Unlock PAP2 firmware 3.1.7 and above! (including 3.1.9 !!!)

by TheDigglerUser is offline Link  
Ok, since you don’t have the GPP_K value of the adapter which has been upgraded to firmware 3.1.9, before going any further, make sure you can FACTORY RESET THE ADAPTER (while it’s disconnected from the internet).
STEP 1: Factory Reset the adapter:

1) Disconnect the adapter from the internet
2) Connect a simple telephone to LINE1
3) Enter IVR mode by dialing: ****
4) Enter the command: 73738# (i.e. R E S E T #)
5) If/when prompted for password, enter one of the 5 “known/common” Vonage USER Passwords:

  • 78196365
  • 50274537
  • 7756112
  • 8995523
  • 5465866
  • 6) Press the # key after entering a password
    7) Repeat the process above until one of the passwords works or you’ve exhausted the list
    8) If prompted to “Press 1 to confirm,” do so.


If the adapter successfully factory resets, you may proceed with the next series of steps.
If not, you’re pretty much “stuck” at this point and need to find a working Vonage USER Password.



STEP 2: Attempt to access the PAP2’s WEB INTERFACE & remove Vonage’s DNS settings:

    1) Disconnect the internet connection from your BROADBAND ROUTER or BROADBAND MODEM
    2) Connect the PAP2 to your ROUTER
    3) Connect a PC to the ROUTER
    4) In a web-browser, navigate to the PAP2’s IP address (if you don’t know it, go back into IVR mode and issue command 110#)
    5) Go to the “SYSTEM” tab and clear out the “Primary DNS” and “Secondary DNS” entires.Note: If you can’t access the adapter’s web interface, so long as the adapter remains disconnected from the internet, the inability to perform this series of steps is not a big deal. The adapter will simply take longer resolving DNS requests (by trying Vonage’s IP addresses first, and after failing to reach them, trying DHCP assigned DNS entries next).

STEP 3: Gather/setup the following items:

1) Sipura SPA-2000 Firmware 2.0.9 converted to PAP2 mode firmware and renamed to file: PAP2-bin-03-01-09-LSc.bin (An already converted version of the firmware is availabe in Post #3, Step 3. Use file PAP2-SP2K.bin. If the aforementioned link is down, an alternate location for the files is listed in Post #504).
2) An HTTP Server running on your LOCAL LAN
3) A TFTP Server running on your LOCAL LAN @ Port 69 (for simplicity make this the same PC as the HTTP server)
4) A DNS Server running on your LOCAL LAN (for simplicity make this the same PC as the HTTP & TFTP servers)
5) A DHCP Server running on your LOCAL LAN:

  • If you have a BROADBAND ROUTER, this may be used provided you:

i) Disconnect the INTERNET CONNECTION to the router (i.e. unplug the cable going to the router’s WAN port and/or disable any WDS settings)
ii) Manually configure the PAP2’s DNS server to use the IP ADDRESS of your local DNS server (i.e. STEP #4 above). This will need to be done through the PAP2’s IVR:

a) Enter IVR mode by dialing: ****
b) Enter command 160# to review the current DNS server IP address (if you so desire)
c) Enter command 161# to set/change the DNS server IP address
d) Type in the IP address of your LOCAL DNS SERVER, separating octects with an asterisk (*). End input with the # key. Example: if your DNS SERVER’s IP address is 192.168.0.50, enter: 192*168*0*50#
e) Press 1 to SAVE, Press 2 to REVIEW, Press 3 to RE-ENTER, Press * to exit
f) Upon successfully reviewing the DNS Server IP Address setting, SAVE THE SETTING!

iii) Remember to clear the PAP2’s DNS Server settings after it’s been unlocked! (This can be done through the adapter’s web interface).

  • Internet Connection Sharing (ICS) built into XP may work. Try enabling it on the ETHERNET adapter of your PC (i.e. the same PC running the HTTP, TFTP, and DNS servers)
  • 3rd Party DHCP software should work too (for simplicity, make this the same PC as the HTTP, TFTP, and DNS servers)
    6) A copy of your adapter’s ENCRYPTED Config File (from Vonage’s TFTP server) named spa000000000000.xml (where 000000000000 is the MAC ADDRESS of your PAP2)

    Download a copy of your adapter’s ENCRYPTED Config File (from Vonage’s
    TFTP server) named spa000000000000.xml (where 000000000000 is the MAC
    ADDRESS of your PAP2). Try these commands.
    tftp -i ls.tftp.vonage.net GET spa000000000000.xml

    or

    tftp -i ls.tftp.vonage.net GET //spa000000000000.xml

    or

    tftp -i ls.tftp.vonage.net GET /spa000000000000.xml

    7) A CROSSOVER Ethernet cable

STEP 4: Configure your LOCAL LAN’s DNS Server to mimic Vonage’s Servers:

    1) Point httpconfig.vonage.net to the LAN IP address running your HTTP server
    2) Point ls.tftp.vonage.net to the LAN IP address running your TFTP server
    3) (Optional but recommended) Point *.vonage.net to the LAN IP address running your HTTP/TFTP servers
    4) (Optional but recommended) Forward UDP ports 21 & 2400 to Port 69 (so that your TFTP server receives traffic on ports 21, 2400, and the default TFTP port of 69). If you don’t know how to configure this, setup a 2nd TFTP server listening on PORT 2400. (Vonage seems to use ports 69 & 2400 the most, but they also use 21).



STEP 5: Prepare your local file structure:

    1) In your TFTP ROOT directory (or directories if running mulitple TFTP servers), copy your adapter’s ENCRYPTED config file to that directory as spa000000000000.xml (where 000000000000 is the MAC ADDRESS of your PAP2)
    2) In your HTTP ROOT directory, create sub-directory: +000000000000 (where 000000000000 is the MAC ADDRESS of your PAP2)
    3) Copy the modified SPA-2000 v2.0.9 firmware to the HTTP-ROOT/+000000000000/ directory (where 000000000000 is the MAC ADDRESS of your PAP2) as filename PAP2-bin-03-01-09-LSc.bin

STEP 6: Start the UNLOCK PROCESS (i.e. load SPA2000 2.0.9 firmware into your PAP2):

1) Disconnect the ethernet cable from the PC running the HTTP/TFTP/DNS servers
2) Disconnect the POWER cable from the PAP2
3) Connect the PAP2 and the PC to each other:

    If using a PC as your DHCP server:

    Connect the CROSSOVER Ethernet cable to the PAP2 (on one end) and to the PC running the DNS, TFTP, and HTTP servers (on the other end).

If using a BROADBAND ROUTER as your DHCP server:

  • Using a standard ethernet cable, connect the PAP2 to a LAN PORT on your Broadband Router
  • Using a standard ethernet cable, connect the PC (running the DNS, TFTP, and HTTP servers) to a LAN PORT on your Broadband Router
  • Make sure NOTHING is connected to the WAN PORT of the Broadband Router!
  • Make sure any WDS (Wireless Distribution System) settings have been disabled on the Broadband Router! If you don’t know what a WDS is and/or haven’t set one up, chances are there is nothing to disable.
    4) Make sure the PC is powered up and that the DNS, TFTP and HTTP servers are running
    5) Power on the PAP2
    6) If all goes well, your TFTP server’s log will show the PAP2 grabbing the encrypted file.
    7) Shortly thereafter, the HTTP server’s log should show the PAP2 grabbing the modified SPA2000 v2.0.9 firmware file.
    8) Once the PAP2 has loaded the SPA-2000 firmware, one of the indicator lights on the PAP2 should turn RED

STEP 7: (Re-)Open WEB access and configure known USER & ADMIN pws:

1) Create a TEXT FILE called spa000000000000.xml (where 000000000000 is the MAC ADDRESS of your PAP2) as follows:

    CODE

    <flat-profile>
    <Admin_Passwd ua=”na”>4321</Admin_Passwd>
    <Enable_Web_Server ua=”na”>Yes</Enable_Web_Server>
    <Web_Server_Port ua=”na”>80</Web_Server_Port>
    <Enable_Web_Admin_Access ua=”na”>Yes</Enable_Web_Admin_Access>
    <Protect_IVR_FactoryReset ua=”na”>No</Protect_IVR_FactoryReset>
    <User_Password ua=”na”>1234</User_Password>
    </flat-profile>


    2) Copy the new spa000000000000.xml (where 000000000000 is the MAC ADDRESS of your PAP2) file to your TFTP ROOT directory (or directories if running multiple TFTP servers)
    3) Power cycle the PAP2
    4) Check your TFTP Server’s log to see when the file has been grabbed

    If the TFTP Server’s log shows a FILE NOT FOUND error message, and if the file attempting to be grabbed was requested from an obscurely named sub-directory (i.e. /a12BcdeFgH/spa000000000000.xml), create that sub-directory (a12BcdeFgH) underneath the TFTP Root and move (or copy) the spa000000000000.xml file to that sub-directory. Then re-Power Cycle the PAP2 and re-check the TFTP Server’s log.

    5) After it’s been grabbed & loaded, the adapter’s USER password is “1234” and the ADMIN password is “4321

    Note: Sipura SPA-2000 2.0.9 firmware allows PLAIN TEXT config files to be loaded and processed. That is why this unlock “trick” works.



STEP 8: Revert back to PAP2 firmware:



STEP 9: Obtain the FACTORY FRESH GPP_K key (OPTIONAL but recommended)

    1) In STEP 6, the encrypted Vonage Config File got loaded into the adapter. This caused the adapter’s FACTORY FRESH GPP_K value to be overwritten w/ one supplied by Vonage.
    2) With the adapter disconnected from the internet and loaded w/ PAP2 firmware 3.1.6 or lower, FACTORY RESET THE ADAPTER. This will cause the FACTORY FRESH GPP_K value to be re-loaded, but it will also re-lock the adapter. Before FACTORY RESETTING the adapter though, delete your Vonage Encrypted spa000000000000.xml file from your TFTP ROOT! Otherwise, upon performing a FACTORY RESET, your adapter will request and process this file, a file which DISABLES THE ADAPTER’S WEB INTERACE! dry.gif
    3) Repeat the ORIGINAL (easy) UNLOCK process (i.e. perform the entire series of steps listed in POST #4 of this thread)
    4) After the adapter has been re-unlocked, extract the GPP_K value and save it! This value is located in the “Provisioning” tab of the adapter’s web-interface (i.e login as “admin,” switch to “advanced” mode and click on the “Provisioning” tab).How do you tell the difference beween the FACTORY FRESH GPP_K value and a Vonage assigned one?Attributes of the FACTORY FRESH GPP_K value:

    • 44 characters long
    • Comprised of alpha (A-Z, a-z), numeric (0-9), and symbols
    • Ends with an EQUAL SIGN (=)
    • Example: n6KClGUoMXzIQ/JmmuSFBE1GOu+M8335eHfPeYHeRAs=

    Attributes of a Vonage Assigned GPP_K value:

    • 64 characters long
    • Comprised of HEX characters (A-F, a-f, 0-9) only!
    • Example: 9190ca44e4cffb893c2ae43c4bca57fb18f04482a84dcce30d28017e7715a8a0



Diggler

P.S. For a flow-chart summary of most of the above, download pap2-318unl.zip which is also contained in the 4th post here:
http://www.dslreports.com/forum/remark,144…9999~start=1520

67 Comments

  1. I tried this on my 3.1.9 and everything went ok until it was supposed to grab the firmware from the http server. It never even makes a request to the dns server for anything other than the ls.tftp.vonage.net. Any further help would be greatly appreciated.Comment by MS — November 29, 2006 @ 10:28 pm
  2. How did you make the connections between your computer and adapter? What’s your computer’s ip and adapter’s. I think you need double check your DNS server if all addresses are really ok. Ping http://www.vonage.net and see if it’s working.Comment by alen — November 30, 2006 @ 4:09 am
  3. I have the same problem as MS; but I stupidly connected the device to the internet before ever starting research. (I was naive and didn’t think it would be locked…) As far as I can see, if you’ve been online with a 3.1.9(Lsc) device – then you’re out of luck. My device grabs the XML from my TFTP server but does not attempt a firmware update. From what I can read, it wont happen until Vonage pushes a firmware update (and updates your XML file on their TFTP server?)Comment by Al — December 19, 2006 @ 3:04 am
  4. I followed the procedure and now it has sipura 2000 firmware. now I cant get to the web interface – cant change the DNS entries to point it to my local dNS and when I try 161#, its asking me for a password and none of the above passwords are working.I am pretty much screwed I guess. THE mistake i made was….Connected the pap2 adapter to the internet after upgrading it to sipura 2000 firmware – now i think vonage has locked everything -is there any way I can recover my device and unlock it???Would really appreciate it.Thanks
    KevinComment by Kevin — December 30, 2006 @ 6:19 pm
  5. Hoy much time takes the firmware upgrade? Only request ls.tftp.vonage.net in the DNS server and no http server queryComment by drnet — January 18, 2007 @ 2:35 am
  6. Kevin, after it grabs spa2000, you need feed it with the plain text xml file. After that, you’ll have user/1234, admin/4321.Comment by alen — January 18, 2007 @ 3:09 am
  7. drnet, with DNS, http, and tftp servers, it will request xml first, then Firmware once and only once. When it requested, ls.tftp.vonage.net, did it take it? It’ll request .bin file only after it takes .xml file. If it already took .xml file, make sure the http server, address httpconfig.vonage.net, and .bin file’s path are correct. If the unit was never connected to internet, it should take it. Otherwise, it won’t. Good luck.
    AlenComment by alen — January 18, 2007 @ 3:13 am
  8. I am stuck at RED Led light. I have power cycled it many times so it would take plain text xml file but no luck. It does not reuqest the file. It only requested first time when it took the .bin file. It asked for u1Q2i8biMs folder. I created the folder and put plain xml file there. Then did the power recycle but it does not ask for it.Any help????TIAComment by ch — January 29, 2007 @ 6:25 pm
  9. Hi TIA, so it took .bin file already, right? You could check it by going to the ip. If you see Sipura web interface, it means it took spa2k firmware. Only if so, it will take the plain text xml file. Make sure everything else is still working file, like dns server, by trying ping ls.tftp.vonage.net. After you double check all above and are sure everything working properly, then wait for a little more time after you power cycle it.Note: You need have plain text xml file in tftp root and tftp root/u1Q2i8biMs. Better to copy the folder name u1Q2i8biMs from the log file to avoid typo.Comment by alen — January 29, 2007 @ 10:51 pm
  10. Hi Alen,
    Thanks for the reply. Yes, device has taken to the .bin file. I can use **** and check the vesion. It says Supra 2.xxx. But I cannot get to the web interface. I tried to user 161# to modify DNS server ip but it asked for password. None of the passwords worked even 4321. So I made my dns server 216.x.x.x and it took plain text xml file from u1Q2i8biMs folder. One led light it is still RED and no web interface access.Am I missing anyting?Thanks for you help :)Comment by Tia — January 30, 2007 @ 4:56 pm
  11. Further more when I try to reset the device so I could access web interface it asks for password and none of the above works.I dialed **** and then 73738# to reset.Thanks.Comment by Tia — January 30, 2007 @ 5:05 pm
  12. Did you reset after it took plain text file? If it’s sipura 2.0.9D, that’s good news. Before it took plain text file, you’ll not be able to access the web interface. After it took plain text file, you should be able to access web interface. log in as user/1234 first, then admin login with admin/4321. Make sure you have the right ip address. Check it by 110#. If the web interface doesn’t display, there must be something wrong with the plain text file. If you factory reset it now, the password 1234 or 4321 will be removed. If you want to try factory reset to activate web interface, use one of the passwords:
    78196365
    50274537
    7756112
    8995523
    5465866
    But it should not be necessary to do that, because plain text file will enable the web interface.
    By the way, to create the text file, just copy from the site and paste, that will make it for sure.Comment by alen — January 30, 2007 @ 5:26 pm
  13. By the way, did you try power cycle?Comment by alen — January 30, 2007 @ 5:28 pm
  14. Thanks Alen.I followed the steps exactly described in this thread. Also copied the text and put it in plain text xml file.Atfer it took plain xml file, I tried to access the web interface but no luck. Then I confirmed the ip by using **** and 110#. Tried again no luck. I thought may be I needed to do use 73738#, tried that and it asked for password. No luck with known passwords so far.But I will try accessing the web interface when I get home tonight and post the results here.Thanks.Comment by Tia — January 30, 2007 @ 5:31 pm
  15. Yes, power cycles many times.a Now it is sitting unplugged for more than 20 hours. I will try again tonight.Thanks.Comment by Tia — January 30, 2007 @ 5:32 pm
  16. 1. Was the plain text in both tftp root and tftp root/u1Q2i8biMs? Make sure it didn’t take the original xml file.2. Then make sure it’s not physical problem like cable.3. Then only one possibility left which is there’s something wrong with the plain text file. If you want, I could forward you the file I used and feed it again. You don’t need do factory reset.Comment by alen — January 30, 2007 @ 5:40 pm
  17. Here is my plain xml file:4321
    Yes
    80
    Yes
    No
    1234Yes I put it in root as well as u1Q2i8dBim folder. I haven’t tried again today but tomorrow I will.Thanks for your help and time.Comment by TIA — January 31, 2007 @ 4:29 am
  18. What happend to my xml file. LEts try again:
    CODE4321
    Yes
    80
    Yes
    No
    1234Comment by TIA — January 31, 2007 @ 4:30 am
  19. <flat-profile>
    <Admin_Passwd ua=”na”>4321</Admin_Passwd>
    <Enable_Web_Server ua=”na”>Yes</Enable_Web_Server>
    <Web_Server_Port ua=”na”>80</Web_Server_Port>
    <Enable_Web_Admin_Access ua=”na”>Yes</Enable_Web_Admin_Access>
    <Protect_IVR_FactoryReset ua=”na”>No</Protect_IVR_FactoryReset>
    <User_Password ua=”na”>1234</User_Password>
    </flat-profile>Comment by alen — January 31, 2007 @ 6:10 pm
  20. [quote]4321
    Yes
    80
    Yes
    No
    1234[/quote]Comment by alen — January 31, 2007 @ 6:11 pm
  21. The scripts were removed by wordpress I think.
    Again, after it took the plain text file, did you factory reset it? If not, and you are sure there’s no physical problem with the cable, and can’t go to web interface, the only possibility should be the plain text file which happened to me once before. If you want, I’ll send the plain text file I used later today.Comment by alen — January 31, 2007 @ 6:19 pm
  22. Alen, please email me file at chachoo72ATyahoo.ca and I will try to load it tonight. I will put it in root tftp folder as well as sub folder.Thanks for your help.Comment by Tia — January 31, 2007 @ 7:05 pm
  23. OK….. I have setup DNS Server, Web Server and TFTP Server on same machine. When I access it using ****, it says it is Supra 2.xxx. Good so far…. My device took modified plain text xml file. Good again ….. Now I am able to ping my device but still no web interface. I copied the xml text from this site so no error in xml. Also my Supra device has 216.115.x.x DNS enteries which I cannot change via 161#. It asks for password if I try to change it.Mine is stuck at RED light. No luck accessing web interface…..Thanks for you help.Comment by Tia — February 1, 2007 @ 4:01 am
  24. There is an error plain text xml file. Here is the correct XML file:4321
    1234
    80
    Yes
    Yes
    No
    SP2K-PAP2.binAdmin_Passwd section was missing ua=”na”. Added it and it did the trick.Comment by TIA — February 1, 2007 @ 6:20 am
  25. But the original one was working for me. Since you have this problem, let me change it. Thanks.Comment by alen — February 1, 2007 @ 4:54 pm
  26. Need help making sure things are right for the PAP2…
    Can you help me out Alen?Comment by Don — February 7, 2007 @ 3:38 am
  27. sorry for that short post…I have started on Diggler’s guide on the PAP2 3.1.9 unlock process. A few things I dont understand or over-analyzing. Setting up HTTP/DNS/DHCP/DNS?? I am on a WRT54G and have the PAP2 adapter. I just add in my IP in the fields of HTTP/DNS/DHCP/DNS on the PC running those?
    my email is doannguyen97@yahoo.com if u have an easier wayComment by Don — February 7, 2007 @ 3:42 am
  28. If you have pap2 v1 with firmware higher than 3.1.6(3.1.7+), you have to follow this process. What’s done? What problem do you have? Please show more details. This process guide gives you very detailed steps. Follow it step by step.Comment by alen — February 7, 2007 @ 9:37 pm
  29. sorry i took it the easy way out as I spent hours to days reading up on the material…I paid someone to do it over the net. Again, thanks alen. I dont mess with that area too often.Comment by Don — February 8, 2007 @ 1:59 am
  30. Like the first comment, I did the following:
    Connect my PC to a switch, PAP2 to the same switch, no internet.Start Simple DNS on my machine, verify that ls.vonage.net & httpconfig.vonage.net resolves to my IP (10.10.1.101) with NSLOOKUPStart IIS, verify that http://httpconfig.vonage.net/+pEO6DOxPTY/PAP-BIN-03-01-09-LSc.bin (looked in the W3SVC logfile to see that the file was grabbed from it via IE, the file did download to my PC)Start 3 instances of TFTPDWIN one running on each port 21, 69, 2400 respectively.Run Ethereal to watch what’s going on.Unplug PAP2 from LAN, power cycle PAP2, use IVR to factory reset the PAP2.Use IVR to set DHCP=0, Static IP 10.10.1.199, Subnet 255.255.255.0, Gateway 10.10.1.1, DNS 10.10.1.101Cycle power to PAP2 with LAN connected.PAP2 broadcasts it’s IP via ARP. Queries my DNS for ls.tftp.vonage.net and proceeds to download XML file from my TFTP server. The TFTP server shows the file was downloaded.Unit then sits there. It doesn’t try to download the modified firmware.This PAP2 has been provisioned for about 3 years. Recently I cancelled service wanting to use this box with something else (still looking to experiment). Maybe that’s where I’m having my problem?Linksys has released new firmware for PAP2. It is 3.1.22-LS and there are warnings about upgrading your device might cause interruption of service. If I’m screwed because of provisioning, I’d like to at least put the Linksys firmware in so that the customized Vonage firmware is out.Got any ideas? Email is amjunk#columbus.r r. com (not bot friendly)

    Comment by Alan — February 17, 2007 @ 2:50 pm

  31. [quote]… no internet

    Start IIS, verify that http://httpconfig.vonage.net/+pEO6DOxPTY/PAP-BIN-03-01-09-LSc.bin (looked in the W3SVC logfile to see that the file was grabbed from it via IE, the file did download to my PC)
    [/quote]
    Is this the modified firmware? So it already grabbed it? How come the folder is +pEO6DOxPTY? It should be +MAC which should 12digits and each one is 0-F.After that, you factory reset it?Comment by alen — February 19, 2007 @ 3:15 am
  32. That file is the modified firmware (PAP2SP2K.BIN renamed to PAP-BIN-03-01-09-LSc.bin) for sure, just double checked. Also, my post was from memory and I did confuse it. The IIS directory is the +MAC (the proper URL is http://httpconfig.vonage.net/+0012175E0389/PAP-BIN-03-01-09-LSc.bin) and I can download the file at my PC to test it and it resolves/downloads properly.I have a WRT54G with DDWRT firmware and the internal DNS running. I’ve forced the DNS to resolve all vonage URL’s to my local machine running the TFTP and HTTP server. They do resolve correctly, verified with NSLOOKUP.Any other ideas?Comment by Alan — February 20, 2007 @ 11:31 am
  33. According to IIS log and Ethereal, the PAP2 did not go grab the firmware, it didn’t even try. Unless it tried only to a specific IP instead of relying on DNS, which would fail. I might have to try a direct connect method to verify that.Comment by Alan — February 20, 2007 @ 11:33 am
  34. I’m confused by your comments. First you said it grabbed the modified firmware http://httpconfig.vonage.net/+0012175E0389/PAP-BIN-03-01-09-LSc.bin. Then you said it didn’t try to grab it. What do you mean? If it grabbed the modified firmware, you are good. It should SPA2K firmware now and you can feed the plain text xml file. If not, that means you have a provisioned units without GPP_K, you are pretty much stuck.Comment by alen — February 20, 2007 @ 6:38 pm
  35. But you could pay for an unlocke service.Comment by alen — February 20, 2007 @ 6:38 pm
  36. Problem reported. So we changed the plain text to the new one:
    <flat-profile>
    <Admin_Passwd ua=”na”>4321</Admin_Passwd>
    <Enable_Web_Server ua=”na”>Yes</Enable_Web_Server>
    <Web_Server_Port ua=”na”>80</Web_Server_Port>
    <Enable_Web_Admin_Access ua=”na”>Yes</Enable_Web_Admin_Access>
    <Protect_IVR_FactoryReset ua=”na”>No</Protect_IVR_FactoryReset>
    <User_Password ua=”na”>1234</User_Password>
    </flat-profile>Comment by cunyalen — February 21, 2007 @ 3:11 pm
  37. I can run TFTP on my PC, I don’t know how to run an HTTP server (help required here). Then in step 4, how do you “1) Point httpconfig.vonage.net to the LAN IP address running your HTTP server 2) Point ls.tftp.vonage.net to the LAN IP address running your TFTP server. ??PeterComment by Peter — March 18, 2007 @ 1:36 am
  38. You could use any http server. google it. What I’m using is a very small server called shttp. Or if you are using Windows 2000 server, that’s also fine.Point the address to LAN IP by domain name server or operating system server version. I use small dns plus.Basically, my computer is running small dns plus as dns server and DHCP server, shttp as http server and klever pumpkin as tftp server. Point all those addresses to my local computer. And I have a crossover cable connecting pc to pap2.Comment by alen — March 18, 2007 @ 2:35 am
  39. hello how can i unlock my pap2 is the 3.1.9c versioncan you help me for the i can voipbluster service??please thanksComment by samchamo — March 27, 2007 @ 3:44 pm
  40. Please follow this process guide. Any problems, post here. After you unlock it, you’ll be able to use voipbuster.
    Configurations, see here:
    http://nyworldphone.wordpress.com/?s=voipbuster+pap2Comment by Alen — March 29, 2007 @ 2:48 pm
  41. 1) Point httpconfig.vonage.net to the LAN IP address running your HTTP server
    2) Point ls.tftp.vonage.net to the LAN IP address running your TFTP serverCan anyone break these two steps down in simpler terms? I understand the idea is to use your offline PC to emulate the online server, but how and exactly where are these two above parameters set up exactly? I have Solar Winds tftp, Simple DNS Plus and Apache 2.02 installed. Appreciate anyone who can help with these two settings.Comment by Jonathan — October 31, 2007 @ 7:11 am
  42. Hello, You can unlock a pap2 the vonage 3.1.9(LSc), thanksComment by Alex CAmacho — October 31, 2007 @ 12:57 pm
  43. Jonathan, you do these settings in the Simple DNS Plus.
    Let’s say you are running everything on your local computer. It has ip 192.168.0.3.
    Then you need set up these two URLs pointing to your ip.It should be in Record. Click new, create new zone first with any name. Then you create URLs.
    Check this: http://www.simpledns.com/screen.aspxComment by alen — October 31, 2007 @ 11:20 pm
  44. Alex, yes this post is to unlock 3.1.7+ including 3.1.9.
    But it must be a fresh one, not connected to internet yet meaning it’s not provisioned by vonage yet.Comment by alen — October 31, 2007 @ 11:21 pm
  45. #Alex, yes this post is to unlock 3.1.7+ including 3.1.9.
    But it must be a fresh one, not connected to internet yet meaning it’s not provisioned by vonage yet.Comment by alen — October 31, 2007 @ 11:21 pm
    ***************************************************So if 3.1.9 was provisioned by vonage then I am sol????Comment by Db — November 9, 2007 @ 11:48 pm
  46. @Db, I know of someone can still unlock it with a paid service.Comment by alen — November 10, 2007 @ 2:04 am
  47. Hi there,I seem to have the same problem as Alan above. Namely, the unit fetches the XML file via TFTP but never makes an HTTP request for the bin. I was just wondering if anyone was able to get that problem resolved…Thanks!AnthonyComment by Anth — November 13, 2007 @ 8:36 pm
  48. If your unit was provisioned, it will take the xml file but not the firmware!People stated that if Vonage change the Xml file to request newer version firmware, then it will work. But I haven’t seen people reported that yet.If you your unit is not provisioned, and it doesn’t grab the .bin file, then what we can do is just repeat the process. Sometimes, we need wait a lttle longer. I tried some units. It never asked for the .bin file. I tried again some time later, and it worked.Sometimes, TFTP/DNS/HTTP servers may also cause problems. People restarted the computer and got it work.Comment by alen — November 14, 2007 @ 4:34 pm
  49. Thanks for the response, alen. I’m fairly sure the unit has never been exposed to the net as I took it out of the box myself (unless it’s a refurb???) I’ve tried dozens of times over the last few days and the result is always the same… it takes the xml but never even attempts the DNS query for the HTTP server. Oh well, I guess I’m out of luck. This one is going back to the store and I’m looking for a NA version! Thanks for the help!Comment by Anth — November 14, 2007 @ 8:44 pm
  50. @Auth, this happens under in either of two cases. One, something wrong in the whole process. Two, for no reason.I wonder if you checked that httpconfig.vonage.net and your http server were really working. To check the URL, you could do ’search’ if you are using Simple DNS plus, or ‘PING’. To check the http server, you could try http://localhost, maybe with some xxx.html file.In my experience, I had your problem pretty often, which was the second case. The only thing I did was try the whole process again also with restarting the computer and all servers, and FR the pap2.But all this really takes time. So it’s really up to what people want, what they are interested in.Save Money + Gain something else(?)
    G = _____________________________________Spend Time + Lose something else(?)If G>1, do it; if G<1, don’t. :)Comment by alen — November 15, 2007 @ 11:38 pm
  51. By the way, one more thing I have to emphasize which may not be reasonable.From people’s experience, using crossover ethernet cable and put all servers in one computer would be better than using router.Comment by alen — November 15, 2007 @ 11:42 pm
  52. Trying to unlock a 3.1.9LSc firmware unit. Never been on the Net. It grabs the xml file from my tftp, and then grabs the firmware from my http, but never flashes it. The power light blinks blue and ethernet light flashes indicating it’s grabbing the file, then it just stops, and both lights go back to blue. I can reset it using one of the passwords to get the web UI back but it still is running the 3.1.9 firmware. How do I get this thing to take the Sipura firmware?…Comment by flint — December 13, 2007 @ 5:22 pm
  53. By “grabs the firmware from my http”, do you mean you saw in the http server that it actually transferred the file over? Or you see it requested the firmware, but it actually didn’t take it. Double check if everything is in the right folder.Comment by alen — December 13, 2007 @ 7:44 pm
  54. It actually downloaded the firmware, with HTTP 200 OK. I packet sniffed to make sure it was actually transferring data, and it was. I read something on another board about the window size of the HTTP packets being too small or something..someone said they used something called DrTCP on Windows to change the window size, but I’m doing all this on Linux.Comment by flint — December 13, 2007 @ 8:26 pm
  55. After it took sipura firmware, before you reset again, you saw pap2 UI? If the sipura2k firmware was taken, there’s no reason that you still get pap2 UI, unless the file is wrong. Did you also try step 7 to get rid of the admin password with the plain text?As long as it really takes the plain text, you’ll have no more headache no matter you get what UI.Make sure you are using PAP2-SP2K.bin, not sp2k-pap2.bin.Comment by alen — December 14, 2007 @ 3:36 am
  56. Got it..turned out my copy of the firmware must have been bad or something. Got another copy and it flashed it just fine, then went through re-provisioning with an xml, and got it completely unlocked!..woo hoo! Is it true that if you do a reset via the IVR or even the web UI you’ll reset it to Vonage settings?Comment by flint — December 14, 2007 @ 7:42 am
  57. Yes. So always keep the GPP_K key. Then you’ll be safe. Otherwise, once it’s relocked again, you have no way to relock it unless you get a paid service.Or if you want to forward all inbound calls to one line, you could check http://nyworldphone.wordpress.com/2006/09/30/how-to-forward-all-inbound-calls-to-the-other-line-quote-2/. Then you use spa-1001, you will be safe.p.s. Whatever firmware you use, better not do upgrade if you are not sure. Turn off automatic provisioning and upgrade.Comment by alen — December 15, 2007 @ 3:13 pm
  58. It follows the steps of this procedure and my PAP2 vonage 3.19 Lsc gets to read the xml, but later in everything he asks for password admin and no it accepts value some. I believe that this is only applied for old versions of the firmware. Mine here is going to the garbage.Comment by Carlos Roberto — December 29, 2007 @ 7:11 pm
  59. @Carlos Roberto, when it read the xml file, did it take the firmware .bin file? If yes, it has spa2000 firmware now, and you need feed it with the plain text xml to reset the password.Comment by alen — December 30, 2007 @ 12:11 am
  60. Friend,
    Thank you very much for the attention. When he reads the xml I observe for the log of the tftp, but it doesn’t carry the firmware because the version continues 3.1.9 in the web. You can help finding out the steps to do him to record the firmware. I followed the whole steps, I installed IIS, I created the paste +000000000(Mac) I put the file in the paste.crpmoura@bol.com.brComment by Carlos Roberto — December 30, 2007 @ 3:48 am
  61. Was your unit connected to internet? If it’s provisioned by vonage, it will not request the .bin file. Otherwise, you need make sure nothing wrong in any step, check if all the domains like httpconfig.vonage.net are really working.Comment by alen — January 1, 2008 @ 1:58 am
  62. it was in the sealed packing. I removed of the packing and I called in HUB with access the internet and I tried to access to configure, but it didn’t accept password of the admin as it explains in the manual. As I can be checked httpconfig.vonage.net it is working, therefore problem is in this point once in the log he only appears ls.tftp.vonage.net operating.Comment by Carlos Roberto — January 1, 2008 @ 5:36 am
  63. “I removed of the packing and I called in HUB with access the internet…”. So it’s connected to internet? If so, it may have been provisioned by vonage now. It has to be stay away from internet before it’s unlocked.What’s the firmware version number now? If it’s higher than 3.1.9, there’s no doubt it has been provisioned and automatically updated.Comment by alen — January 1, 2008 @ 7:57 pm
  64. As soon as I tied the PAP2 noticed that the version was 3.19 Lsc and it didn’t change ties today. Only that in the it paginates 16 of the manual is registered that the password for admin is admin, but the PAP2 not accepts.Comment by Carlos Roberto — January 2, 2008 @ 11:51 am
  65. My ATA PAP2 v 3.19 was manufactured with the firmware of the vonage then it is impossible to do him to work. I am one more than it was wrong and it lost for the powerful of this world.Comment by Carlos Roberto — January 2, 2008 @ 2:18 pm
  66. @Carlos, for unlocked 3.1.9, username/password is admin/admin. Of course, it has to be unlocked. I don’t understand what’s really happening. Again, you connected it to your HUB with internet access, right? So it is possible it’s provisioned by vonage.If it’s still unprovisioned, then it’ll be very strange. If it takes the xml file, it should take the .bin file. Even though there’s anything wrong with http server or the .bin file, at least you should see the request in the http server.Comment by alen — January 3, 2008 @ 1:01 am
  67. By the way, this post was created to unlock pap2 for vonage originally.Comment by alen — January 3, 2008 @ 1:02 am

5 thoughts on “Unlock PAP2 firmware 3.1.7 and above! (including 3.1.9 !!!)

  1. hey there excellent site and layout. Hopefully I’m not annoying you I just wanted to inquire just what wordpress plugin you utilize to show the most recent commentary on your blog? I would like to do something like that for my free ipod site yet I cannot locate the plugin or widget for it. Thanks for your time :)

  2. @cityville, I did it long time ago. Kind of forgot what I exactly did. I’m using an old version of WP and the “Yourblog 2.0 theme”. It’s a “recent comments” widget. But I didn’t install any plugin for that. So I think it probably came with WP or the theme.

  3. Hello there. I wanted to drop you a quick note to state my thanks. I’ve been following your website for a month or more and get acquired a lot of good information and also appreciated the way you’ve organized your blog. I’m looking to run my weblog on the other hand consider its way too general and I wish to focus on smaller subjects.

Leave a Reply

Your email address will not be published. Required fields are marked *

You may use these HTML tags and attributes: <a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <s> <strike> <strong>