[xperiate]

In light of the recent failures being reported, I picked a new PAP2 today (which should be pre-loaded w/ 3.1.9 firmware). At some point during this weekend, I'll try unlocking it to see what happens. Will report back w/ my findings.

Diggler

Any luck?

[TheDiggler]

Hi Diggler,
I can't web access the pap2 by typing it IP address. Am I still can re-flash it back to vonage? Thanks.

This is kind of a chicken vs. egg thing. You've previously stated that your adapter is now upgraded to SPA2K firmware; however, it's not accepting or perhaps not processing plain-text XML files.

To load different firmware onto your adapter, it either needs to be unlocked or it needs to be able to process plain-text XML files. Linksys SPA2K 2.0.9 firmware permits PLAIN TEXT XML file processing; however, recent events seem to indicate otherwise.

Later tonight I'll hopefully have time to attempt unlocking the new PAP2 I purchased yesterday. I'll be in a better position to comment on recent events thereafter. Sit tight.

Diggler

[TheDiggler]

Any luck?

I answered this in my previous post (which I was composing when you posted yours above).

[xperiate]

I answered this in my previous post (which I was composing when you posted yours above).

:-) Look forward to hearing the results....

[cxterm]

Hi, Diggler:

I followed your instruction to unlock the 3.1.9c PAP2. I meet some problem after pap2 read the bin file (in step.6). I checked the log file of http server and TFTP server. PAP2 did read the encrypted xml file and upload the PAP2-bin-03-01-09-LSc.bin file. I did not notice the led turned red after that. Below is the symptoms I noticed after the new bin file uploaded.

1. I can not access the PAP2 by web.

2.I find the DNS server IP is changed to original one. I tried to change it by IVR. It required a passeword now ( not 1234 or 4321)!

2. The pap2 now try to get the encrypt xml file at TFTPROOT//yRmf9EmzE0/. And it re-upload the bin file each time it power-up. I tried download the xml file in "yRmf9EmzE0" folder from vonage tftp server. There is really a xml file under that strange folder.

Do you have any sense what happened to me.

thanks.

[xperiate]

Hi, Diggler:

I followed your instruction to unlock the 3.1.9c PAP2. I meet some problem after pap2 read the bin file (in step.6). I checked the log file of http server and TFTP server. PAP2 did read the encrypted xml file and upload the PAP2-bin-03-01-09-LSc.bin file. I did not notice the led turned red after that. Below is the symptoms I noticed after the new bin file uploaded.

1. I can not access the PAP2 by web.

2.I find the DNS server IP is changed to original one. I tried to change it by IVR. It required a passeword now ( not 1234 or 4321)!

2. The pap2 now try to get the encrypt xml file at TFTPROOT//yRmf9EmzE0/. And it re-upload the bin file each time it power-up. I tried download the xml file in "yRmf9EmzE0" folder from vonage tftp server. There is really a xml file under that strange folder.

Do you have any sense what happened to me.

thanks.

I am stuck at exactly the same point...phew...looks like I'm not alone. Let's wait for some Diggler magic when he tries it out on a new PAP2 he just bought!

Cheers!

[ajpatel]

I found a fh900exxxx from Walmart, and exchanged my 3.1.9. The new one is 3.1.3 and I unlocked it. What do I need to do now? I got the gpp_k value. Do I need to upgrade to 3.1.6 or is that optional? Please help before I connect this think to the internet.

[TheDiggler]

I found a fh900exxxx from Walmart, and exchanged my 3.1.9. The new one is 3.1.3 and I unlocked it. What do I need to do now? I got the gpp_k value. Do I need to upgrade to 3.1.6 or is that optional? Please help before I connect this think to the internet.

Wow, you got lucky finding such an old PAP2! You don't NEED to upgrade to 3.1.6; however, you're free to do so. You can even upgrade all the way to 3.1.12 (the latest version). Just be sure to TURN OFF PROVISIONING before connecting the adapter live. (Login as admin mode, go to advanced mode, go to the provisioning tab, and set "Provision Enable" to "no").

Since you've extracted the factory fresh GPP_K value though, you'll be able to safely recover from a re-locked situation should your adapter provision w/ Vonage.

Diggler

P.S. I still haven't had time yet to attempt unlocking the adapter I purchased yesterday. I expect to work on it late tonight.

[ajpatel]

Thanks for your quick reply, i turned off provisioning and upgrade firmware, I'll connect it and see what happens.

[xperiate]

I found a fh900exxxx from Walmart, and exchanged my 3.1.9. The new one is 3.1.3 and I unlocked it. What do I need to do now? I got the gpp_k value. Do I need to upgrade to 3.1.6 or is that optional? Please help before I connect this think to the internet.

Awesome. Was your earlier 3.1.9 also from Walmart?

[dullkily]

Thanks xperiate for helping me get the xml file from vonage!!Without xml file, I do not have a start point!

After 3 hours trying, I finally unlocked my 3.19lsc, finally!
I met similar problems as metioned by xperiate(no red light) but i finally figured out where is the pbrblem. The vonage is playing game with us.

Currently my software version is 3.1.3LS and I can admin login (with no password), can I call it unlocked?
Right now I am trying to get GPP-k, once I crack it, I will update how vonage played.

This post has been edited by dullkily: 7-23-06, 7:24pm

[xperiate]

Thanks xperiate for helping me get the xml file from vonage!!Without xml file, I do not have a start point!

After 3 hours trying, I finally unlocked my 3.19lsc, finally!
I met similar problems as metioned by xperiate(no red light) but i finally figured out where is the pbrblem. The vonage is playing game with us.

Currently my software version is 3.1.3LS and I can admin login (with no password), can I call it unlocked?
Right now I am trying to get GPP-k, once I crack it, I will update how vonage played.

So where was the problem? I would like a solution too....

[ajpatel]

My earlier was a 3.1.9 from BestBuy and 1 from compusa. I got the 2.0.9d on the one from compusa and it's stuck now. I purchased one from BestBuy with the $50 gift card offer, but never opened it. When I was at Walmart today I say about 6 PAP2s that were FH900Exxx. So I brought one and returned the one I brought from BestBuy to Walmart.

[TheDiggler]

I'm about to start the unlock process, but the PAP2 I picked up is an FH900Fxxxxxx. Given what ajpatel has posted about his recent "find," the PAP2 I picked up may not be a 3.1.9. I guess I'll know shortly.

Diggler

*EDIT* Whew! It's a 3.1.9!

This post has been edited by TheDiggler: 7-23-06, 8:08pm

[xperiate]

I'm about to start the unlock process, but the PAP2 I picked up is an FH900Fxxxxxx. Given what ajpatel has posted about his recent "find," the PAP2 I picked up may not be a 3.1.9. I guess I'll know shortly.

Diggler

*EDIT* Whew! It's a 3.1.9!

Getting warmer...wonder what dullkily do to get hsi working from the point it stalled - just like mine....

[dullkily]

Hi, Diggler
I downgrade from 3.19lsc to 3.13ls, do I have to upgrade to 3.16?
I used 44chart GPP-K shown in my provision tab with the spa<mac>.xml and got the password, are there anything else that I need to do?
Thanks!

I'm about to start the unlock process, but the PAP2 I picked up is an FH900Fxxxxxx. Given what ajpatel has posted about his recent "find," the PAP2 I picked up may not be a 3.1.9. I guess I'll know shortly.

Diggler

*EDIT* Whew! It's a 3.1.9!

This post has been edited by dullkily: 7-23-06, 8:17pm

[xperiate]

Hi, Diggler
I downgrade from 3.19lsc to 3.13ls, do I have to upgrade to 3.16?
I used 44chart GPP-K shown in my provision tab with the spa<mac>.xml and got the password, are there anything else that I need to do?
Thanks!

Hi, can you please explain what you did to get past the "no red led" problem that I am facing too. I desperately need this going as I have cancelled my land line

[dullkily]

The little problem is that when you feed the original xml files, it first got from the tftp-root directory, then it request another same copy from a sub-directory, you can find the name subdirectory from your tftp log.
After loading the PAP-SPA.bin, then the fake spa<mac>.xml, I can not access web as reported by someone else. Then I just did a factory reset and then I can get the web access, shown the version of 1.33.

Getting warmer...wonder what dullkily do to get hsi working from the point it stalled - just like mine....

[xperiate]

The little problem is that when you feed the original xml files, it first got from the tftp-root directory, then it request another same copy from a sub-directory, you can find the name subdirectory from your tftp log.
After loading the PAP-SPA.bin, then the fake spa<mac>.xml, I can not access web as reported by someone else. Then I just did a factory reset and then I can get the web access, shown the version of 1.33.

I have tried the process with the same spaMAC.xml in TFTP root AND the sub directory. It does grab from both - then the bin file...and then the light remains blue - no red.

What do you exactly do after that? Are you suggesting that you now replace the original spaMAC.xml with the fake spaMAC xml? Before the red led?

By factory reset - you mean you do a 73738#?

[dullkily]

After grabbing the bin file, it turned red. After that I feed tha adapter with fake spamac.xml, but i have no web access to adapter.Then I did a 73738#, no password required, then I get web access.

I have tried the process with the same spaMAC.xml in TFTP root AND the sub directory. It does grab from both - then the bin file...and then the light remains blue - no red.

What do you exactly do after that? Are you suggesting that you now replace the original spaMAC.xml with the fake spaMAC xml? Before the red led?

By factory reset - you mean you do a 73738#?

[xperiate]

After grabbing the bin file, it turned red. After that I feed tha adapter with fake spamac.xml, but i have no web access to adapter.Then I did a 73738#, no password required, then I get web access.

I will give it one more shot. Just one question - did you keep the original spaMAC.xml in both the folders? i.e. TFTP root AND the sub directory?

Also, the second time around, after it turned red, you kept the fake spaMAC.xml in the TFTP root? or that sub-directory?

[ajpatel]

After grabbing the bin file, it turned red. After that I feed tha adapter with fake spamac.xml, but i have no web access to adapter.Then I did a 73738#, no password required, then I get web access.

Yours still grabs the files. Whereas my pap2 grabbed the file the 1st time and changed over to 2.0.9d, and I saw the request in the obsecure folder from the tftp log, but when I created the folder and placed the file in that folder and power cycled the pap2 it no longer made any requests for any files.

[dullkily]

I first kept orginal spacmac.xml in both folers. Then removed both of them with faked xml.

I will give it one more shot. Just one question - did you keep the original spaMAC.xml in both the folders? i.e. TFTP root AND the sub directory?

Also, the second time around, after it turned red, you kept the fake spaMAC.xml in the TFTP root? or that sub-directory?

[xperiate]

I first kept orginal spacmac.xml in both folers. Then removed both of them with faked xml.

Just tried the process again-

1. spaMAC.xml in both the folders- TFTP root and the sub-folder
2. It grabbed the .xml and the .bin (as always)
3. Light still remains blue (no red)
4. I reset the PAP2 and let it grab the faxe.xml this time (instead of original spaMAC.xml)
5. I can now access the web interface (user only - no admin) - earlier with the resets too I couldnt access the web control

But, to cut a long story short, I can't still get the red led - so am stuck - this is my 2nd PAP2 - now just waiting for Diggler to post his findings!

[TheDiggler]

I'm about to start the unlock process, but the PAP2 I picked up is an FH900Fxxxxxx. Given what ajpatel has posted about his recent "find," the PAP2 I picked up may not be a 3.1.9. I guess I'll know shortly.

Diggler

*EDIT* Whew! It's a 3.1.9!

Unlock SUCCESSFUL. In the process, I encountered a behavior I hadn't previously read about anywhere; however, this behavior, which re-locks your adapter (after you've gone through the process of unlocking it), makes perfect sense.

Once you get past this point:

STEP 8: Revert back to PAP2 firmware:

you'll end up w/ an unlocked PAP2

Next you're advised to perform the following step:

STEP 9: Obtain the FACTORY FRESH GPP_K key (OPTIONAL but recommended)

The moment you FACTORY RESET your adapter in STEP #9, if your local environment still has your ENCRYPTED spa<MAC>.xml file sitting in your TFTP root (i.e. the one you downloaded from Vonage to begin the unlock process), the adapter will download this file from your TFTP server, re-lock your adapter, and turn off its web interface. For the same reason USED Vonage PAP2's don't attempt HTTP upgrades, your PAP2 won't attempt to re-download file PAP2-bin-03-01-09-LSc.bin from your HTTP server. Thus, it'll remain locked w/ Vonage firmware; however, this time the firmware will be 3.1.6 or lower (i.e. the firmware version you used in STEP #8).

At this point it's fairly easy to recover and continue:
1) Remove the spa<MAC>.xml file from your TFTP root.
2) Factory Reset the PAP2 (which will accept the same Vonage User password you found in STEP #1)

You can then complete STEP #9 and end up w/ an unlocked PAP2 w/ FACTORY FRESH GPP_K value.

I'll post more details of my unlock process shortly. Just wanted to get the above out quickly.

Diggler

This post has been edited by TheDiggler: 7-23-06, 10:20pm

[TheDiggler]

Details of my unlock process:

SETUP:

Environment:
• Windows XP Pro w/ SP-2
• Crossover cable

Server Software:
• TFTP Server: SolarWinds TFTP Server:
  • Upon installing & running, configure the server to Transmit or Transmit & Receive files:
    • Click the File drop-down menu
    • Select the Configure menu option
    • Choose the Security tab
    • Choose the Radio Button for Transmit and Receive Files
  • Copy your actual (encrypted) spa<MAC>.xml to your TFTP Root directory (configurable in SolarWinds)
• HTTP Server: Microsoft Internet Information Services (comes w/ XP Pro but not installed by default):
  • Create a virtual web directory alias +<PAP2 MAC Address> pointing to a physical directory (i.e. C:\TEMP\UNLOCK_319)
  • Copy PAP2-SP2K.bin to C:\TEMP\UNLOCK_319 as PAP2-bin-03-01-09-LSc.bin
• DHCP Server: Internet Connection Sharing (ICS):
  • For this to work, you need at least two network "interfaces" in your Network Connections folder. A Wireless Network Connection plus a Local Area Connection (i.e. ethernet interface) will suffice:
    • Open up Network Connections
    • Right click on Wireless Network Connection
    • Select the Advanced tab
    • Check the box for "Allow other network users to connect through this computer's Internet connection"
    • If there's a drop-down box below requiring you to select a "Home networking connection," choose "Local Area Network"
    • ICS will now be active on the Local Area Connection (this seems backwards, but that's how ICS works). The PC's Local Area Connection will be the ICS "gateway" and will be assigned an IP Address of 192.168.0.1.
  • Make sure the Wireless Network Connection is NOT connected to the Wifi network!!! ICS will share your PC's wifi connection w/ its ethernet port, so if the wifi connection is "alive," and if the wireless router is connected to the internet, your PC's ethernet port will be on the internet too!
• DNS Server: Windows 'hosts' file:
  • Load C:\Windows\System32\Drivers\etc\hosts into NotePad (it's a text file)
  • Add the following to the end of the file:
    
    CODE
    192.168.0.1 ls.tftp.vonage.net
    192.168.0.1 httpconfig.vonage.net
  • Save the file and exit NotePad

The UNLOCK PROCESS:

1) Connected the PAP2 to the PC using a crossover cable
2) Powered on the PAP2
3) After a minute or so, it requested /spa<MAC>.xml from ls.tftp.vonage.net (running on 192.168.0.1). I only ran 1 TFTP server on Port 69.
4) After another minute or so, it TFTP requested (but failed to receive) file: /random-vonage-GPP_D-directory/spa<MAC>.xml
5) After another minute or so, an HTTP request was received & processed by the HTTP server @ httpconfig.vonage.net (running on 192.168.0.1):
/+<PAP2 MAC Address>/PAP2-bin-03-01-09-LSc.bin
6) One of the indicator lights on the PAP2 flashed rapidly while it was downloading the firwmare file
7) After the download was complete, the PAP2 processed the file for perhaps a minute or so, then it automatically rebooted. The indicator light on the adapter turned RED (thus it successfully loaded SPA2K firmware).
8) Upon rebooting, the SPA-mode PAP2 attempted a TFTP request of /random-vonage-GPP_D-directory/spa<MAC>.xml, but it failed as I hadn't yet created the PLAIN-TEXT XML file.
9) Created the /random-vonage-GPP_D-directory underneath the TFTP Root directory and added the PLAIN TEXT XML file as listed in my:
"STEP 7: (Re-)Open WEB access and configure known USER & ADMIN pws"
10) Power cycled the SPA-mode PAP2. Waited a few minutes for it to boot up and make a TFTP request. It requested and received PLAIN-TEXT XML FILE: /random-vonage-GPP_D-directory/spa<MAC>.xml.
11) After it processed the file above, was able to access the web-interface and login as "user/1234"
12) Switched to admin mode, wiped out the user/admin pw's, disabled provisioning, and saved settings.
13) Reverted back to PAP2 firmware.
14) The adapter was now unlocked, but I didn't yet have the FACTORY FRESH GPP_K value.
15) See my previous post for what happened thereafter.

Diggler

*EDIT* When using ICS as your DHCP server, every time the PAP2 reboots, ICS assigns it a new IP address. Thus, go into IVR MODE and issue command 110# to find out the adapter's IP address. Another option is to look at file C:\Windows\System32\drivers\etc\hosts.ics which gets updated w/ the IP addresses doled out by ICS.

Speaking of going into IVR mode, as others have mentioned in this thread, once the PAP2 is loaded w/ SPA2K firmware, accessing IVR mode can be a PITA. Keep hitting the * key until the adapter generates a FAST BUSY. Once the FAST BUSY starts, the normal **** sequence will enter IVR mode.

This post has been edited by TheDiggler: 7-23-06, 11:50pm

[eshopper]

Never Mind

This post has been edited by eshopper: 7-24-06, 6:49am

[xperiate]

7) After the download was complete, the PAP2 processed the file for perhaps a minute or so, then it automatically rebooted. The indicator light on the adapter turned [b][color=red]RED

Good job. Did you encounter any of my problems i.e. the LED color not changing from Blue to Red or did it turn RED the first time around itself? I am having zero luck with getting the red light...

Is anyone willing to unlock my PAP2 if I mail it across?

This post has been edited by xperiate: 7-24-06, 5:57am

[TheDiggler]

Good job. Did you encounter any of my problems i.e. the LED color not changing from Blue to Red or did it turn RED the first time around itself? I am having zero luck with getting the red light...

Is anyone willing to unlock my PAP2 if I mail it across?

When I first setup my HTTP server's virtual directory, I named it /+SPA<PAP2 MAC Address>/ instead of /+<PAP2 MAC Address>/. As a result, the first time my PAP2 successfully downloaded its ROOT XML FILE, it faild to perform a firmware upgrade (i.e. the IIS logs showed a 404 error). After I created the correct virtual directory name and re-factory reset the PAP2, the process went smoothly. That is, once the adapter actually downloaded the firmware file, the indicator light turned RED within 2 minutes.

Note: When the adapter is downloading firmware, the indicator light flashes at almost strobe-light speeds (i.e. VERY FAST) for about 5-10 seconds (i.e. the time it spends TFTP downloading the firmware file). When it's attempting to download firmware which it can't find, it the indicator light flashes too, but at a more constant rate and at a much slower speed.

Diggler

[xperiate]

When I first setup my HTTP server's virtual directory, I named it /+SPA<PAP2 MAC Address>/ instead of /+<PAP2 MAC Address>/. As a result, the first time my PAP2 successfully downloaded its ROOT XML FILE, it faild to perform a firmware upgrade (i.e. the IIS logs showed a 404 error). After I created the correct virtual directory name and re-factory reset the PAP2, the process went smoothly. That is, once the adapter actually downloaded the firmware file, the indicator light turned RED within 2 minutes.

Note: When the adapter is downloading firmware, the indicator light flashes at almost strobe-light speeds (i.e. VERY FAST) for about 5-10 seconds (i.e. the time it spends TFTP downloading the firmware file). When it's attempting to download firmware which it can't find, it the indicator light flashes too, but at a more constant rate and at a much slower speed.

Diggler

In my setup the HTTP response is a 200 which means the file was successfully transmitted over the HTTP request. Also, the Blue light flashes rapidly (strobe - as you put it) and then becomes solid blue.

I'm going to try one last time, then look for options!