find hubs for a few dollars at thrift stores.
Some users have succeeded capturing the traffic by setting up Internet Connection Sharing on a laptop, connecting the laptop to the router via wireless and connecting the ATA to the LAN port of the router through a crossover cable. Personally I have never needed this setup so I haven't done it.
--
Providers: voip.ms, freephoneline, smartcall.ro through asterisk. Hardware: Vonage VDV21, Moto VT2x42, Linksys SPA series, Grandstream HT series, Panasonic KX-TGP5x0
»www.voipfan.net

Re: [Unlock] Unlocking Linksys SPA2102 adapter

Fri, 16 Nov 2012 15:39:56 EDT

pulsar777 posted : as I can no find hub, I connected PC to ATA ethernet port and cable modem to ATA internet port. I tried sniff packets with Ethereal, unplugged the AC adapter from the ATA, wait 30 sec then connected again. What I can see there is a lot of requests, I can see an IP address assigned to ATA, and "Server Identifier" IP address: is it IP address where config file requested from? The other info I see is Host name= SipuraSPA. But I didn't see config file name and path to this file. Also, I think the config file probably transferred via TFTP, not HTTP. How I can get it?

Re: [Unlock] Unlocking Linksys SPA2102 adapter

Thu, 15 Nov 2012 12:56:16 EDT

toro posted : This thread is full of questions and assumptions but except for taking the ATA apart you haven't tried anything yet.
If the provider doesn't give you the SIP credentials, there's no way to get them from the ATA, even if it's unlocked (you can read everything except for the passwords).
If you get the SIP credentials, you can set them up on another ATA in such a way that you can make outbound calls. For inbound calls the ATA must register with the VoIP provider and 99% of the providers don't support multiple registrations. If both ATAs are online, only the last ATA that has registered will ring on inbound calls.
--
Providers: voip.ms, freephoneline, smartcall.ro through asterisk. Hardware: Vonage VDV21, Moto VT2x42, Linksys SPA series, Grandstream HT series, Panasonic KX-TGP5x0
»www.voipfan.net

Re: [Unlock] Unlocking Linksys SPA2102 adapter

Thu, 15 Nov 2012 12:02:23 EDT

pulsar777 posted : assuming that I will have the SIP credentials.

Re: [Unlock] Unlocking Linksys SPA2102 adapter

Thu, 15 Nov 2012 09:35:02 EDT

hardly posted : And does the provider support multiple registrations?

Re: [Unlock] Unlocking Linksys SPA2102 adapter

Thu, 15 Nov 2012 07:14:23 EDT

toro posted : Do you have the SIP credentials, server info, etc ?

Re: [Unlock] Unlocking Linksys SPA2102 adapter

Thu, 15 Nov 2012 04:39:53 EDT

pulsar777 posted : is it possible to configure the same phone number on another SPA in different network node?

Re: [Unlock] Unlocking Linksys SPA2102 adapter

Tue, 13 Nov 2012 15:05:13 EDT

pulsar777 posted : will try..