Unlocking the Vonage DLINK VTA-VR firmware 1.00.09

[howto voip]

Unlocking the Vonage DLINK VTA-VR firmware 1.00.09


So, Vonage charged me a $50 disconnection fee because apparently i was
on a ’2 year’ contract.

In return, i felt obligated to own their stupid little Vonage ATA and
make it work with other SIP providers.

The model I had was the D-LINK VTA-VR. In theory it’s a 2-line ATA
that has hardware very similar to the Linksys PAP2. Practically, it
has some annoying quirks that make it, in my case, only work for one
line – or in some other cases, completely useless.

Files/programs you’ll need:

CYT46 for unlocking
http://goo.gl/64VX

Tftpd32-3.26-setup.rar maybe
http://goo.gl/N6mA

Vonage VTA-11.4.0-r060331-1.00.07-r060418.img firmware.
search google
w*w*w*goo.gl/Mesr

toro’s 1.09 unlocked firmware
w*w*w*goo.gl/Mesr

So, quick overview of what we’re gonna do. We’re gonna somehow gain
access to the Admin or Support accounts, then we’re gonna downgrade
the firmware to 1.00.07, then we’ll unlock it with CYT46. Then we’ll
put an unlocked version of 1.00.09 (created by toro) on there and
quickly configure it.

Now, my problem was mine had been used on Vonage for a while, and I
couldn’t get into the Admin or Support accounts. If you google around,
the passwords are usually blank, the same as the username, or
‘tivonpw’. None of that worked for me though. User/User only. OK,
we’ll start from there then.

This article assumes a certain degree of understanding. Like, I’m
going to assume you know the IP of your VTA-VR, and you can disable
your internet connection on your own and maintain local network
connectivity. In my case, I have DHCP giving out static IP’s on my
network, and I can disconnect the PPPoE session on the router to kill
the internet.

OK so here goes:

Pull up the web interface of your currently locked VTA-VR. In this
guide, i’m gonna use 192.168.1.73 as my example, since that’s what
mine was. Try to login with username : Support and a blank password.
This did not work for me. I had to login as user/user and then paste
in the following link:

192.168.1.73/cgi-bin/webcm?getpage=/usr/www_safe/html/home/
home_system.htm&var:OldProvisioned=on&=&var:OldUnProvisioned=on&=&var:isFirstTime=no

you may have to change the OldProvisioned option in there to ‘off’,
but in my case, it came up properly. And by properly, I mean, i wanted
to restore the Provisioned Parameters and Non-Provisioned Parameters
to default. Using that URL came up with both options checked. I was
able to hit ‘factory reset’ now, and did so. After the VTA-VR
rebooted, i was able to login successfully as ‘Support’ with no
password.As ‘Support’ i now had the ‘firmware’ tab i need to downgrade
to 1.00.07.

Now disconnect your internet, so that the device wouldn’t re-download
its config from Vonage.

In the firmware tab, flash VTA-11.4.0-r060331-1.00.07-r060418.img .
This is Vonage’s 1.00.07 firmware, which can be cracked using CYT46.
Wait for the VTA-VR to reboot.

When the device comes back up, re-open the web interface, and login as
user/user again.

Open up a CMD prompt and navigate to the folder you unzipped CYT46 to.
Run “CYT46 DLINK” (without the quotes). The ‘DLINK’ option is
important. Use option 3 to set your target IP to your VTA-VR’s. In my
case, 192.168.1.73. Now hit option 1. Hit Enter to reset the Admin pw
and set SIP defaults. It might take a minute or it might take 3 to 5,
but it should succesfully crack the 1.00.07 firmware and give you
access to the Admin account.

go back to your web interface window (should still be logged in as
user/user). Log out, and log back in as Admin/Admin. If you can’t, try
unplugging the VTA-VR for a full reboot. If Admin/Admin doesn’t work,
try Admin and blank password.

Go to the ‘Tech Support’ tab and flash toro’s 1.00.09 NA unlocked
firmware. When this completes, you should have toros firmware, fully
unlocked with SIP defaults and full access to the Admin, Support and
user accounts.

You can configure your VTA-VR from the web interface now.

A few notes about configuring the VTA now that it’s unlocked:

It sends the CALLERID field as the username, instead of the username.
This screwed me up for wayyy too long. So make sure you set the
CALLERID and USERNAME fields as the username you want to send to your
SIP provider.

Another strange glitch is it seems to have trouble sending some
characters in the username. Some people are saying it has trouble with
some letters (e? and above?). Mine didn’t have this problem, but mine
wouldn’t send an _ (underscore) in the username field. This meant that
i had to use a fully numeric username with no special characters.

I also had trouble with the REG_EXPIRE_TIMER setting. I set it to
3600, thinking 60 seconds x 60 minutes for a 1 hr registration. But i
found my device was re-registering every minute. I downloaded someone
else’s config, and theirs was set to 60000. This still resulted in a 1
minute registration. I set mine to 6000000. This somehow made
registrations 1 hour. Don’t ask me why.

The time on my device is still 4 hours ahead. I can’t figure out how
to fix this. If someone knows, please help.

And the final annoyance, apparently if you use it for 2 lines, they
both send the registrations at the same time on the same port, so its
kinda random if both lines connect or not. Or something like that. I
dunno.

Now, you can configure it via the web interface, but you can also run
TFTPD and provision it with an XML file. Basically you run tftpd,
point it at the directory with the tiMAC.xml, and set the Provisioning
Profile Base URL in the ‘Admin’ tab of your VTA-VR to tftp://yourpcip

If you google around you can find a few pre-configured xml example
files and modify them – that’s what I did. You may alse want to set
the Provisioning Profile Base URL in the ‘Admin’ tab to http://127.0.0.1
long term. Some people have reported their device re-locks to Vonage
after a day or two if they don’t do this.