I Ate Your Baby

Unlocking Vonage DLINK VTA-VR

by on Mar.31, 2010, under Mods

Unlocking the Vonage DLINK VTA-VR firmware 1.00.09


So, Vonage charged me a $50 disconnection fee because apparently i was on a ‘2 year’ contract.

In return, i felt obligated to own their stupid little Vonage ATA and make it work with other SIP providers.

The model I had was the D-LINK VTA-VR. In theory it’s a 2-line ATA that has hardware very similar to the Linksys PAP2. Practically, it has some annoying quirks that make it, in my case, only work for one line – or in some other cases, completely useless.

Files/programs you’ll need:

CYT46 for unlocking
the Vonage VTA-11.4.0-r060331-1.00.07-r060418.img firmware.
toro’s 1.09 unlocked firmware
tftpd maybe

So, quick overview of what we’re gonna do. We’re gonna somehow gain access to the Admin or Support accounts, then we’re gonna downgrade the firmware to 1.00.07, then we’ll unlock it with CYT46. Then we’ll put an unlocked version of 1.00.09 (created by toro) on there and quickly configure it.

Now, my problem was mine had been used on Vonage for a while, and I couldn’t get into the Admin or Support accounts. If you google around, the passwords are usually blank, the same as the username, or ‘tivonpw’. None of that worked for me though. User/User only. OK, we’ll start from there then.

This article assumes a certain degree of understanding. Like, I’m going to assume you know the IP of your VTA-VR, and you can disable your internet connection on your own and maintain local network connectivity. In my case, I have DHCP giving out static IP’s on my network, and I can disconnect the PPPoE session on the router to kill the internet.

OK so here goes:

Pull up the web interface of your currently locked VTA-VR. In this guide, i’m gonna use 192.168.1.73 as my example, since that’s what mine was.Ā  Try to login with username : Support and a blank password. This did not work for me. I had to login as user/user and then paste in the following link:

192.168.1.73/cgi-bin/webcm?getpage=/usr/www_safe/html/home/home_system.htm&var:OldProvisioned=on&=&var:OldUnProvisioned=on&=&var:isFirstTime=no

you may have to change the OldProvisioned option in there to ‘off’, but in my case, it came up properly. And by properly, I mean, i wanted to restore the Provisioned ParametersĀ  and Non-Provisioned Parameters to default. Using that URL came up with both options checked. I was able to hit ‘factory reset’ now, and did so. After the VTA-VR rebooted, i was able to login successfully as ‘Support’ with no password.As ‘Support’ i now had the ‘firmware’ tab i need to downgrade to 1.00.07.

Now disconnect your internet, so that the device wouldn’t re-download its config from Vonage.

In the firmware tab, flash VTA-11.4.0-r060331-1.00.07-r060418.img . This is Vonage’s 1.00.07 firmware, which can be cracked using CYT46. Wait for the VTA-VR to reboot.

When the device comes back up, re-open the web interface, and login as user/user again.

Open up a CMD prompt and navigate to the folder you unzipped CYT46 to. Run “CYT46 DLINK” (without the quotes). The ‘DLINK’ option is important. Use option 3 to set your target IP to your VTA-VR’s. In my case, 192.168.1.73. Now hit option 1. Hit Enter to reset the Admin pw and set SIP defaults. It might take a minute or it might take 3 to 5, but it should succesfully crack the 1.00.07 firmware and give you access to the Admin account.

go back to your web interface window (should still be logged in as user/user). Log out, and log back in as Admin/Admin. If you can’t, try unplugging the VTA-VR for a full reboot. If Admin/Admin doesn’t work, try Admin and blank password.

Go to the ‘Tech Support’ tab and flash toro’s 1.00.09 NA unlocked firmware. When this completes, you should have toros firmware, fully unlocked with SIP defaults and full access to the Admin, Support and user accounts.

You can configure your VTA-VR from the web interface now.

A few notes about configuring the VTA now that it’s unlocked:

It sends the CALLERID field as the username, instead of the username. This screwed me up for wayyy too long. So make sure you set the CALLERID and USERNAME fields as the username you want to send to your SIP provider.

Another strange glitch is it seems to have trouble sending some characters in the username. Some people are saying it has trouble with some letters (e? and above?). Mine didn’t have this problem, but mine wouldn’t send an _ (underscore) in the username field. This meant that i had to use a fully numeric username with no special characters.

I also had trouble with the REG_EXPIRE_TIMER setting. I set it to 3600, thinking 60 seconds x 60 minutes for a 1 hr registration. But i found my device was re-registering every minute. I downloaded someone else’s config, and theirs was set to 60000. This still resulted in a 1 minute registration. I set mine to 6000000. This somehow made registrations 1 hour. Don’t ask me why.

The time on my device is still 4 hours ahead. I can’t figure out how to fix this. If someone knows, please help.

And the final annoyance, apparently if you use it for 2 lines, they both send the registrations at the same time on the same port, so its kinda random if both lines connect or not.Ā  Or something like that. I dunno.

Now, you can configure it via the web interface, but you can also run TFTPD and provision it with an XML file. Basically you run tftpd, point it at the directory with the tiMAC.xml, and set the Provisioning Profile Base URL in the ‘Admin’ tab of your VTA-VR to tftp://yourpcip

If you google around you can find a few pre-configured xml example files and modify them – that’s what I did. You may alse want to set the Provisioning Profile Base URL in the ‘Admin’ tab to http://127.0.0.1 long term. Some people have reported their device re-locks to Vonage after a day or two if they don’t do this.

Some extra reading:
HydraGlass’s post on page 39 of this thread
CYT unlock thread
Jolpots guide to unlocking the VTA-VR
Toros thread releasing his 1.09 firmware

I didn’t proof-read this, so hopefully its right.

:, , , ,

16 Comments for this entry

  • DAVID

    nice inf
    I unlock de device with the new firmware 1.09 but i cant get the line to work with justvoip what did you do to make it work??

    than you for your help
    david

  • Groove

    David – sorry for the slow reply, I’ve been away.

    I’m betting it has something to do with the issue that it sends the CALLERID Number field as the username, AND seems to have problems with usernames that have letters or special characters.

    So, make sure you put your username (or justvoip login name) in the ‘CALLERID Number’ field of the admin interface.

    If that still doesn’t work, try a making username that is numbers only (ex> 123456) or a simple one like ‘ABCD’. Personally i couldn’t use a username that had an underscore in it. It wouldn’t send the underscore properly and therefore wouldn’t register.

    Its pretty annoying.

  • Dan

    I think we could skip a step and load Toro’s firmware without loading 1.00.07. I don’t have a locked VTA maybe somebody can try and report back.

  • Russ

    Dan, I actually tried skipping that step, and it doesn’t work. For some reason, you first must downgrade to 1.00.07, use CYT to unlock, then upgrade to the special unlocked 1.00.09. Not sure why that is.

    I’ve spent a good deal of time on this page following the instructions, and I successfully unlocked my VTA. Can anybody advise on what the web GUI settings need to look like in order to use it as a SIP extension with my Asterisk switch? I seem to be missing something simple because it doesn’t look like it’s even trying to register with my switch.

    Thanks for the awesome article. It’s very satisfying to get this device away from Vonage.

  • Russ

    I can add that the author of the unlocked firmware for the VTA (Toro) has a good set of instructions for provisioning the VTA using its web interface for various VOIP providers. If anyone needs a hand setting up the VTA after you’ve unlocked it, just go to voipfan.net.

    I have my VTA working nicely with my Asterisk switch. The only thing I still haven’t figured out is setting its clock so your caller-ID timestamps make sense.

  • Twist

    Hey guys, i need a copy of toro’s firmware, it seems the rapidshare has died, a reupload would be useful šŸ™‚

  • Bill

    hi, David, I try to hack it, but how can I get into the interface webpage? I cannot figure out the address of the device!!!

  • Vin

    I can’t reset the Support password using the URL however I reset the Support password by press hold the reset button for 2-3 mins šŸ™‚

  • Groove

    Hey Vin – thanks for the tip about holding the reset button – the URL thing was a bit tricky for me as well

    And thanks Anne for linking the ‘b’ version (and thanks to Toro for his hard work) – it looks very interesting! Mine works great so until it breaks i’m not touching it, but if it ever does go wacky i’ll definitely give the ‘b’ version a try!

  • Jason K

    I know this is an old post but I thought I would post a tip to sovle a problem it took me 2 hours to figure out on my own. The computer you are running the CYT tool from CAN NOT be dual-homed. That is, if you are running this for example from a laptop that has WiFi connected to one network and you are trying to crack your Vonage device via your LAN NIC (even if it is using a totally different network) – this will NOT work. I assume it is because the CYT tool is binding to the wrong networking adapter. The simple solution is to just disable all other adapters temporarily while you’re running the tool

  • Sid

    Hi There,

    Trying my luck even though it is quite a old thread. I have a VTR-VD vonage voip adapter. The firmware ver mentioned on the bottom of VTR-VD is 1.00.07 but on the login screen the ver is 1.00.09. I have tried all methods in the above post but I am still not able to login with either admin or support user.

    I want to provision the adaptor with Localphone.com.

    Any help on this will be greatly appreciated.

    Thanks

  • gold price

    Neither firmware 1.00.08 or 1.00.09 have this issue as far as I know. I just tried one of my adapters with an account named like “johndoe” and everything is working fine.

  • Jeremy

    Hi, do you happen to have Toro’s 1.09b firmware stashed away? It’s disappeared from RapidShare. Maybe stick it on DropBox and share a link? That would be so great if you do! šŸ™‚

    Also I found a spammy ad site copying your site content and plastering it with awful ads. It’s got a decent Google ranking too, so it might be worth hitting their provider with a cease and desist.

    http vonagedlinkvta dot blogspot dot co dot nz/2005/10/unlocking-vonage-dlink-vta-vr-firmware dot html

  • Groove

    hrm – he’s even hotlinkig to some of my files. classy!

    thanks for letting me know

    Try this =)

Leave a Reply

Looking for something?

Use the form below to search the site:

Still not finding what you're looking for? Drop a comment on a post or contact us so we can take care of it!

Visit our friends!

A few highly recommended friends...