Unlock your PAP2 : This is how I did a reset on my PAP2: I opened the box to find a two pin jumper for three pins available on the board. I kept the device ON, (I used NONSTATIC gloves) pluged off the jumper from the second and the third pins and connected it to the first and second pins. Then I punched in "****" and "FACTRESET" and then "1" on the telephone connected to the PAP2. It announced that it did RESET successfully. I then switched of the PAP2 and reverted the jumper back to its second and third pin position and closed the box. I had the PAP2 unlocked!' == BE CAREFULL ... AFTER THIS my PAP2 Vonage died, PING OK, but no more Web interface, only get IP thru DHCP, seems to try to get a configuration via TFTP ? But fails ? Perhaps the only way is to reflash the flash chip ? Linksys-PAP2-2.0.12(LS)_ROM DUMP of PAP2 Flash Chip.rom ? ---------------------------------------------------------- I had problems recovering from SOS with the rec-pap2-3-1-22-LS.exe, just as previous poster. This is what I had to do to recover: 1) Install the free TFTPD from here http://tftpd32.jounin.net/tftpd32_download.html 2) Make sure that my computer had the same IP address as when I flashed it with -23-LS. 3) Watch for about 5 min the TFTPD log window. Then, a request for a file showed up from the SOSing PAP2. 4) Download the -22.bin (not exe) firmware from http://prov.802.cz/fw/pap2-3-1-22-LS.bin 5) Rename the -22.bin with the same name as the TFTPD had logged. Then boom, the PAP2 was back in business with -22 firmware. Credit goes to another person, I didn't come up with this. ---------------------------------------------------------- To return the Linksys (Sipura) SPA to an unconfigured state: Pick up the handset attached to your SPA device. You may or may not hear the dialtone. Dial ****73738# Dial 1# to confirm. Hang up. ---------------------------------------------------------- ****877778#1 [User Reset?] ****110# [Read IP Address] ****732668# [Reboot?] ****73738# [Factory Reset? Needs password] ---------------------------------------------------------- From the PAP2 Administrator Guide: Enable/Disable Web Server of PHONE ADAPTER: 7932 Enter 1 to enable Enter 0 to disable Requires Password ? following password: 78196365 ? ---------------------------------------------------------- Unlock PAP2 Instructions (Crossover-cable method) The following is a complete set of step-by-step unlock instructions for PAP2 v1, Firmware 3.1.7 and greater. Firmware 3.1.6 and less can be unlocked with a simpler method. PAP2 hardware version 2 is much different internally. A different thread and technique applies to it. These instructions are based on posts scattered throughout the bargainShare.com Linksys PAP2 Unlock Info thread. IVR (Interactive Voice Response) codes and related links are listed in the Appendix at the bottom of this page. BACKGROUND The core of the PAP2 is a small computer within, a pre-programmed microprocessor and I/O system that will seek out a connection to Vonage.com when an Internet connection is available to it. Initial maintenance such as firmware upgrading will occur at this time, as well as registration if an account has been established. This procedure is based on mimicking this normal activity that only occurs when a new PAP2 is connected to the Internet for the first time. Once this initial activity has been preformed successfully by the PAP2 to Vonage, it will not be repeated. The procedure described here depends on the PAP2 being ready to preform this initial activity. Therefor, this brings up a very important point: The new unit MUST NOT be connected to the internet, even briefly, prior to this procedure or the unit will then be locked, or "bricked", as this condition is termed. So, Do not connect your new unit to the Internet yet. This means a computer, a router or a modem hooked to the internet, or any computer with a wireless card!!! PREPARATION Provide the following items [based on Post #120]: PAP2 v1 (top of box is orange) firmware version 3.1.7 to 3.1.9 – not previously connected to Internet. PC running XP Home or Pro with an Ethernet port (NIC) - Note: Windows 2000 does not do ICS (DNS) quite right for this procedure. Ethernet crossover cable. The following make-do's are possible if not available: A switch (or router with DHCP off, and using only its LAN connections) and 2 cables can be used as a clumsy substitute. Make your own from a regular cable by swapping the green pair and orange pair(most cables) - cut cover, fold, cut wires, strip, twist. Sipura SPA-2000 Firmware – pap2sp2kzip3vn.zip and sp2kpap2zip1pm.zip - must right click, then save. Rename extensions to .ZIP . [from Post #3, Step 3]. Comment: one user had to use IE. It would not dl with Firefox. 12/16/07 Tested dl with Netscape SeaMonkey and Firefox OK.. TFTP Server – free from SolarWind http://www.solarwinds.com/downloads/ HTTP Server. Choose ONE of these: SHTTPD - Preferred for size and ease of use. Freeware. http://shttpd.sourceforge.net/ [Note: testing of SHTTPD revealed an issue in this application. However, a similar product, "wxWebserver" tested OK. No log, though. Stay tuned.] IIS - free MS add-on. Only works for XP PRO. Specific instructions for IIS are not included here. An additional data connection to allow Windows ICS, Internet Connection Sharing, to activate. Choose ONE of these: an existing wireless port. install a 2nd Ethernet card(NIC) - What I did, Fry's sale 99 cents. XP will usually auto install it. A Virtual port. It acts like another physical port , but is software only. OpenVPN is suggested if a virtual port is needed, free at http://openvpn.net/download_action.php?ope...0.9-install.exe Factory reset your PAP2 [from Post #120 step1]: Connect power only, then Connect a simple telephone to LINE1 Enter IVR mode by dialing: **** Enter the command: 73738# (i.e. R E S E T #) If you're prompted to "Press 1 to confirm," do so (password is not required) If you're prompted for password, enter one of the "known/common" Vonage USER Passwords: 78196365 50274537 7756112 8995523 5465866 Press the # key after entering a password Repeat the preceeding two steps until one of the passwords works or you've exhausted the list Get your PAP2 MAC address Enter the IVR command: 140# Save your PAP2 information in notepad so that you can copy & paste and avoid typos. For example, my_PAP2_info.txt looks like this: MAC address: 00123456789A password: 7756112 Note: whenever you see as part of a file or folder name, translate it to your PAP2's MAC address. Get the unique encrypted XML file available for each PAP2 unit. Obtain this file by the following procedure [from Post #21]: with computer internet access, open a command window ( start/run/cmd ) cd to a convenient folder and note the location to retrieve the downloaded file later. Copy and paste the following in the command line: tftp -i ls.tftp.vonage.net GET //spa.xml Replacing the above with your PAP2's MAC address. Make sure no firewall is blocking internet access. Press "enter". The file "spa.xml will downloaded to the command folder in use. It will be about 30K bytes. In the sample unit above, the file name would be spa00123456789a.xml. It is referred to as "Your Encrypted XML file". Once this file and the other files above have been obtained, no additional internet access is required. CONFIGURE YOUR COMPUTER FOR UNLOCK PROCEDURE [based on Post #326] and additions: TFTP Server: Install SolarWind TFTP Server configure it to both transmit and receive files The default folder it creates is C:\TFTP-Root. It will be used for most files. HTTP Server: Unzip SHTTPD.zip and extract shttpd.exe to C:\TFTP-Root [There is an issue with SHTTPD in this app.(404 error) I used the very similar "wxWebServer" instead, and it worked fine. No log, though. Stay tuned. ] wxWebSrever defaults to port 8080; change that to port 80. click on it to run, click on the new green clover in the tray, set to autostart so it will be running if you reboot. Note. don't depend on autostart. Placing Unlocking Files: Note: is your own 12 character MAC address [ref Post #120, step 7] Your encrypted XML file: Copy your encrypted XML file, obtained in the preparation section, into C:\TFTP-root. You now have C:\TFTP-root\spa.xlm PAP2 to Sipura mode file ( firmware that temporarily converts unit to partial Sipura state) make a new folder in C:\TFTP-root. Name it + e.g C:\TFTP-root\+ Unzip pap2sp2kzip3vn.zip and rename file as PAP2-bin-03-01-09-LSc.bin copy it to the new sub-folder e.g. C:\TFTP-root\+\PAP2-bin-03-01-09-LSc.bin Make a 2nd copy of the file as C:\TFTP-root\PAP2-SP2K.bin Sipura to PAP2 ver 3.1.6 firmware: Unzip file sp2kpap2zip1pm.zip extract bin file to C:\TFTP-root and re-name it sp2k-pap2.bin for consistancy with this and most other guides. Plain-text spa.xml file - Made with notepad. It clears pw's, etc. This simple file will be created later, since it will have the same name as "your Encrypted XML File" DNS/DHCP Servers: DNS/DHCP Servers are part of XP's built-in Internet Connection Sharing (ICS). In order to activate ICS, XP requires two Local Area Connections. XP already has one Local Area Connection if the PC is connected to a Network or the Internet. A second Local Area Connection can come from an existing wireless port, from a second NIC, or from a virtual connection (OpenVPN). Do only ONE of these: Existing wireless port: Share connection OTHER THAN the Ethernet connection. This will make the one Ethernet connection available at 192.168.0.1. OR add a 2nd NIC: Share the original NIC connection and the other becomes the port available at 192.168.0.1. The computer will then work as usual after you are done - without re-configuring. Simply re-connect to the Internet. OR add a virtual connection: Install the OpenVPN software. The act of installing OpenVPN creates a second Local Area Connection. Share the virtual connection. This will make the one Ethernet connection available at 192.168.0.1. In any case, you will be using the connection that is NOT checked share. ICS activate: Note settings before making changes so they can be set back after you are done. Hint:The connections can be easily re-named to avoid confusion Control Panel > Network Connections Should have 2 connections shown. click Local Area Connection (~ the one to be shared, and not used here): Advanced tab: check the "Allow other network..." box General tab: Internet Protocol (TCP/IP) > Properties> Should be unconnected and show: Obtain an IP address automatically Obtain DNS server address automatically Retire the open properties panels Click on Local Area Connection (~whatever) - the connection to be used General tab: Internet Protocol (TCP/IP) > Properties> Shows: "Use the following iP address" - values here are auto-installed by ICS 192.168.0.1 255.255.255.000 "use the following DNS server address" 192.168.0.1 DNS redirect using hosts file: This routes PAP2 vonage requests to local files. Make backup copy of C:\Windows\system32\drivers\etc\hosts Open the hosts file with NotePad and add the following two lines to the end of the file: 192.168.0.1 ls.tftp.vonage.net 192.168.0.1 httpconfig.vonage.net The UNLOCK PROCESS Verify that there is no live internet connection or ISP configuration. If using 2 NICS, double check now that there is NO INTERNET CONNECTION to the other NIC!! If your other port is a wireless connection, assure that your access point is disabled and that no nearby WIFI signal has inadvertantly connected you to the internet !!! From command line: ipconfig/all to inspect your configuration UNLOCK - Stage 1 Connect the PAP2 to the PC's 192.168.0.1 ethernet port with a crossover cable Power on the PAP2 Wait 1 minute and PAP2 should have two steady blue lights Start SHTTPD Start SolarWinds. SolarWinds should be listening to 192.168.0.1 (lower right corner) Power cycle the Linksys-mode PAP2. The PAP2 boot sequence should be as follows: After a few minutes PAP2 makes a TFTP request. This can be verified from SolarWinds' main window indicating that PAP2 grabed the ENCRYPTED spa.xml file. Then PAP2's BLUE LEDs FLASH RAPIDLY for 5-10 seconds, indicating that the PAP2 is processing the spa.xml file. Then PAP2 sends an HTTP REQUEST to the HTTP server for the SPA2K firmware file, PAP2-bin-03-01-09-LSc.bin. This can be verified from the SHTTPD log panel. PAP2's indicator light should turn RED, indicating successful processing of the SPA2K firmware file. [continuing on Post #120 STEP #7] UNLOCK - Stage 2 Strong provisioning rules are still prohibiting free access, but the "guts" of the PAP2 have now been changed, allowing an unencypted plain-text provisioning file to be read into the unit. Copy and paste the following section of text into NOTEPAD: 4321 Yes 80 Yes No 1234 Name this file spa.xml ( replacing with your unit's MAC #), and using ANSI encoding (not UNICODE)!!! Save this file to the C:/TFTP-Root folder, replacing the "encrypted" spa.xml Power cycle the PAP2 Check the TFTP Server's log to see that the plain text spa.xml file (created in SETUP) was grabbed. If the TFTP Server's log shows a FILE NOT FOUND error message, and if the file attempting to be grabbed was requested from an obscurely named sub-directory (i.e. /a12BcdeFgH/spa.xml), create that sub-directory (a12BcdeFgH) underneath the TFTP Root and move (or copy) the spa.xml file to that sub-directory. Then re-Power Cycle the PAP2 and re-check the TFTP Server's log. The unit is unlocked and in Sipura mode. The unit is still vulnerable to "bricking" by an internet connection. The rest of the work will be done directly through the unit's web interface. UNLOCK - stage 3 Operational firmware and manual provisioning are next. [continuing on Post #326 UNLOCK PROCESS] Get the IP address of PAP2 web-interface: Dial * * * * Enter: 110# IP address of PAP2 web-interface should be 192.168.0.xxx Put "http://192.168.0.xxx/" in browser's address bar Login as user User Name: user Password: 1234 PAP2 web-interface comes up Switch to Admin Login, link near the top-right. User Name: admin Password: 4321 [continuing on Post #4 Basic Firmware Update Instructions] Click the "Advanced" button near the top-right. This will show the Provisioning Tab. Click the PROVISIONING tab and set PROVISION ENABLE=NO. DNS addresses= 0.0.0.0 admin password=blank. Click "Submit All Changes". Copy the following address into the browser's address bar. http://192.168.0.XX/upgrade?tftp://192.168.0.1/SP2K-PAP2.bin note: this browser line is addressed to the PAP2 at 192.168.0.XX. It commands the pap2 to do an upgrade using the TFTP server at 192.168.0.1 . The file to be served is in the ROOT directory of that server and the address shown relects this, though the file is NOT in the root directory of the computer. Done, almost. Your Linksys PAP2 will eventually reboot (2 blue LEDs) (BE PATIENT) and you can click the "admin login" near the top-right. No password needed. From admin login, go to advanced mode and provision tab. Examine this page for the presence of the factory gpp_k value, the unit's encryption key. It will be a 44 character alphanumeric base64 string ending with "=". If it is there, extract that key and save it, you are done. If it is absent ( a different type of string (hex) or is blank) you should retrieve the factory key. Without this key, the unit can be permanently "bricked" If the unit is inadvertently reset while connected to the internet. Get the FACTORY GPP_K [continuing on Post #325 step 9] Remove the spa.xml file from C:/TFTP-Root Factory Reset enter IVR mode by dialing: * * * * enter 73738# [continuing on Post #4] Power cycle the PAP2 (not needed??) Type the IP address of the PAP2 adapter into your web browser to get to the configuration page (see IVR code in appendix if you need the IP address) In SYSTEM, set a User password of 1234 Click the SAVE SETTINGS button. Refresh the link (you login with user and 1234) Copy the following address into the browser's address bar http://192.168.0.XX/upgrade?tftp://192.168.0.1/PAP2-SP2K.bin Examine the status leds. Power should turn RED when it is done. Give it a minute or two, dont interrupt it. Once red, point browser at your PAP2. (our IP in this example is 192.168.0.5) Click the "admin login" link near the top-right. Click the "Advanced" button near the top-right. This will show the Provisioning Tab. Click the PROVISIONING tab. Set PROVISION ENABLE=NO and click "Submit All Changes". Copy the following address into the browser's address bar, and modify to include your TFTP server's IP address. http://192.168.0.XX/upgrade?tftp://192.168.0.1/SP2K-PAP2.bin Done. Your Linksys PAP2 will eventually reboot (2 blue LEDs, BE PATIENT) and you can click the "admin login" near the top-right. No password needed. Put http://192.168.0.xxx/ in browser's address bar and the PAP2 web-interface comes up Switch to Admin Login > "Advanced" mode > "Provisioning" tab > extract the GPP_K value and save it. Make sure you got the FACTORY FRESH GPP_K value. Attributes are: 44 characters long Comprised of alpha (A-Z, a-z), numeric (0-9), and symbols Ends with an EQUAL SIGN (=) RESTORE PC TO ITS ORIGINAL CONDITION If there is a chance of Unlocking PAP2 another time, disable the effects of OpenVPN, IIS, and SolarWinds as decribed in at the end of Post #1332. If you will not be Unlocking any more PAP2s, you can unistall the software and settings: Remove Local Area Connection 2 OpenVPN > Delete all TAP-Win32 virtual Ethernet adapters Restore values for Local Area Connection Restore original copy of C:/Windows/System32/Drivers/etc/hosts Re-enable any/all firewalls, antivirus, antispyware, etc. Uninstall programs that were not installed before: OpenVPN SolarWind TFTP Server shttpd APPENDIX IVR (Interactive Voice Response) To enter IVR mode, connect a phone to the PAP2 and dial: * * * *. Then enter an IVR code: 110# --- Current IP address of PAP2 140# --- MAC Address of PAP2 150# --- firmware version of PAP2 73738# --- factory reset the PAP2 (USER password needed) Administration Guide Linksys PAP2 and RT31P2 PHONE ADAPTER Administration Guide (pdf) has a sections on: 1.1.2. Provisioning Overview 2.1. Phone Adapter LED Status (meaning of indicator lights) 3. Software Configuration Mechanism 3.4.1 If the value of "upgrade enable" parameter in Provisioning tab is no, you cannot upgrade the PHONE ADAPTER ------------------------- Linksys PAP2 V2 Linksys PAP V2 with two Phone Ports. This is made for Vonage only. The CPU of the board uses TNETV10552. The tool to debug the CPU is EJTAG (NonDMA). Flash 8MB 28F640 Firmware 8MB $90000000-$907FFFFF Definition Commands (usbjtag NT 0.34a and up,CYT.dll 0.05): TPAP2V2.xml Backup firmware getram 90000000 800000 save 9fc00000 800000 Program the firmware detect ldram boot (file backed up) program 90000000 800000