edison303
join:2006-02-06
Denver, CO
| [General] Unlocking the Uniden UIP1869
Okay, now that the PAP2's almost completely pwned, let's move on to another challenge, shall we?
I picked up the Uniden UIP1869V the other day since it looks like a nice cordless office phone and I'm content with Vonage for the time being.
I haven't regged it yet, but put it on my net with firewall rules in place to see what it does. Here's what I have so far:
1. Looks up uni.tftp.vonage.net from dns1-edn, dns1-nyc.vonage.net and then the DNS servers received from DHCP. ('uni' returns the same IPs as 'ls', BTW)
2. gets XXXXXXXXXX/ti000000000000.xml from tftp.vonage.net where 'XXXXXXXXXX' appears to be some kind of key (similar to the PAP2's $GPP_D?) and '000000000000' is the MAC.
The XML file is encrypted or encoded in a way that I can't figure out. I tried decrypting in the same manner the PAP2 config with $GPP_D, but openssl didn't like the key.
The 1869 is based on TI's TNETV1060, which apparently uses Telogy's RTOS. I can't find any dev guides for the OS, so I have no hints for decoding the file. Can anyone offer any insight?
Regarding web interfaces, since this thing is a complete router/gateway, it has the standard router config pages available on the LAN side, but nothing to do with VoIP at this point. It may need to grab a config before those show up, but I want to find out as much as I can before giving it the config.
Incidentally, the admin pages show up on the WAN side for about a second during the reboot process and if you time your HTTP GETs right, you can access them. What's available from the WAN appears to be identical to the LAN admin pages, so I doubt it's worth the headache.
The main circuit board is rather simple with the TI DSP, SDRAM and 2 FXOs being the only notable chips. There is a 4 pin header on the board near the DSP and also holes for a 14-pin header. I'm thinking the latter is JTAG and the former may be a serial console.
That's all for now. Feel free to chime in if you have any useful observations.
-edison |
|
rcilink
Premium
join:2003-12-15
Manchester, NH
| Can you tell me where a good deal on this unit can be had?
I don't like to sink a ton of money into something, just to find out I made it into a brick, or it can't be unlocked with todays information..
But, if you were able to get a good deal (rebate), I may be interested.. Somehow our existing cordless phones got ruined (water? argh!).. So, I could use a new set. |
|
mazilo
From Mazilo
Premium
join:2002-05-30
Lilburn, GA
1 edit | reply to edison303
Deleted ... |
|
mazilo
From Mazilo
Premium
join:2002-05-30
Lilburn, GA | reply to edison303
Currently, there is a $100 rebate on this device tied to Vonage services. At a local Fry's Electronics store, this device is old @ about $190 before the rebate. |
|
edison303
join:2006-02-06
Denver, CO
| reply to edison303
Been playing with it some more...
The 4-pin connector does appear to be some kind of serial, but I can't get any plaintext out of it. I've tried all the port speeds and comm settings to no avail. I suppose it could be JTAG, but the spec says at least 5 pins. Plus, the 14-pin header holes lower on the board are a standard for JTAG connectors.
While the 1869 appears to be the same as the 1868, the web interface shown in the 1868 Admin Guide is *nothing* like the 1869. Does anyone know if the 1868 is based on a difference chipset than the TI TNETV1060? |
|
rcilink
Premium
join:2003-12-15
Manchester, NH | Just a guess... The UIP1868 is based on a Audacity T2U chipset (might be MysonCentury CS6220, same chip)..
I dont have one to check tho.. |
|
MrTwister
Premium
join:2003-09-27
Hilliard, OH | reply to edison303
I've got a UIP1868 (g) as in generic not
the (p) for packet8, and not the (v) for
vonage.
where whould I look for this infermation, I
can check it.
I payed I believe $190 a few months back for this. |
|
edison303
join:2006-02-06
Denver, CO | If you could save the admin page in your browser and attach it here, that'd be great. |
|
rcilink
Premium
join:2003-12-15
Manchester, NH
| reply to edison303
I just found this file.. They GPL'd the code for the UIP1869v phone!!
»www.uniden.com/index/downloadfil···d_id=100
With this, it should be easy to unlock the phone for general use. |
|
