yhakak
join:2004-01-21
Flushing, NY
| reply to rcilink
Re: [PAP2] Unlocking Guide
hi all,
anyone make any progress unlocking pap2-VN (the verizon version, i believe they are supplied by deltathree)? They do not use XML files like the vonage ones...I have a unit sitting here i want to try to unlock, but I can't make heads or tails out of it.
thanks,
yhakak |
|
mazilo
From Mazilo
Premium
join:2002-05-30
Lilburn, GA
| said by yhakak  :They do not use XML files like the vonage ones... Why not try to setup your own isolate LAN, connect this PAP2, and sniff the traffics to find out what the PAP2 does.
--
Mazi (UK Non-Geo Phone: +44-703-194-2574) |
|
kxl19
@comcast.net
| I'm trying to unlock a non-virgin PAP2 with 3.1.9 LSc firmware. I've been able to spoof the dns, tftp and httpd servers correctly (doubled-check to make sure it was accessible from another computer), and the PAP2 can download my spa.xml files.
When I power-up the PAP2 adapter, it connects up to the tftp server, and then downloads the XML file via tftp on 3 different ports (21, 2400, and 69). It asks for 2 XML files,
/spa.xml
//spa.html
I've placed the same copy of the Vonage downloaded XML files on those directories.
After the PAP2 downloads these files, no further requests are made to the http server to download the firmware. When looking at the network traffic using Ethereal, I see that the tftp was successful, but after that, there's a request to:
f.voncp.com:10000 (SIP)
Any idea why it's not asking for firmware after downloading the XML files? This is on a unit that has already been connected to Vonage some time ago...
Thanks, |
|
meister_sd
Premium
join:2006-01-29
La Mesa, CA
| reply to yhakak
said by yhakak : They do not use XML files like the vonage ones... They actually do use .xml files, but get the file via https. The certificate the https server looks for is the https certificate in the pap2 itself. As of yet, I haven't found anywhere that has a guide to unlocking these, mainly because they lock off the user access too. |
|
myvoip07
join:2006-04-29
USA
 ·VOIPo
| I am also in the same situation. My PAP2 takes the xml file but doesn't request the firmware file. My f/w is 3.1.12(LS). Here is the post i talking about 3.1.12(LS) fw. »Latest PAP2 Firmware 3.1.12(LS)
Will decrypting the xml help anyway and how can i decrypt the file? |
|
mazilo
From Mazilo
Premium
join:2002-05-30
Lilburn, GA
| said by myvoip07 :Will decrypting the xml help anyway and how can i decrypt the file? If you can download the XML file that fed to your PAP2 and decrypt it, then you will see the plain-text XML file that contains the admin password for you to unlock your PAP2. To decrypt the XML file, you can either use openssl or VuckFonage utility.
--
Mazi (UK Non-Geo Phone: +44-703-194-2574) |
|
gizmogameboy
join:2006-06-05
Vancouver, BC
| reply to gizmogameboy
Re: [PAP2] Unlocking Guide -
My PAP2-NA was supplied to me unlocked by my VoSP with firmware version 2.0.13. I just upgraded to version 3.1.10(LS)
I've tried dialing **** to get to the IVR but the PAP2-NA seems to reboot itself when I do that. Anyone else notice this happening to their PAP2 / PAP2-NA? |
|
meister_sd
Premium
join:2006-01-29
La Mesa, CA
| said by gizmogameboy :Anyone else notice this happening to their PAP2 / PAP2-NA? Not me. I have that on one of mine... You can get an official release from linksys that is 3.1.12, but I haven't tried this one myself. |
|
supercool
join:2005-02-08
Plano, TX | Help
I loaded a Sipura 2.0.9 firmware on a pap2 3.1.9 LSc (von) but my web interface is not enabled. I tried the IVR 7932 option but I do not know the password. Please any suggestions .
Thanks |
|
mazilo
From Mazilo
Premium
join:2002-05-30
Lilburn, GA
| said by supercool :I loaded a Sipura 2.0.9 firmware on a pap2 3.1.9 LSc (von) but my web interface is not enabled. I tried the IVR 7932 option but I do not know the password. Please any suggestions . If you can try to first factory reset your PAP2 on an isolated LAN, this will definitely re-enable the web interface. Or, you can feed your PAP2 with a simplified and plain-text XML file that will enable web interface. The later approach has been discussed here numerously. Please take your time to read posts in this thread. You are not only going to find out your answer, but you will also learn a lot of the DOs and DON'Ts regarding your unlocked PAP2 unit!
--
Mazi (UK Non-Geo Phone: +44-703-194-2574) |
|
Papped Off
@rogers.com | reply to rcilink
Re: [PAP2] Unlocking Guide
Got it unlocked.
Just wanted to say thanks again for the advice over the weekend.
Not Papped Off anymore.  |
|
supercool
join:2005-02-08
Plano, TX
1 edit | Yes,
I got 3 pap2 units with 3.1.9 LSc firmware unlocked today. Thanks everyone for valuable infomation posted here.
After hacking 3.1.9 LSc seems to be a rather easy. Just more steps.
--- This is what I did--- Just a recap
1. Never connect ur pap2 to internet
2. Factory reset the pap2 device using the IVR (****, 73738#,1 to confirm), no password should be needed for virgin devices
3. download spaMAC.xml from provider.
4. Set up DNS, TFTP, HTTP servers - please check the form for details. Page 86-88
Note pap2 will request spaMAX.xml from 2 folders, first folder is from root of your TFTP server. This file is the one u should have dowbloaded from the provider.
pap2 will also make an additional request for the spaMAC.xml file from a unique folder. supply the flat xml file that has ur admin pwd for this request. see the 3.1.8 unlock document for this file.
5. pap2 should download THE FIRST spaMAC.xml from root and then request PAP2-bin-03-01-09-LSc.bin from apache server(this is where u rename and supply the sipura 2.0.9.d firmware as pap 3.1.9 LSC)
6. pap2 will download new firmware and Reboot . now its a sipura device and it should request second spaMAX.xml(flat xml file with ur pwd) file and eat it. so u got admin rights now.
7. Upgrade the sipura back to a pap2 by doing »192.168.2.3/upgrade?tftp://192.1···PAP2.bin
8. upgrade pap2 3.1.3 LSc to »192.168.2.3/upgrade?tftp://192.1···-LSd.bin |
|
beaver
join:2006-03-12 | supercool,
I would suggest that you do one more step to upgrade your unlocked PAP2 to spa1001. read the link below.
»[Equipment] Configure Line1 on your PAP2 with two VoSPs |
|
rizzo2dial
Premium
join:2004-08-05
3 edits | reply to supercool
supercool (and anybody else who's recently unlocked their PAP2 running 3.1.7 or above firmware):
With your PAP2 unlocked, downgraded to PAP2 3.1.6 or lower firmware, and disconnected from the internet, FACTORY RESET your adapter. This will cause the adapter to get re-locked, but it will restore all FACTORY DEFAULTS. Then re-unlock it using the original & very easy to accomplish unlock method described in the OP of this thread. The FACTORY RESET will restore the FACTORY FRESH GPP_K value, and firmware 3.1.6 (or lower) will permit USER MODE firmware upgrades. Once you have the GPP_K value, should your adapter ever get re-locked, you can re-unlock it by downloading & decrypting your then "current" Fonage primary XML file. (That file contains the admin pw for your adapter).
After you've extracted your FACTORY FRESH GPP_K value, you're ready to use VuckFonage to download & decrypt your Fonage PAP2 XML files.
Rizzo |
|
mazilo
From Mazilo
Premium
join:2002-05-30
Lilburn, GA
| said by rizzo2dial :With your PAP2 unlocked, downgraded to PAP2 3.1.6 or lower firmware, and disconnected from the internet, FACTORY RESET your adapter. This will cause the adapter to get re-locked, but it will restore all FACTORY DEFAULTS. Then re-unlock it using the original & very easy to accomplish unlock method described in the OP of this thread. Or, re-unlock it using the SPA1001 modded firmware if you want your PAP2 to behave like an SPA1001, a 2-line VoIP with a single-line POTS. If you take this route, you can freely factory reset your PAP2 even when it's connected to the Internet and won't get re-locked.
--
Mazi (UK Non-Geo Phone: +44-703-194-2574) |
|
gizmogameboy
join:2006-06-05
Vancouver, BC
| reply to gizmogameboy
Re: [PAP2] Unlocking Guide -
said by gizmogameboy :I've tried dialing **** to get to the IVR but the PAP2-NA seems to reboot itself when I do that. FWIW, found out that changing the codecs and saving settings seems to restore the IVR.(maybe just making any change and saving the new settings will work too).
- If I then power down the unit and restart it I lose the IVR again.
- If I dial **** from line 2 (which is the line I did not make codec changes) the unit reboots.
Not sure what is happening here |
|
myvoip07
join:2006-04-29
USA
·VOIPo
| reply to myvoip07
Re: [PAP2] Unlocking Guide
Nothing is working for me so far. I even tried to encrypt the xml file but gets the following error. I guess the GPP_K values i have is probably wrong. I can provide the xml if anyone wants to help me to decrypt it.
Here is the cmd & error msg:
C:\opt\OpenSSL\bin>openssl aes-256-cbc -d -in Myspaxxxx.xml -out config.xml -k xxxxxx
bad decrypt
5324:error:06065064:digital envelope routines:EVP_DecryptFinal_ex:bad decrypt:.\crypto\evp\evp_enc.c:461: |
|
Sukru Bey
join:2005-09-17
Toronto, ON | reply to rcilink
Why not use VuckFonage? With openssl, it is very much likely you make spelling or capital-small letter mistakes. Even 1 mistake will give that error.
--
SUKRU BEY, a Linksys PAP2 user |
|
myvoip07
join:2006-04-29
USA | Tried with VuckF...., it download the file but says decryption failed. The GPP_K value probably is not the correct one it needs to decrypt. |
|
Sukru Bey
join:2005-09-17
Toronto, ON
| reply to rcilink
OK.
Then just factory reset your PAP2 and reunlock it to see virgin GPP_K value. BUT you must have 3.1.6 or bellow fw. If you have older versions then 3.1.7, you first need to upgrade your PAP2 to 3.1.6.
Also, here is an axample of GPP_K value:
Virgin GPP_K: TqwDX2wRXENe+PlAZU10XjlFsRYntqYBPp7iRTZ4CaG=
Fake GPP_K: d49207a329ydd7557e3s9928416dfe9688adca6196e6791382ee10ccb0f13cbf
As you can see, the fake one is longer and does not finish with equation mark (=).
--
SUKRU BEY, a Linksys PAP2 user |
|
