[Unlock] WRTP54G with Firmware 5.01.04 Page 3
Links: home · search · speed test · login · more ·
Links: Reply New Topic
Forums » Voice Over IP - VOIP » VOIP Tech Chat » [Unlock] WRTP54G with Firmware 5.01.04
page: 1 · 2 · 3 · 4
rrangar @ 22nd Jul 01:02AM:
Re: [Unlock] WRTP54G with Firmware 5.01.04
The layout and instructions are here (search for OPENWRT WRTP54G)
»www.google.com/search?q=OPENWRT+···soft:en-
US&ie=utf8&oe=utf8
However I could not get my serial console to post anything. If you get this working let me know which jumper is the serial console on the board (J1 with pins or J3 needs soldering?)
reply
toro @ 22nd Jul 10:34AM:
Re: [Unlock] WRTP54G with Firmware 5.01.04
I second this. I have my serial voltage converter at the ready. I just need the pinout of the serial connector, and the commands needed to upload and flash the new firmware file. I have an rtp300 with v5.01.04, which does NOT revert to an earlier firmware when reset, and NONE of the previously posted un/pw combinations work in the web interface.
Another question i've got is about the CRYPT_KEY and ADMIN_PWD contained in the output from cat /proc/ticfg/env. The key displayed does not seem to allow me to decrypt either version of my ti001310xxxxxx.xml file (the router tftps two slightly different copies from two different directories), and the password doesn't work for anything in the web interface.
Once you get the serial console working, reboot and hit ESC to stop the boot process. Then you need to do the following:
format the 2 firmware partitions and the configurations, then flash the -NA firmware (modded to load on a Vonage router and to be flashed from the PSPBoot prompt - look through the other threads if you don't have it, there's plenty of info )
Replace your_TFTP_server_IP with the actual IP address and wrtp54g_na_pspboot.bin with the filename for your image.
As for the ADMIN_PWD and CRYPT_KEY: ADMIN_PWD contains the encrypted password while the web interface needs the unencrypted one. I don't know of any way to get one from the other, so this will not help you much. The CRYPT_KEY is not too useful either. As far as I can tell, the actual key for decrypting the Vonage's XML file is somehow obtained by combining the CRYPT_KEY and ADMIN_PWD environment variables. I haven't figured out how and frankly I didn't waste too much time on it since it isn't of much help to me. All I could find is that if you have access to the provisioning page on the router, you will see that the decrption key changes if you change either one of the CRYPT_KEY and ADMIN_PWD environment variables.
reply
toro @ 22nd Jul 11:09AM:
Re: [Unlock] WRTP54G with Firmware 5.01.04
However I could not get my serial console to post anything. If you get this working let me know which jumper is the serial console on the board (J1 with pins or J3 needs soldering?)
It's J1, and the pinout is in paragraph 14 of »wiki.openwrt.org/OpenWrtDocs/Har···/WRTP54G
reply
herrdude @ 16th Aug 08:13AM:
Re: [Unlock] WRTP54G with Firmware 5.01.04
This is my first post here, so I help you will bear with me. I bought a RTP300 from craig's list. When I brought it home, I tried all the passwords known to man, and I tried all the versions of CYT. Nothing worked. Then I noticed that I had the firmware 5.01.04. After searching, I ended up in this forum and in this post. I followed Velund's instructions on the first page using the ping hack. I had to substitute 0.0.0.0 with 127.0.0.1. I managed to get the message: control state unlocked.
Everyone states that this is a good thing and I can do what I want now (as I have read on few posts) but I am at a total loss what to do next.
I had read in another post that a quick way to get rid of the vonage provisioning was to use the following command through the ping hack with the following command: dd if=/dev/zero of=/dev/mtd/9. Would this work?
Any help would be greatly appreciated. I want to set this baby up to use my voipbuster account.
reply
mazilo @ 16th Aug 02:14PM:
Re: [Unlock] WRTP54G with Firmware 5.01.04
said by herrdude :
I followed Velund's instructions on the first page using the ping hack. I had to substitute 0.0.0.0 with 127.0.0.1. I managed to get the message: control state unlocked.
When you mentioned someone's instructions, it would be nice if you include the link here to the post on such instructions for a reference.
I had read in another post that a quick way to get rid of the vonage provisioning was to use the following command through the ping hack with the following command: dd if=/dev/zero of=/dev/mtd/9. Would this work?
This is only true after your RTP300 has been flashed with an RTP300-NA firmware released by Linksys (not Vonage). In order for your RTP300 to take an RTP300-NA firmware released by Linksys, you must make the necessary changes to the RTp300-NA firmware header. Such a mod has been discussed here in this forum numerously. Please use the search button to find out how to mod the header of this firmware.
--
Mazilo always prays for FREEBIES!
US Phone: +1-678-601-0907
UK Phone: +44-703-194-2574
reply
herrdude @ 17th Aug 10:18AM:
Re: [Unlock] WRTP54G with Firmware 5.01.04
So, I went off to modify the software header. I followed these instructions from Rcilinks(»New WRTP54G-NA firmware 3.1.24 released 3-27-07)
1. Download the RTP300 3.1.24 firmware from the linksys site (link in previous msg)
2. Open the file in your HexEditor and change offset 0x17 from 4D to 4C.
3. At offset 0x3B0004, change 85 DA 20 BB to 3B A5 4D DA
4. Done!
At step 3. Using Hexedit, I didn't find: 85 DA 20 BB but rather EE F4 2E B9. This kinda stumps me. Is it ok to leave it like this?
After doing some reading, I was wondering if the following would be possible through the ping hack (Ping page + Firefox web developer plugin + TFTPD32), each line being sent by ping:
(A or B depending on the previous command line response)
Where flash_erase is from section 16.3 from »wiki.openwrt.org/OpenWrtDocs/Har···/WRTP54G
Would this work?
reply
Velund @ 17th Aug 05:06PM:
Re: [Unlock] WRTP54G with Firmware 5.01.04
Looks like you will not have enough free spave in /var to store whole firmware image. I used similar approach to reflash patched bootloader (to make unit -NA), but there is just 64k, and real trick was to reinit environment vars after you reflash the bootloader...
By the way, I do not recommend to try to play with flash_erase if you not understand really good what you are doing, and not have jtag and serial level converter handy.
reply
herrdude @ 17th Aug 08:08PM:
Re: [Unlock] WRTP54G with Firmware 5.01.04
Let me ask you, if you didnt have a serial hookup, what would be the best way to unlock this firmware? I dont mind fooling around and trying something out.
I appreciate any input you can give me!
reply
anon @ 19th Aug 07:03PM:
Re: [Unlock] WRTP54G with Firmware 5.01.04
I am not looking to be spoon fed. If someone could point me in the right direction to do this without a serial console.
I would be etnernally grateful.
reply
boredwild @ 20th Aug 12:41AM:
Re: [Unlock] WRTP54G with Firmware 5.01.04
Would you mind elaborating on what changes you made to the bootloader to make it an -NA? What provider was it locked to originally? Thanks
reply
Velund @ 20th Aug 03:23PM:
Re: [Unlock] WRTP54G with Firmware 5.01.04
It was former Vonage unit.
Change CYLL->CYLM (use patched image read from this particular unit to avoid MAC address change), then erase environment variable area starting at 64K. On a next reboot bootloader will reinit environment vars with defaults, and you'll have RTP300-NA. -NA firmware images must be loaded.
reply
Pcpro745 @ 23rd Aug 04:23PM:
Re: [Unlock] WRTP54G with Firmware 5.01.04
I have the password for this firmware after spending 3 hours on the phone with vonage i finally got it, If you want it PM me or hit me up on AIM- SuperCobaltss or MSN Computerpro745@msn.com
reply
boredwild @ 23rd Aug 11:51PM:
Re: [Unlock] WRTP54G with Firmware 5.01.04
Environment variable area extends from 64K to where? Just one 64K block? Thanks.
reply
boredwild @ 23rd Aug 11:53PM:
Re: [Unlock] WRTP54G with Firmware 5.01.04
Why don't you let us all know? Surely it won't be the same in the next version of firmware.
reply
Pcpro745 @ 26th Aug 12:46AM:
Re: [Unlock] WRTP54G with Firmware 5.01.04
More secure this way, And they cant use google to find there password online this way also
reply
boredwild @ 5th Sep 04:48PM:
Re: [Unlock] WRTP54G with Firmware 5.01.04
Will you send it to me via PM then? I'd be interested to try the v5 firmware with my provider to see if it works any more reliably than the 3.1.27. Presently it likes to drop the wireless periodically when the phone is in use. Thanks.
reply
DogFace05 @ 5th Sep 05:13PM:
Re: [Unlock] WRTP54G with Firmware 5.01.04
Vonage's practice is to assign an individually unique admin password to each and every adapter. Pcpro745's admin password won't do anyone else any good.
reply
tickticktick @ 5th Sep 09:29PM:
Re: [Unlock] WRTP54G with Firmware 5.01.04
Given that we can get into v5 thru the ping hack, and can mod the voice xml config file in /var/tmp -- i assume ggsip reads that... is there someway to cause ggsip to reload and reread the mod'd voice config? Alternatively, is it possible to mount -o rw /? The goal, as with the poster above, is to try the v5 instead of the v3 f/w.... i don't care if it's permanent yet... i can, for now, automate the re-config via the ping hack.
Another approach I was considering faking a cgi-bin post via shell with needed env mods to simulate a web post to cause a reconfig - it would think it came from the webserver....anyone have the v5 voice config pages they could post so i can see what its posting to what?
Tnx
reply
boredwild @ 6th Sep 09:11AM:
Re: [Unlock] WRTP54G with Firmware 5.01.04
Dogface05, can you tell us what you charge to unlock the ACN SPA-2102?
reply
jetzhu @ 6th Sep 02:23PM:
Re: [Unlock] WRTP54G with Firmware 5.01.04
use ping hack.
reference to Velund's post on 2008-04-20 09:28:16:
»[Unlock] WRTP54G with Firmware 5.01.04
Suggest you go through Velund's post first, to make sure you understand how to use ping hack. That will also get the console unlocked, in case anything bad happen.
Then, you need to prepare an device acceptable firmware.
I download one from here:
»httpconfig.vonage.net/rt-11.1.0-···0327.img
(use "tftp -i ls.tftp.vonage.net GET rt-11.1.0-r021-1.00.62-r060327.img" in dos promote to get the complete file if http give you broken files. it will take almost 10minutes)
you may be able to find others here:(Warning: Their server is not stable all the time. sometimes you only download part of the file, you need to verfy the file download have size of 3,866,632 bytes.
»wiki.openwrt.org/OpenWrtDocs/Har···/WRTP54G
I tested with the version of 1.00.62.
download the file, change the name to von10062.bin and put under your tftp's file folder
Edit an script. i.e.
#!/bin/sh
cd /var/tmp
wget tftp://192.168.15.100/von10062.bin
dd if=von10062.bin of=/var/tmp/fw.bin
use unix line terminator("\n" only in c fprintf style) for each line please. save it as rf and put in your tftp's file folder
then ping hack:
127.0.0.1 &&cd /var/tmp &&wget tftp://IP addr of your PC/rf
127.0.0.1 &&cd /var/tmp &&chmod 755 rf
127.0.0.1 &&sh /var/tmp/rf
After the power light flashing, you got an firmware version 1.00.62. volla... old firmware...then. you know what to do... right...or else.... »www.bargainshare.com/index.php?s···ic=87504
Possible to change the firmware from 5.01.04 directly to modified 3.1.24 NA which is created by the following steps
»Re: New WRTP54G-NA firmware 3.1.24 released 3-27-07
For RTP300
1. Download the RTP300 3.1.24 firmware from the linksys site (»www.linksys.com/servlet/Satellit···ondetail)
2. use HexEditor change offset 0x17 from 4D to 4C.
3. At offset 0x3B0004, change 85 DA 20 BB to 3B A5 4D DA
For WRTP54G, WRTP54G have different pattern
2. Change HEX offset 0x17 from 4D to 4C
3. Change HEX offset 0x3B0004 from 71 FB 16 5F to CF 84 7B 3E
Need a hard reset (10seconds hold of reset) to change the configuration back to the firmware default, (Thanks a94cobra confirmed working).
Try at your own risk. no guarantee to work. only tested on one RTP300 unit and succeed. if you got a spare one I would like to try other shortcut.
------------------------------
Vonage is doing their job to bring the telephone service cost down. Though it may not be at the point that all customer satisfied yet, at lest, they are trying. Please only use above thought on unused device to prevent electronic waste.
reply
DogFace05 @ 8th Sep 04:26AM:
Re: [Unlock] WRTP54G with Firmware 5.01.04
said by boredwild :
Dogface05, can you tell us what you charge to unlock the ACN SPA-2102?
I don't believe I can answer this question publicly on this forum, or in any way discuss any topic here related to services I offer, without it somehow violating forum rules.
The few times in the past, when I've posted in reply to specific questions asked of me on this forum about my unlocking service, I've gotten heat from the site moderator, and complaints from a few militant members who harbor resentment toward me for unknown reasons.
Unless this site's moderators explicitly post their consent here to my answering your question, I'm afraid all I can suggest is that you contact me by private IM or email with any questions you may have. I will not post my email address, but you may be able to find it posted by others on this and/or some other message boards.
reply
a94cobra @ 10th Sep 02:18PM:
Re: [Unlock] WRTP54G with Firmware 5.01.04
said by jetzhu :The following method is untested, just an idea:
Possible to change the firmware from 5.01.04 directly to modified 3.1.24 NA which is created by the following steps
»
Re: New WRTP54G-NA firmware 3.1.24 released 3-27-07For RTP3001. Download the RTP300 3.1.24 firmware from the linksys site (»
www.linksys.com/servlet/Satellit···ondetail)
2. use HexEditor change offset 0x17 from 4D to 4C.
3. At offset 0x3B0004, change 85 DA 20 BB to 3B A5 4D DA
For WRTP54G, WRTP54G have different pattern2. Change HEX offset 0x17 from 4D to 4C
3. Change HEX offset 0x3B0004 from 71 FB 16 5F to CF 84 7B 3E
I tried this on a WRTP54G with the 5.01.04 and was successfull. At first upon reboot the router seems bricked. Computer would not get an IP. Even after power cycle. But after the 10sec reset, it came up and I logged in to see 3.1.24 Voice section is there and reports 3.1.22
Not sure where to go from here but the router is downgraded with this method.
reply
jetzhu @ 10th Sep 05:40PM:
Re: [Unlock] WRTP54G with Firmware 5.01.04
I believe it's also unlocked. you can go gizmo5.com apply for an account. and Ipkall.com to apply for a phone number. After setup your ATA with the information you got from the above two websites, you can got other's call you at a US / DC phone number on your unlocked device.
reply
mazilo @ 10th Sep 08:01PM:
Re: [Unlock] WRTP54G with Firmware 5.01.04
said by a94cobra :
I tried this on a WRTP54G with the 5.01.04 and was successfull. At first upon reboot the router seems bricked. Computer would not get an IP. Even after power cycle. But after the 10sec reset, it came up and I logged in to see 3.1.24 Voice section is there and reports 3.1.22
After a factory reset and you still see firmware v3.1.22, then your upgrade to v5.01.04 doesn't seem to be of any success; otherwise, you would be seeing the new version of just installed firmware.
--
Mazilo always prays for FREEBIES!
US Phone: +1-678-601-0907
UK Phone: +44-703-194-2574
reply
a94cobra @ 11th Sep 02:09PM:
Re: [Unlock] WRTP54G with Firmware 5.01.04
I went from 5.01.04 to 3.1.24
Successful.
reply
mazilo @ 11th Sep 05:38PM:
Re: [Unlock] WRTP54G with Firmware 5.01.04
said by a94cobra :
I went from 5.01.04 to 3.1.24
Successful.
Congratulation! Cheers.
--
Mazilo always prays for FREEBIES!
US Phone: +1-678-601-0907
UK Phone: +44-703-194-2574
reply
janakjanak @ 13th Sep 07:06PM:
Re: [Unlock] WRTP54G with Firmware 5.01.04
Hi, I am new here please help me.
I bought RTP300 from ebay recently. It is locked by vonage firmware version 5.01.04. I tried zetzhu's instructions on the page »Re: [Unlock] WRTP54G with Firmware 5.01.04
Everything looks fine, I see von10062.bin downloaded from TFTP server log. But after that power light did not blink and firmware version is still 5.01.04.
Dont know if my ebay seller tried to unlock this unit earlier, but i see a character "n" next to unlocked as below in console_state env value.
CONSOLE_STATE unlocked n
BOOTCFG m:f:"IMAGE_B"
ProductID CYLL
Any help would be appriciated.
reply
Phoenix2088 @ 13th Sep 07:58PM:
Re: [Unlock] WRTP54G with Firmware 5.01.04
I have followed jetzhu's instructions and I think I almost got it. However at the last ping hack step
(127.0.0.1 &&sh /var/tmp/rf) I get the following.
The router's (WRTP54G) power light does not blink and is still running firmware 5.01.04. If anyone can help me and point out what I might have done wrong it would be greatly appreciated.
Background Info:
Running TFTPD32, AV and Firewall off during ping hack. Firmware is in Program Files/tftp32 directory as well as the rf file. TFTP32 is set to use the previously mentioned directory as root. I have already successfully ping hacked to unlock the console.
reply
anon @ 14th Sep 04:44PM:
Re: [Unlock] WRTP54G with Firmware 5.01.04
said by Phoenix2088 :
I have followed jetzhu's instructions and I think I almost got it. However at the last ping hack step
(127.0.0.1 &&sh /var/tmp/rf) I get the following.
The router's (WRTP54G) power light does not blink and is still running firmware 5.01.04. If anyone can help me and point out what I might have done wrong it would be greatly appreciated.
Background Info:
Running TFTPD32, AV and Firewall off during ping hack. Firmware is in Program Files/tftp32 directory as well as the rf file. TFTP32 is set to use the previously mentioned directory as root. I have already successfully ping hacked to unlock the console.
Two suggestions are:
1. Disconnect from internet and hard reset your router before doing this.
2. Make sure the script "rf" is using unix style line terminator ("0Ah" only) at the end of each line. (notice that windows programs using "0Ah 0Dh" as line break)
reply
Phoenix2088 @ 14th Sep 07:42PM:
Re: [Unlock] WRTP54G with Firmware 5.01.04
Thanks. I redid the script using Unix syntax and that sort of worked. I saw TFTP32 transfer the file over to the router successfully.
However the power light did not blink on the WRTP54G and even after a power cycle and hard reset the device is still running 5.01.04. It feels like I am very close, any help would be greatly appreciated.
reply
anon @ 15th Sep 03:56AM:
Re: [Unlock] WRTP54G with Firmware 5.01.04
I guess that you missed an 0AH at the end of the rf file...
reply
Phoenix2088 @ 15th Sep 05:58PM:
Re: [Unlock] WRTP54G with Firmware 5.01.04
Even wrote the script in Ubuntu, same problem. Not sure what I am doing wrong.
reply
jetzhu @ 16th Sep 09:33PM:
Re: [Unlock] WRTP54G with Firmware 5.01.04
which firmware are you using for your WRTP54? »httpconfig.vonage.net/wrt-11.1.0···327.img?
Notice that the RTP300 is using different file
»httpconfig.vonage.net/rt-11.1.0-···0327.img
reply
Phoenix2088 @ 16th Sep 11:30PM:
Re: [Unlock] WRTP54G with Firmware 5.01.04
That was it! Thanks so much for the help. This doorstop is now useful. :D
I'm going to post a tutorial with all the steps to help make it easier for n00bs like me. Once again, thanks to everyone for the help.
Here it is: »[Unlock] TUTORIAL: VONAGE WRTP54G/RTP300 WITH 5.01.04
reply
ogdensburg @ 16th Sep 11:58PM:
Re: [Unlock] WRTP54G with Firmware 5.01.04
Tried to upgrade the firmware. For some reason,the upgrade failed and now my WRTP54G power light keeps blinking. Anyway to recover it?
reply
Phoenix2088 @ 17th Sep 01:11AM:
Re: [Unlock] WRTP54G with Firmware 5.01.04
It blinks for about 2-3 minutes. If the power continues to blink, try doing a hard reset (paper clip for 10-15 seconds).
reply
ogdensburg @ 18th Sep 06:14PM:
Re: [Unlock] WRTP54G with Firmware 5.01.04
No luck. Still blinking.
said by Phoenix2088 :
It blinks for about 2-3 minutes. If the power continues to blink, try doing a hard reset (paper clip for 10-15 seconds).
reply
mazilo @ 18th Sep 07:36PM:
Re: [Unlock] WRTP54G with Firmware 5.01.04
said by ogdensburg :
Tried to upgrade the firmware. For some reason,the upgrade failed and now my WRTP54G power light keeps blinking. Anyway to recover it?
Use a serial-console cable to flash the unit with a legitimate firmware to recover this. You did enable CONSOLE_UNLOCK option when the device was working, right? Otherwise, you will probably need to ask someone to dump the whole Flash using a JTAG cable, modify the S/N and MAC Addresses, then upload to your WRTP54G using aJTAG cable. This may take more than 40 hours using an unbuffered JTAG cable.
--
Mazilo always prays for FREEBIES!
US Phone: +1-678-601-0907
UK Phone: +44-703-194-2574
reply
GrauerFuchs @ 19th Sep 03:09PM:
Re: [Unlock] WRTP54G with Firmware 5.01.04
said by mazilo :
Otherwise, you will probably need to ask someone to dump the whole Flash using a JTAG cable, modify the S/N and MAC Addresses, then upload to your WRTP54G using aJTAG cable. This may take more than 40 hours using an unbuffered JTAG cable.
If the light is flashing, then the bootloader is still valid. If I do recall, if pspboot fails to boot, it will drop to a prompt regardless of the CONSOLE_STATE setting. If not, a simple JTAG wipe of the environment variable section (addr 0xb0010000 length 0x10000) will release the console on most devices. If, in the process, the desire is to make it entirely NA, simply use JTAG to flash the modded 64k pspboot bootloader in, wipe the above-mentioned environment space, and forget about the firmware images. The bootloader alone will take about 25 minutes if all goes well. Once the new pspboot is in place, it can accept and quickly flash the Linksys-provided NA firmware in less than 5 minutes. Then, there's no question about it reverting to a locked state, either.
reply
shycharles @ 18th Oct 03:49AM:
Re: [Unlock] WRTP54G with Firmware 5.01.04
I am a newbie in the Voip Unlocking world. You are telling the entire process, step by step marvelously. One thing you miss though is whether the device from Vonage (in my case RTP300) will be opened and we will be able to see the entire page with User id & Password, domain and port OR does this process wash every setting that was made by the provider and once we do it, we will just be able to use this device with other providers and not (or maybe) with Vonage? I understand your concern about legalities, which do not bother me as such. All I want to do it to be able to see the following:
User ID (generally 1+my Vonage phone number)
Password
Domain
Port (generally 5060 or 5061)
My Firmware version is 5.01.04 or maybe 5.01.14, basically it is the latest firmware.
reply
Thank you for using lo-fi dslreports.com - report bugs
© 99-2009 silver matrix LLC