rizzo2dial
Premium
join:2004-08-05
| reply to VOIPnYC
Re: [Equipment] Configure Line1 on your PAP2 with
said by VOIPnYC  :just another thought, can we patch the header of sipura 2000 firmware and "convert" the Pap2 to sipura 2000 or pap2-na? The original PAP2 unlock process invovled converting the PAP2 to an SPA-2000. In the event you weren't aware or failed to recall, a PAP2 loaded w/ SPA-2000 firmware only has LINE1 of the adapter listed in the web-interface.
I decided to see if a PAP2 could become an SPA-2002 and/or an SPA-3000 by modifying the headers accordingly. My results:
SPA-2002: The PAP2 downloads the firmware but doesn't load it. (The Wafro tools displayed lots of "empty" data blocks when converting this firmware to a PAP2 header). As a result, nothing changes on the PAP2, and the unit does not get damaged.
SPA-3000: The PAP2 downloads the firmware, loads it up, has one of the indicator lights turn RED (much like when it loads SPA-2000 firmware), at least one other indicator remains blue (blinking at random intervals) and then becomes unusable. Specifically, the adapter can occassionally be pinged (most pings timeout), a phone connected to either PHONE PORT keeps "clicking on hook/off hook," the IVR DOES NOT WORK, and the WEB INTERFACE DOES NOT WORK.
Thus, the PAP2 I've loaded w/ SPA-3000 firmware is esentially a "brick."
Rizzo |
|
mazilo
From Mazilo
Premium
join:2002-05-30
Lilburn, GA
| said by rizzo2dial :Thus, the PAP2 I've loaded w/ SPA-3000 firmware is esentially a "brick." I was so tempted to do this the night I posted to open this thread after failing with the SPA2002 firmware, but refrained my self from doing so (due to the fact that I did not some guts to brick my PAP2).
I hope you will be able to un-brick your PAP2. Perhaps, you may want to try the PIN15 shorting trick and/or even the TFTP method used to flash open source firmware on a Linksys WRT54G/S router. |
|
rizzo2dial
Premium
join:2004-08-05
| said by mazilo :I hope you will be able to un-brick your PAP2. Perhaps, you may want to try the PIN15 shorting trick and/or even the TFTP method used to flash open source firmware on a Linksys WRT54G/S router. It doesn't appear as though the PAP2 runs a TFTP Server, so the WRT54G TFTP bootp flash method won't work. As for shorting PIN15, I'm not too familiar w/ that trick. If you could post a link to more detailed instructions on that trick (or just type them here), I'll give it a shot.
Worst case scenario: replace the brick w/ a new PAP2. 
Rizzo |
|
mazilo
From Mazilo
Premium
join:2002-05-30
Lilburn, GA | There is a Sipura Utility to recover an SPA3K that's supposed to let you de-brick an SPA3K. Perhaps, it will also work with a PAP2. Give it a try. |
|
tkprojects
join:2003-06-12
Schenectady, NY
1 edit | reply to rizzo2dial
I wish I read you post earlier, I just "bricked" (not really, but it isn't very usefull now) my pap for nothing trying to do the spa3k trick. |
|
mazilo
From Mazilo
Premium
join:2002-05-30
Lilburn, GA
| said by tkprojects :I wish I read you post earlier, I just "bricked" (not really, but it isn't very usefull now) my pap for nothing trying to do the spa3k trick. What exactly did you mean? Did you brick your PAP2 from flashing it with a modded SPA1K firmware?
BTW, how do you know if you have a bricked PAP2? Does it keep rebooting itself indefinitely or a complete shut off?
--
Mazi (UK Non-Geo Phone: +44-703-194-2574) |
|
tkprojects
join:2003-06-12
Schenectady, NY
| said by mazilo :What exactly did you mean? Did you brick your PAP2 from flashing it with a modded SPA1K firmware? BTW, how do you know if you have a bricked PAP2? Does it keep rebooting itself indefinitely or a complete shut off? spa3k NOT spa1k.
It's not completely bricked, hence the quotes. I get the config menu and I used to have access to the IVR. Before the IVR gave me "0" in response to any parameter query. Now the IVR doesn't even turn on. I either get silence or a fast busy sometimes followed by the attention tone. Actually I think that the fast busy stemmed from the fact that I had gw0 in my dial plan. The box is a bit unstable at first, rebooting or at least resetting the Ethernet port after it is powered up, but it becomes more stable with time. Perhaps the "broken" parts time out after a while.
However, when I configure it for a SIP provider on Line 1 it registers and I get a dial tone. I couldn't dial though. Perhaps I should preface my number with a #, as described with respect to some other sipura mod. I need to play with it a bit more, I guess.
Anyway, I tried to upgrade it back to some sane FW, but it just sits there claiming that it will do it when it isn't busy. I wasn't holding my breath for long enought on that.
Furthermore, I tried the spa3k and spa2k recovery tools, but to no avail.
I also tried the flash address pin shorting trick, but it just locked up the box until powerdown, i.e. I didn't see it do a bootp/dhcp request as hoped for so that I could tftp a recovery image.
I'm at wits end for now. I'd like to find out where the reset jumper on the old PAP2's was connected and what are the physical differences between the PAP2 and the Linksys SPA3000 (NOT the Sipura version, which uses a different board). I'd rather push the box in the spa3k direction rather than the pap2 direction. However, if anyone has ideas on how to abuse this box some more, outside of reflashing in vitro (i.e. removing the chip, reflashing, and replacing) please let me know.
If you have a Linksys SPA3000 (NOT Sipura SPA3000) and a digicam I'd love to see high res pics of both sides of the circuit board. |
|
mazilo
From Mazilo
Premium
join:2002-05-30
Lilburn, GA
| said by tkprojects :However, when I configure it for a SIP provider on Line 1 it registers and I get a dial tone. I couldn't dial though. Perhaps I should preface my number with a #, as described with respect to some other sipura mod. I need to play with it a bit more, I guess. This sounds like a dial-plan issue. The # string is used to access the 2nd line.
Anyway, I tried to upgrade it back to some sane FW, but it just sits there claiming that it will do it when it isn't busy. I wasn't holding my breath for long enought on that. Since your PAP2 now runs on an SPA3K firmware, you will need to mod a PAP2 firmware so that it will have an SPA3K header string for your PAP2 to recognize.
I also tried the flash address pin shorting trick, but it just locked up the box until powerdown, i.e. I didn't see it do a bootp/dhcp request as hoped for so that I could tftp a recovery image. Which PINs did you short?
--
Mazi (UK Non-Geo Phone: +44-703-194-2574) |
|
tkprojects
join:2003-06-12
Schenectady, NY
| said by mazilo :Since your PAP2 now runs on an SPA3K firmware, you will need to mod a PAP2 firmware so that it will have an SPA3K header string for your PAP2 to recognize. Which PINs did you short? Yes, I know about the header, but I don't even get to the point where it matters which firmware I use, i.e. the box doesn't even ask for firmware.
I shorted 1 and 2 initially, since they are the address pins on my RT, then I just started shorting them left and right. Nothing worked, e.g. write enable, ..., nothing. |
|
DogFace05
join:2005-12-09
Cary, NC
| You can make the failsafe code run by shorting address lines 18 and 19--don't recall which pin numbers they correspond to--but it's kind of tricky, since they happen to be on opposite sides of the chip. However, it's kind of moot, due to a *slight* blunder by Linksys. As part of the initialization of the failsafe code it goes and reads the manuf/device id of the flash and validates it against a list of supported devices. If the device isn't in this list, the code halts and is rebooted by the watchdog. Well, would you believe the MX29LV081 flash chip in most (if not all) PAP2s, so happens, isn't in the list. Ooops! In all fairness, I don't know if the failsafe in the SPA3K fw also lacks this support, so there may perhaps still be a chance that you could get it to run. Also, the failsafe in PAP2 fw 3.1.10 was changed, so it is possible that it may have been fixed now. |
|
tkprojects
join:2003-06-12
Schenectady, NY
1 edit | said by DogFace05 :Well, would you believe the MX29LV081 flash chip in most (if not all) PAP2s, so happens, isn't in the list. The ones I've seen have an SST flash. I'll try your trick. |
|
