dslreports logo
 
    All Forums Hot Topics Gallery
spc
Search similar:


uniqs
706
Lecsi
join:2008-06-08

3 recommendations

Lecsi

Member

Definitive Unlock for Vonage F-1000 UTstarcom

Hi folks,

I would like to say that I have successfully unlocked the UTstarcom F-1000 from vonage. I actually did it 2 years ago but I had a problem with the device and I thought that the issue happened because of the firmware flashing. The display started failing. I thought that it was a firmware related issue but the problem is the LCD flex cable that has a bad quality. Channu Sannappanavar told me that the same period but I didnt want to believe that, since the unit has never fell on the ground. I ended up destroying the unit trying to flash it via serial. This device is very sensitive to interference.

I keep asking myself whats the point of doing an unlock for this device since its too old. (LOL! Very old... Wireless B? WPA-TKIP? Cmon... Are you really going to reduce the overall speed of your network just for using this little device? Well I did. :P). Even though is much better and cheaper to buy any simple (or used) Android phone and use SIP softwares like CSipSimple that even can call sip emails, I do use this device because it means something for me. I had a little story with this device.

Before going on explaining how to do it I would like to ask everybody here, who played with this little device, who has provisioning files for this device? HiddenVision, here on forum, kindly provided me one of 3 possible (i think, by looking at old betateilchen's website) provisioning templates. Thanks HiddenVision. If you have another template or any template you have, I would be happy if you could send it to me.

I am really trying to make a file vault so anyone who wants to use this device can still find information about it and also can do modifications on its settings.
I tried contact with Channu but he said he dont remember stuff from this device very well. It was too long ago -he said. If I were on US on that time I could get some stuff from his friend in NJ.
I also contacted betateilchen but sadly he told me he was not allowed to share that information...

BTW, if you have a vonage f-1000 and want to donate it, i will accept so I can do futher investigation.

In the end: send me anything you have for this device
Thanks for the help to TripleOxygen, HiddenVision, meister_sd, toro. And thanks for the attention to Channu and Betateilchen.
------------------------

Previously, to do Vonage's unlock people were using the ATE menu to do a full reset. But this menu is not available in many devices. What we need to do is find the actual vonage's admin password to do a factory reset via web browser menu. And this is quite simple. You just need to open your device and hook it to a serial ttl cable. 115200bps speed with default serial settings.

"DONT TOUCH THE CIRCUITS ON THE DEVICE WHILE ITS TURNED ON. LEAVE THE DEVICE ON THE TABLE. TOUCHING THE CAPACITOR,RESISTORS ON THE BOARD CAN DAMAGE THE DEVICE!" It happened to me!

First, with your device plugged only to the battery, make it connect to your AP or Open AP if you dont know the user pass to add a new SSID with password.

After a successful connection, turn off the device and plug the serial cable to it. You just need to connect TX,RX and GND.

Open your serial terminal program and turn on the device. Wait it boot and connect to your AP. After some time it will give an error about cannot register if you dont have a vonage account anymore. Its ok.
Just give the device some time to load.

Then look at the serial output the device just printed on your screen. (if your terminal software create a .txt output file this step might be easier)

On this step you want to search for the following text:

httpInit: Upload RPM successfully initialized.
httpInit: System File Registry successfully initialized.
httpInit: System File Manager successfully initialized.
httpInit: File System RPM successfully initialized.
httpInit: RPM dispatcher successfully initialized.
httpInit: MIME type guessing RPM successfully initialized.
httpInit: HTTP server connected successfully to WindManage Backplane.
httpInit: Post RPM successfully initialized.
httpInit: http Password Checking successfully initialized.
httpInit: http Access Control successfully initialized.
httpPwdConfAdd OK YWRtaW46ODRKaTIzZGphVw==
httpPwdConfAdd OK dXNlcjo4ODg4ODg=
before taskSpawn sysPause

Take a closer look on this 2 lines:
httpPwdConfAdd OK YWRtaW46ODRKaTIzZGphVw==
httpPwdConfAdd OK dXNlcjo4ODg4ODg=

The chars after OK are the user and password encrypted with base64 for admin and user accounts.

Copy those strings to any base64 online decoder to get the admin password. Vonage's admin passwords are random number/letter strings.

Now it is only joy.

You can change the admin password to anything you want by accessing the webpage.

Now follow meisted_sd tutorial and after flashing a 4.50 version, do a factory reset via web menu using admin account. (»Unlocking the UTStarCom F1000)

PS. I do not recommend the 4.50 version. I prefer flashing 3.80 because you cannot downgrade it or maybe cannot return to vonage's firmware by rewriting the vonages tftp link.

Enjoy!!!
Lecsi

Lecsi

Member

Hi. Just a quick update. Digging the firmware I found some of the configuration templates for the provisioning file. I tried to sort them. Most I dont know what would be the parameters. Its good to find some since betateilchen's website doesnt provide that service anymore.

Have fun!


#Config protocol=tftp
#Vendor Name=
#Enterprise Code=
#Product ID=F1000
#Model Name=
#Time zone offset=-0
#Display Name=
#Autosan flag=1
#Auto scan interval=60
##User password=888888
#Administrator password=psw
#SIP terminal use outbound proxy=0
##SIP terminal use register=sipserver.com
#SIP proxy Domain Name=sipproxy.com
#SIP proxy IP address=0.0.0.0
#SIP proxy port=5060
#SIP register Domain Name=sip.register.com
#SIP register IP address=0.0.0.0
#SIP register port=5060
#SIP terminal user name=username
##SIP terminal pass word=password
#SIP terminal port=5060
#SIP terminal use Null packet=0
#SIP terminal use DNS=3
#DNS Query type=0
#Set Registration duration=60
#Terminal audio RTP port=10010
#Terminal audio Packetize time=20
#g711u=5
#g711a=4
#g729a=3
#g726=2
#DTMF transfer mode=0
#use STUN=0
#Stun server port=10000
#Stun server=stun.server.net

##NTP
#Enable NTP=
#NTP Server DNS flag=
#DST flag=0
#Primary NTP Server Domain name=ntp.nasa.gov
#Secondary NTP Server Domain name=
#Primary NTP Server IP=198.123.30.132
#Secondary NTP Server IP=
#NTP server port=123
#NTP synchronize Interval=36000

##SYS
#Syslog server Domain name=syslog.server.com
#Syslog server IP address=
#Syslog Server name Flag=
#Syslog Level=0
#level 0-3
#Syslog server port=514
#Syslog duration=20

##GENERAL
#Wifi parameters data structure Version=1.2
##IP
#DHCP work mode=
#Terminal IP Address=
#Terminal subnet mask=255.255.255.0
#Terminal Gatewate IP address=
#Primary DNS Server IP Address=
#Second DNS Server IP Address=
#DNS Server IP address source=

##CALL
#Set Call Transfer=
#Set Repeat Dial on busy flag=
#Set Reject Anonymous flag=
#Set Call Waiting flag=
#Set Caller ID block flag=
#3way flag=
#Incoming call timer=
#Outgoing call timer=
#Set Repeat Dial on busy interval=120
#Set Repeat Dial on busy counts=
#HTTP authentication website=www.baidu.com
#Sip authentication string=authstring

##CONFIGURATION
#TFTP Resync Period=300
#Upgrade Error retry delay=
#Configuration Server= FQDN
#Configuration Path=F1000/
#Current Config Filename=

##FIRMWARE
#Firmware Upgrade Server= FQDN
#Firmware Upgrade Path=
#Firmware File name=vxworks_romresident.bin.z
#Upgrade protocol=

##DEBUG
#dump flag=

##UNKNOWN
#Reserved Parameter
#Key
#Encrypt Key
#Factory reset password
#Silence timer=500
#Jitter buffer compensate size=30
#Mail access num=*86
#Mail box num=
#Mai box psw www.nat.server.com

#Reserved Codec
#Max Connections
#Max buffer size packets
#Max latency packets
#Max hold threshold %125
#Min buffer size packets
#Min stable events
#HWM grow rate %100
#HWM shrink rate %70

#Wifi work mode=
#AP1 PSKUTStarcomAP2 PSKAP3 PSKAP4 PSKwww.pppoeserver.comSSID1SSID2SSID3SSID4
#WEPKey11(5Btyes)WEPKey12(13Btyes)WEPKey21(5Btyes)WEPKey22(13Btyes)WEPKey31(5Btyes)WEPKey32(13Btyes)WEPKey41(5Btyes)WEPKey42(13Btyes)
#HWepkey select 00001111
#Manually config SIP timer=T1T24000T45000TimerB32000TimerFTimerHTimerDTimerJ