Unlocking the Linksys PAP2 v2

2011-10-19 09:51| 发布者: Test| 查看: 4206| 评论: 0|来自: voipfan

摘要: The Linksys PAP2 v2 is a device sold exclusively through Vonage. A sotware unlock exists for firmware versions up until 1.00.16 but it's not permanent. The method presented here works for all firmware ...

The Linksys PAP2 v2 is a device sold exclusively through Vonage. A sotware unlock exists for firmware versions up until 1.00.16 but it's not permanent. The method presented here works for all firmware versions up to 1.00.22 (current version at the time when this article was written).
You need a serial console cable to complete this unlock method. You will also need this package which contains the firmware files and this package which contains the CYT unlocker tool.
First, open the ATA by removing the screw from the bottom of the unit, and the two screws from under the rubber feet on the back of the unit (the ones closer to the top). The front panel will then come off easily.
Then, disconnect your main router from the internet, power on the ATA and connect it to your router. Give it a minuted to boot up completely and obtain an IP address from your router. Find its IP address either dialing ****110# from a phone, or from your router's DHCP table. Then, open a browser and login to its web interface with username and password admin and find the firmware version (printed on the upper right corner).
If the firmware is 1.00.16 or older, skip to the CYT Unlocker step.
If the firmware is 1.00.22, you need to downgrade the firmware first. Change the URL in your browser to ip_address/cgi-bin/firmwarecfg (where ip_address is the address found earlier), chose the file pt-11.4.0-r060628-1.00.16-r060628.img included in the package above and click Update Gateway to program the 1.00.16 firmware. When the update is completed, login to the web interface as admin and verify that the firmware version is 1.00.16.
Now, run the CYT unlocker (cyt46.exe) utility. At the Main Menu, choose option 3 to enter the adapter's IP address, then option 1. The unlocker should detect your ATA model. If you get an error here, close the web browser, open it and login to the ATA again, then run the CYT unlocker again. If the adapter is detected properly, hit Enter to start the unlock process. This can take 1-2 minutes. When done, you shuld get a message saying that the Admin user's password has been changed to Admin. You can quit the CYT unlocker now.
At this point, the adapter is temporarily unlocked. Now we will change the firmware in order to make the unlock permanent.
Connect the serial console to the 5 pin console header shwon below.

Start the terminal emulation program and connect at 115200, 8 N 1 XON/XOFF and hit Enter a couple times. You should be at the login prompt of the embedded Linux. Login as username Admin with password Admin. Then type the following command:

echo "setenv CONSOLE_STATE unlocked" > /proc/ticfg/env

This will unlock the serial console so that it can be used during boot.
Now, power cycle your PAP2v2 or type the command "reset" in the console. The console should display something like this:

Basic POST completed... Success.
Last reset cause: Software reset (memory controller also reset)
Software reset (memory controller also reset)

PSPBoot1.3 rev: 1.3.3.11 ODM rev:2.6
(c) Copyright 2002-2005 Texas Instruments, Inc. All Rights Reserved.

Press ESC for monitor... 3

You have 3 seconds to hit the Escape key to stop the router from booting.
Now, you are the the PSP Boot loader prompt which allows you to enter commands. First, let's format both image partitions and the configuration partitions:

fmt IMAGE_A
fmt IMAGE_B
fmt CONFIG_A
fmt CONFIG_B

Then, change the adapter's IP address to be in the same range as your computer but without conflicting any other device in your network. For example if your computer has the IP address 192.168.1.100, and your router's DHCP pool is 192.168.1.100 to 192.168.1.149 you could use 192.168.1.80 for the PAP2v2. This is only temporary, to be able to flash the new firmware through the boot loader functions.

setenv IPA 192.168.1.80

Now, let's flash the new firmware. There are two firmware versions included in the ZIP you downloaded earlier: 1.00.22 which is the newest Vonage firmware designed for this ATA, and the 3.1.24, which is a firmware developed by the users of the DSLReports forum from the firmware for the Linksys RTP300 router. My preferred version is 3.1.24 because it has the comprehensive web interface specific to the Linksys/Sipura SPAxxxx series of adapters. However some users have complained about some bugs, such as the IVR that doesn't report the adapter's IP address correctly. You can switch between the two firmware versions to see which one suits you better. However, note that when switching from version 3.1.24 to 1.00.xx, you must adjust some environment variables as well (details in the Note section).
Once you decided which firmware to use, start the TFTP server in the directory where you have the firmware files and issue one of the following commands, depending on which firmware version you are loading (replace 192.168.1.100 with your computer's actual IP address):

tftp -i 192.168.1.100 pap2v2_1.00.22.img IMAGE_A
tftp -i 192.168.1.100 pap2v2_3.1.24.img IMAGE_A

Now reboot your adapter. At this point, your adapter is completely unlocked and factory reset safe. If you installed the firmware 1.00.22, the adapter is set to use DHCP and will obtain an IP address from your router. Simply dial ****110# to find that IP address and start configuring it.
If you installed the firmware 3.1.24, the adapter is set with a static IP address of 192.168.1.254. To change it, set your computer's IP address to be in the range 192.168.1.x, then login to the PAP2v2's web interface and change the IP address to "Obtain and IP automatically" (DHCP), then power cycle your adapter. You will have to use your router's DHCP table to determine the IP address, because the phone command ***110# will report the address incorrectly.

Note: when you first boot the adapter using the 3.1.24 firmware, the flash partition sizes and positions will be changed from the values used by the 1.00.xx firmware. If you wish to switch the firmware from 3.1.24 to 1.00.22, you will first have to reset the size and position of the partitions, using the following commands:

setenv IMAGE_A 0x90020000,0x903f0000
setenv CONFIG_A 0x903f0000,0x90400000
setenv IMAGE_B 0x90400000,0x907d0000
setenv CONFIG_B 0x907d0000,0x907e0000

Immediately after that, without booting any firmware, format the IMAGE_x and CONFIG_x partitions again and use TFTP to load the 1.00.22 firmware.

-------------- Another way:

[PAP2] Unlocking Guide

Follow these steps and your Linksys PAP2 will be unlocked. Provider settings do not get erased.

Several assumptions:
1. you can get to the WEB interface and set the USER password.
2. Ideally, the device has never downloaded updates, or talked to the provider.
3. You have a TFTP server setup on your network

For this example, Assumptions:
PAP2 is at ip: 192.168.1.5
TFTP svr is : 192.168.1.110

OK, lets go for it:

1.  Put the following two files in the TFTP root folder.
2.  Disconnect from the Internet (avoids downloading cfg files)
3.  Boot your PAP2 in your network.
4.  Browse to the web page of the PAP2.
5.  In SYSTEM, set a User password of 1234
6.  Click the SAVE SETTINGS button.
7.  Refresh the link (you login with user and 1234)
8.  modify the link to show (http)
     http://192.168.1.5/upgrade?tftp://192.168.1.110/PAP2-SP2K.bin
9.  Examine the status leds.. Power should turn RED when it is done.
    Give it a minute or two, dont interrupt it.
10. Once red, point browser at your PAP2. (our IP in this example is 192.168.1.5)
11. Click the "admin login" link near the top-right.
12. Click the PROVISIONING tab and set PROVISION ENABLE=NO.
13. Click SAVE SETTINGS.
14. Now, modify the link to show (http)
     http://192.168.1.5/upgrade?tftp://192.168.1.110/SP2K-PAP2.bin
15. Done. Your Linksys PAP2 will eventually reboot (2 blue LEDs) (BE PATIENT)
    and you can click the "admin login" near the top-right. No PW needed.

This test uses specific firmwares.. These are not for any other use, so if you are looking for upgrade firmware for your PAP2, DO NOT assume that this will be them.. These are for unlocking your PAP2 unit.
-------------------------------------------

datarax
I got one from staples and tried it out for testing purposes only of course. My pap2 came without access to the web interface so the instructions on dslreports wouldn't work. However, i found these instructions to gain web access to the pap2 and then was able to unlock the pap2. I prefer to use the sipura firmware and after unlocking it upgraded to sipura 3.1.5. Amazing.

Quote:

Pick up your phone and dial:

****
Then dial 73738#
Password is: (usually) 7756112# could be: 8995523#
enter 1 to confirm press # Hang up

pick up the phone and dial
****
then 7932#
Password is: 78196365
Press 1 to Confirm and then hang up.

This just enabled the Web Interface if needed.

Even though the second part of the instructions didn't work, I still had access to the web interface. Yeeha. Pap2 morphed to spa-2000 has sucessfully registered and tested to Brekeke's Ondo PBX.
--------------------------------------------------------------
Cisco PAP2T - PAP2T-NA (Unlocked)

Cisco PAP2T - PAP2T-NA (Unlocked)

Note: The Cisco PAP2T featured at IP Phone Warehouse are unlocked by Cisco from the factory. This Cisco PAP2T does not work with Vonage Service. The "NA" on the part number stands for "North America" meaning this Cisco PAP2T is to be sold in North America.

The Cisco PAP2T Internet Phone Adapter with 2 VoIP Ports enables high-quality feature-rich VoIP service through your broadband Internet connection. Just plug it into your home router or gateway and use the two standard telephone ports to connect analog phones or fax machines. Each phone port operates independently, with separate phone service and phone numbers, like having two telephone lines. You'll get clear reception and reliable fax connections, even while using the Internet.

With Internet telephony, along with low domestic and international phone rates, impressive arrays of special telephone features are available. Choose your preferred local dialing number, regardless of where you live. Or add a virtual telephone number to have forwarded to your Internet phone. You can even add a toll-free number. The Cisco PAP2T Internet Phone Adapter is compatible with these and all of the other special telephone features that are available from your Internet telephone service provider, such as caller ID, call waiting, voicemail, call forwarding, distinctive ring, and much more.

Cisco PAP2T Package Contents

PAP2T Phone Adapter Unit
AC Power Adapter
RJ-45 Ethernet Cable
Quick Installation Guide

Cisco PAP2T-NA Quick Info

Enables feature-rich telephone service over your broadband Internet connection
Two standard telephone ports for analog phones or use one of the ports for a fax machine, each with an independent phone number
High quality, clear sounding voice service simultaneous with Internet use
Compatible with all common telephone features: Caller ID, Call Waiting, Voicemail, etc.

Cisco PAP2T Features:

Two voice ports (RJ-11) for analog phones or Fax machines
Impedance Agnostics - 8 Configurable Settings
Call Waiting, Cancel Call Waiting, Call Waiting Caller ID
Caller ID with Name/Number (Multi-national Variants)
Caller ID Blocking
Call Forwarding: No answer, Busy, All
Do Not Disturb
Call Transfer
Three-way Conference Calling with Local Mixing
Message Waiting Indication - Visual and Tone Based
Call Return
Call Back on Busy
Call Blocking with Toll Restriction
Delayed Disconnect
Distinctive Ringing - Calling and Called Number
Off-hook Warning Tone
Selective/Anonymous Call Rejection
Hot line and Warm Line Calling
Speed Dialing of 8 Numbers/Addresses
Music on Hold

Main Specifications

Product Description	Cisco Small Business Pro PAP2T Internet Phone Adapter with 2 VoIP Ports - VoIP phone adapter
Device Type	VoIP phone adapter
Enclosure Type	External
Dimensions (WxDxH)	4 in x 4 in x 1.1 in
Weight	5.4 oz
Localization	North America
Data Link Protocol	Ethernet
Network / Transport Protocol	TCP/IP, UDP/IP, ICMP/IP
Remote Management Protocol	HTTP, HTTPS
VoIP Protocols	SIP v2
Telephony Interfaces	2 phone (FXS)
Features	DHCP support, ARP support, Syslog support, DiffServ support, 256-bit encryption
Power	AC 120/230 V ( 50/60 Hz )


General
Device Type	VoIP phone adapter
Width	4 in
Depth	4 in
Height	1.1 in
Weight	5.4 oz
Localization	North America

Processor / Memory / Storage
Hard Drive	None.

Networking
Form Factor	External
Connectivity Technology	Wired
Data Link Protocol	Ethernet
Network / Transport Protocol	TCP/IP, UDP/IP, ICMP/IP
Remote Management Protocol	HTTP, HTTPS
Status Indicators	Port status, power
Features	DHCP support, ARP support, Syslog support, DiffServ support, 256-bit encryption
Encryption Algorithm	MD5, AES
Compliant Standards	IEEE 802.3, IEEE 802.3u

IP Telephony
VoIP Protocols	SIP v2
Voice Codecs	G.723.1, G.729a, G.711u, G.711a, G.726
Telephony Interfaces	2 phone (FXS)

Expansion / Connectivity
Interfaces	2 x phone line - FXS - RJ-11 1 x network - Ethernet 10Base-T - RJ-45

Miscellaneous
Compliant Standards	CE, cUL, FCC Part 15 B

Power
Power Device	Power adapter - external
Voltage Required	AC 120/230 V ( 50/60 Hz )

Environmental Parameters
Min Operating Temperature	32 °F
Max Operating Temperature	113 °F
Humidity Range Operating	10 - 90%