Unlock Thread for CYT VoIP Devices like the PAP2 Version 2.0, WRTP54G, and RTP300

These CYT VoIP devices can all be unlocked via the same software tool. Please note that this software is relatively untested, so use at your own risk.
_____________________________________________________________________

CYT Device Unlock FAQ:

1) Which adapters are CYT Devices?

CYT devices are VoIP adapters that use the TI AR7 chipset.
Here are a few of the CYT adapters:

- Linksys WRTP54G - 2 phone ports, 4 port router, wireless
- Linksys RTP300 - 2 phone ports, 4 port router
- Linksys RTP200
- Linksys PAP2 v2.0 - 2 phone ports
- Vtech IP8100 - Cordless SIP phone with base
- Motorola VT2442 - 2 phone ports, 4 port router
- D-Link VTA-VR - 2 phone ports
- Linksys WAG54GP2 - 2 phone ports, DSL router

The software being discussed in this thread may at some point be able to unlock many of these devices.

2) Where can I download the CYT device unlock software?

Latest Beta Release: cyt 4.6 for Windows (Details on this Beta Revision)

Latest Stable Release: cyt 3.9c for Windows (Details on this Revision)

Previous Stable Releases (Old):
cyt 3.5 for Windows (Details on this Revision)
cyt 3.0 for Windows

3) Which devices are confirmed to work with the latest version of the cyt software unlock?

More devices will be added to this list as time goes on.

- Linksys RTP300
- Linksys WRTP54G
- Linksys PAP2 v2.0 (not original PAP2)
- Motorola vt2442 (run using cmd-line arg: MOTO )
- D-Link VTA-VR (run using cmd-line arg: DLINK )
- Vtech IP8100

The unlocker may not work for Earthlink and some other providers. YMMV as individual providers may do things differently.

4) What does this software do and NOT do?

The CYT unlock tool will change the "Admin" and "user" passwords to default values (they will match the usernames). Additionally, all SIP settings are set to default by the tool.

For current customers with a VoIP provider, this tool will NOT retain any account settings after unlocking. Do not use this tool if you are subscribing to a phone service. The device you are unlocking should not be *registered* with any service unless you already know the exact SIP settings necessary for your provider.

5) How do I use this software?

Instructions are located in the readme file that's included in the software download

Here is a copy of those instructions:
_______________________________________

First, configure your network so that:
- your PC is either connected directly to a LAN port on the device or
you have the device connected to a simple switch or hub and the PC is
also connected to the same simple switch.

For Example:

+----------+ +------+ +----------+
| Computer |<---->|Switch|<-->|SIP Device|
+----------+ +------+ +----------+
192.168.15.100 - - 192.168.15.1

This example shows the SIP device is offering the IP of 192.168.15.1
on the LAN interface and that your PC has the IP of 192.168.15.100.

- This application requires two-way communication with the SIP device.
This means you will need to temporarily disable the Windows firewall or
open port 2400/TCP on the windows PC running the software application.

- After wiring your device and PC in a similar fashion as shown above,
you can run the software application from a Windows PC.

- The first menu, verify your IP of the SIP device. If incorrect, you
can press "3" to enter the correct IP of the SIP device.

- Using your favorite web browser, login to your SIP device. This is
required for the software to run. Skipping this step will display a
security violation on your screen.

- To start the 'reset' process, press "1".

* NOTE: After the software talks to your SIP device, you should wait up
to 1 or 2 minutes for your SIP device to accept the new configuration
values. Be patient!

- After about 1 or 2 minutes, the screen should change. You should see
a screen announcing the new Admin and user passwords.

- This screen is normally a sign that your device has succeeded in the
unlocking process. Try to access the SIP settings to verify this. (On
the Linksys SIP device, you should be able to access /update.html. The
username will be Admin (yes, capital A ) and the same (Admin) for the
password.

* NOTE: On the Linksys devices, this is often at: http://192.168.15.1/Update.html

6) What to look for if CYT software does not work:

1. Check to make sure you have a web browser open to the device.
(that means login as 'admin', not just open the page).

2. Make sure windows firewall is disabled. The device needs to
talk to the PC running the CYT program!

3. Did you wait long enough? It can easily take up to 1 minute!

* If you change the Admin / user passwords and forget them, just
run CYT program again and reset them! Remember, this will destroy
your custom SIP settings each time you run the CYT program...

7) How do I decrypt the provisioning file using the encryption key?

Decrypt Instructions Here (Thanks xperiate)

Details and Download Information for RC4

8) What about other adapters like the RT31P2 and WRT54GP2?

These adapters have a different unlock method. Use the linked thread below.

RT31P2 and WRT54GP2 Unlock Discussion

9) I accidentally thought this software unlocks the original PAP2 (V1). Which thread am i supposed to be in?

Just to repeat. The CYT software does NOT unlock the original PAP2 (V1)
How To Tell the Difference between V1 and V2: (LINK)
Original PAP2 unlock instructions: (LINK).

_____________________________________________________________________

Thanks go to the author of the CYT tool. (Not sure who that is)
Additional credit for tips from meister_sd/mazillo and rcilink @ dslreports
_____________________________________________________________________

Voip Provider Setups for Various Adapters:

PAP2 v2 SIP Settings:

1) internetcalls.com (thanks soufan)

1) leave the proxy and register blank in the SIP tab
2) fill in the username and password in the line#
3) enter sip.internetcalls.com for both the proxy and the register im the line# tab
4) Leave all the other settings to be default.
5) Disable 911 if you prefer. Scroll down to see the emergency number section.

2) Voipstunt (Link to Config)

3) Stanaphone (Link to Config)

D-Link VTA-VR Settings:

1) Jolpot's Guide to the VTA-VR

Well the long awaited solution to unlock PAP2 Ver 2 has been publicly released !

The serial # check isn't as important. On the UPC CODE itself it says "PAP2 v2.0," so determining whether you've purchased a PAP2 v2 is rather idiot proof.

I wouldn't make that recommendation. I'm just as new to the PAP2 v2 as everybody else in here.

I haven't.

I disagree with you Diggler. You are smarter than if not all of us, then most of us. I personally would not be use the tool until officially certified by The Diggler.

Hi I just picked up the new PAP2 V2 and tried the new tool to unlock it.

Here are my observations

I followed the steps as per the readme.txt. The application came back and said that it successfully unlocked my PAP2 v2.

I was able to get to the page where I can configure the line1, line2 and the sip settings.

Im not sure that confirms the unlocking.

Where do I get the GPP_K value to decrypt the factory default provision XML file


The tool works!!!

soufan, What's the page where you can configure line1 and line2. Did you upload any firmware using /update.html page. I get contact your provider in voice page.

Can you please help me.

Awesome. I will give it a try on my 3 PAP2V2s :-)

The URL for setting the SIP settings for line1 and line2 is
http://pap2ip/Voice_adminPage.html


Im having problems in decrypting the vonage provisioning file using the encryption key.

Have any body successfully decrypted the xml file

How did you decrpt the xml rc4 or VF?

Has anybody successfuly configured voicestick on the new PAP2V2?

Xperiate,
I used RC4 to decrypt the provision file

i wouldnt try this since it is still not been verified yet. Unless try if if u are till under warranty

Awesome. I now have the decrypted XML with the Admin Password. I will try confiuring it for Voicestick tomorrow and report back. Were you able to configure internelcalls?

Thanks for your help!

Internetcalls works fine. VoiceStick, cant get it to work!!!

Let us know if you suceed.

I get a dial-tone on both internetcalls and voicestick but can't make/receive any calls. How did you get internetcalls to work? Can you please post a pic of your settings?

Also, what goes in the SIP Tab? I only filled Line 1 and Line 2...

Update: Got internetcalls.com to work. But the callee gets some echo...how has your experience been? Voicestick still no luck....

I've updated the OP a bit with some of the basic info.

If someone wants to post detailed instructions on decrypting the provision key, that would be very helpful.

Plus, I can include SIP settings to the second post if someone has any to post.

Please post or PM me with any corrections

Instructions to decrpyt with Provision Key.

1. After you have gone through the unlock process (as described by Cron), login to the PAP2V2 as admin/admin by going to its IP address in the browser.

2. Next go to http://pap2ip/Provision.html and at the login prompt type the new password combo Admin/Admin and you will see the Provision Page. Right click in the white space of the page and click on "View Source".

3. Go through this file and you will find a long key (copy and keep it) and also a Vonage Folder like "JyuKartexY" - note that down as well.

4. Grab the tiMAC.xml file using this command on the "cmd" line. MAC is your PAP2 MAC Address.

c:\>tftp -i ti.tftp.vonage.net GET /JyuKartexY/tiMAC.xml

4.1 Before executing the RC4 command below, the tiMAC.xml has to have the "Read Only" and "Archive" flags switched off. Right click on the file in Windows, Go to Propoerties and uncheck the boxes for "Read Only" and Attribute" OR from the "cmd" type

c:\>attrib -r -a tiMAC.xml

5. Now, download RC4 and run it from the command line as below:

c:\>rc4 YourLongKey tiMAC.xml output.xml

6. Voila! You're done. The output.xml will contain the decrypted stuff from tiMAC.xml

If you have any questions, please ping me!

Good to hear that. try the echo supression setting on the line# tab. But I did not have any problems with internetcalls.com related to echo.

cyt 3.0 for Windows download link didn't work.

I just checked. It does work

You want to click on the right column that says "Free" for rapidshare. It then jumps to the next page where you need enter the letters in the graphic image and then click the download button.

hth

Any luck with Voicestick. I am getting dialtone but no call action - I am suspecting it has to do with dial-plan!

Same here. I will play with it more today.

D-Link VTA-VR VOIP Adapter FAR + $6 Shipping @ Micro Center

This adapter is currently locked to Vonage BUT it's possible that this CYT software tool will be updated to unlock this device since it uses the same chipset.

So, here's a deal in case you're interested in getting one in advance of the unlock.

Im starting to believe that the new PAP2 V2 cannot be configured with voice stick as the following voicestick required configurations are not supported by PAP2V2.

- SAS ( Streaming audio server )
- Outbound proxy in addition to the proxy
- Use authentication id

Visiting the http://pap2ip/cgi-bin/webcm?getpage=/usr/w...p/advSetup.html Opens up a whole bunch of cr$p that does not even apply to the PAP2 adapter.

That page is almost exactly what it looks like on a WRTP54G VoIP router. There is a chance Linksys just uses the RTP300/WRTP54G firmware source codes for this PAP2 v2.0.

I have sent you a personal message

Any luck with Voicestick at all?

Gave up on it

geeks man, geeks.

Would anybody tell me where to download the RC4?. I could not find it.

Thanks,

RC4 Downloads and Other Helpful Links:

Downloads:

rc4 Windows Executable + Source Code: RC4.zip

http://www.uqtr.ca/~delisle/Crypto/codes/rc4/rc4.c

Helpful Links and Troubleshooting:

Additional Details about RC4 located (here) and (here)

Troubleshooting RC4 - See Posts 35 to 37

Thank you so much!
I got the rc4 program, but when I run it as
"rc4 <mykey> tiXXXX.xml output.xlm", I got error like Invalid/Missing inFile "tixxxxx.xml", do you know what happended.

By the way, for the v2.0 pap2, I can get the key and the folder name directly from the pap2ip/update.html page. I do not have to "view" the source. Did I do something wrong here?

Thanks.

Here's the snipet of C code from the posted source code which produces the the error above:


Based on the above, if the "inFile" fails to open for READ (in BINARY MODE), the error message "Invalid/Missing inFile '<inFile>'" will be generated and the program will exit.

Translation: When you ran the program, you either typed in the incorrect input filename or failed to point the to the precise path (i.e. drive letter, folder, etc.) where the input file resides. If you copy rc4.exe to the same folder (i.e. directory) as your encrypted XML file and then open up (or navigate) your command prompt to that directory (using the "cd" command), you won't have to worry about specifying a file path.

Diggler

do the following from the command line to get rid of the error.

attrib -A timac.xml
attrib -R timac.xml
Now try the rc3, this will get rid of the error.

I had the same problem and this fixed it.

CYT file has been removed from Rapidshare server.
Please email it to me on skarim at gmail dot com

Thanks.

Moderator Edit: Removed full quote of OP

It is still downloadable from rapidsgare link

Have you tried using it through the web-based asterix server - www.pbxes.org ? I will be giving it a shot and then reporting back.

Any word yet about unlocking the Vtech IP8100?

Im a little bit confused with the asterisk. What benefit does it provide in addition to the functionalities provided by pap2?

Any lucky to unlock with D-Link VTA-VR device?
Thanks

It can consiolidate different trunks i.e. VoiceStick, Stanaphone, Internetcalls.com etc and provide it as a channel to you over 1 VoiP port with an extension. You can thus integrate multiple people with extensions and call using extension numbers as well - especially family etc. In reality, its a PBX system as in an office environment.

I tried pbxes but doesn't seem to work :(. It wasn't able to register extension.

Created a trunk for voicestick and created a couple of extensions and the status page on the pap2 v2 still shows as proceeding.

The same configuration works fine on a regular pap2. ( I can use a voicestick account without the outbound proxy )

PBXES is pretty cool. Thanks for pointing it out.

Are there any other free hosted pbx like pbxes?

If you succeed registering your PAP2 V2 to a pbxes extension let us know too.

Logs generated by PAP2V2 may be worth comparing with PAP2 original. PAP2V2 voice logs link is on Provision.html Unfortunately I do not have PAP2 Original. I have been trying to make PBXES work with V2 but no luck so far.

After we unlock it, do we need change the provisioning to "disabled", like old pap2?
Another stupid question, if the unit is re-locked by accident, how do we use the encryption key and decrypted provisioning file to re-unlock it? Thanks.

Been trying hard as well - just does not register with pbxes.org. Are you able to read the logs? I have a PAP2 original as well - let me know where to look for logs and I will help.

I have no idea about PAP2 Original and log locations. Reding PAP2V2 logs shows this entry [I used 217.195.32.11 as proxy server and Registrar]

SSMU: {--- Message Received: Received from addr=217.195.32.11:5060, UDP
SIP/2.0 404 Not found
Via: SIP/2.0/UDP

May be we should check message/ user agent signature, address & port on PAP2Bravo (Original) and that might clue in new thoughts !