Unlocking the Vonage DLINK VTA-VR firmware 1.00.09
So, Vonage charged me a $50 disconnection fee because apparently i was on a ‘2 year’ contract.
In return, i felt obligated to own their stupid little Vonage ATA and make it work with other SIP providers.
The model I had was the D-LINK VTA-VR. In theory it’s a 2-line ATA that has hardware very similar to the Linksys PAP2. Practically, it has some annoying quirks that make it, in my case, only work for one line – or in some other cases, completely useless.
Files/programs you’ll need:
So, quick overview of what we’re gonna do. We’re gonna somehow gain access to the Admin or Support accounts, then we’re gonna downgrade the firmware to 1.00.07, then we’ll unlock it with CYT46. Then we’ll put an unlocked version of 1.00.09 (created by toro) on there and quickly configure it.
Now, my problem was mine had been used on Vonage for a while, and I couldn’t get into the Admin or Support accounts. If you google around, the passwords are usually blank, the same as the username, or ‘tivonpw’. None of that worked for me though. User/User only. OK, we’ll start from there then.
This article assumes a certain degree of understanding. Like, I’m going to assume you know the IP of your VTA-VR, and you can disable your internet connection on your own and maintain local network connectivity. In my case, I have DHCP giving out static IP’s on my network, and I can disconnect the PPPoE session on the router to kill the internet.
OK so here goes:
Pull up the web interface of your currently locked VTA-VR. In this guide, i’m gonna use 192.168.1.73 as my example, since that’s what mine was. Try to login with username : Support and a blank password. This did not work for me. I had to login as user/user and then paste in the following link:
you may have to change the OldProvisioned option in there to ‘off’, but in my case, it came up properly. And by properly, I mean, i wanted to restore the Provisioned Parameters and Non-Provisioned Parameters to default. Using that URL came up with both options checked. I was able to hit ‘factory reset’ now, and did so. After the VTA-VR rebooted, i was able to login successfully as ‘Support’ with no password.As ‘Support’ i now had the ‘firmware’ tab i need to downgrade to 1.00.07.
Now disconnect your internet, so that the device wouldn’t re-download its config from Vonage.
In the firmware tab, flash VTA-11.4.0-r060331-1.00.07-r060418.img . This is Vonage’s 1.00.07 firmware, which can be cracked using CYT46. Wait for the VTA-VR to reboot.
When the device comes back up, re-open the web interface, and login as user/user again.
Open up a CMD prompt and navigate to the folder you unzipped CYT46 to. Run “CYT46 DLINK” (without the quotes). The ‘DLINK’ option is important. Use option 3 to set your target IP to your VTA-VR’s. In my case, 192.168.1.73. Now hit option 1. Hit Enter to reset the Admin pw and set SIP defaults. It might take a minute or it might take 3 to 5, but it should succesfully crack the 1.00.07 firmware and give you access to the Admin account.
go back to your web interface window (should still be logged in as user/user). Log out, and log back in as Admin/Admin. If you can’t, try unplugging the VTA-VR for a full reboot. If Admin/Admin doesn’t work, try Admin and blank password.
Go to the ‘Tech Support’ tab and flash toro’s 1.00.09 NA unlocked firmware. When this completes, you should have toros firmware, fully unlocked with SIP defaults and full access to the Admin, Support and user accounts.
You can configure your VTA-VR from the web interface now.
A few notes about configuring the VTA now that it’s unlocked:
It sends the CALLERID field as the username, instead of the username. This screwed me up for wayyy too long. So make sure you set the CALLERID and USERNAME fields as the username you want to send to your SIP provider.
Another strange glitch is it seems to have trouble sending some characters in the username. Some people are saying it has trouble with some letters (e? and above?). Mine didn’t have this problem, but mine wouldn’t send an _ (underscore) in the username field. This meant that i had to use a fully numeric username with no special characters.
I also had trouble with the REG_EXPIRE_TIMER setting. I set it to 3600, thinking 60 seconds x 60 minutes for a 1 hr registration. But i found my device was re-registering every minute. I downloaded someone else’s config, and theirs was set to 60000. This still resulted in a 1 minute registration. I set mine to 6000000. This somehow made registrations 1 hour. Don’t ask me why.
The time on my device is still 4 hours ahead. I can’t figure out how to fix this. If someone knows, please help.
And the final annoyance, apparently if you use it for 2 lines, they both send the registrations at the same time on the same port, so its kinda random if both lines connect or not. Or something like that. I dunno.
Now, you can configure it via the web interface, but you can also run TFTPD and provision it with an XML file. Basically you run tftpd, point it at the directory with the tiMAC.xml, and set the Provisioning Profile Base URL in the ‘Admin’ tab of your VTA-VR to tftp://yourpcip
If you google around you can find a few pre-configured xml example files and modify them – that’s what I did. You may alse want to set the Provisioning Profile Base URL in the ‘Admin’ tab to http://127.0.0.1 long term. Some people have reported their device re-locks to Vonage after a day or two if they don’t do this.
I didn’t proof-read this, so hopefully its right.
The other day i was thinking about how much hardware that i have that’s hacked or modified in some way or another to make it do something other than it was really intended to do. I’m bored, so occasionally I’ll whip up a guide on how I did this stuff so that when my techie friends ask ‘whoa, how’d you do that?’ i can sarcastically reply ‘dude, don’t you read my blog?’
The first entry, since I just did it today, is about modifying the WL-520GU router from Asus.
Backstory: So, i needed to setup a wireless bridge.
I could have bought a device designed for precisely that purpose – but where would the fun be in that?
So, i grabbed an Asus WL-520GU for $50 – $10 MIR. Flashed it to DD-WRT, and then setup the bridge. DD-WRT has a lot of very cool features that I’m just learning about since I use Tomato on my main router – but that’s an article for another day perhaps. This guide focuses on flashing DD-WRT and setting it up as a wireless bridge (so that you can connect wired peripherals in another room to your main wireless router/network). As far as i know, the main router doesn’t have to be any specific model or firmware – just setup and working.
I’ll divide the process up into two guides: flashing DD-WRT, and setting up the bridge.
Part I: Flashing DD-WRT to the WL-520GU
Before i flashed DD-WRT, I read about 10 different guides of varying age, so here’s a quick walk-thru of how i did it.
Step 1. Download the latest DD-WRT mini_asus.trx from Here – in my case it was dd-wrt.v24_mini_asus.trx.
Step2. Download the Asus Utilties from Here . Unzip and install.
Step3. Assign a static IP to your network card, in the 192.168.1.whatever range. I suggest 192.168.1.10.
Step4. Hook up your WL-520GU – connect a LAN cable from your computer to one of the LAN ports on the new router. Disable any other network interfaces on your computer other than that LAN connection to the router.
Step5. Open up IE and type in 192.168.1.1 – you should be prompted for a PW from your WL-520Gu. ( this step isn’t 100% necessary – we’re just checking to see that the comp sees the router on the LAN). Hit ‘Cancel’ to not login to the router – we just want to know its there.
Step6. Preping to flash: Unplug the power cable from the router. Open up the Asus Utilties and run the Asus Firmware Restoration Utility. If you’re running Vista or 7, make sure to run it as an Administrator (right click on the icon and hit ‘Run as Administrator). Hit Browse and select the file dd-wrt.v24_mini_asus.trx that you downloaded in Step1.
Step7. The Flash: Hold down the reset button (the recessed black one on the back – you’ll need a pen or something pokey) and plug in the power cable to your WL-520GU. Keep holding the reset button until the power LED starts to flash. Release the reset button, go back to your Asus Firmware Restoration Utility and hit ‘Upload’. Hopefully it’ll flash DD-WRT and everything will go OK.
Step8. Once the firmware has flashed, the Firmware Restoration Tool will wait for the device to reboot. I gave it about a minute and a half and then unplugged/replugged the router. Open up IE, type in the address of the router (192.168.1.1) and viola – you should be greeted by DD-WRT!
Step9. 30-30-30 reset: I’m not sure if this was 100% necessary, but after i flashed DD-WRT i reset the router. You do so by holding that black reset switch on the back for 30 seconds – then unplugging it for 30 seconds – then plugging it back in while holding the reset button again for 30 seconds. I then unplugged it again and plugged it back in.
Part II: Setting up the Wireless Bridge
Step1. Avoiding a conflict with your main router: Open IE and go to the DD-WRT setup page @ 192.168.1.1. It’ll force you to assign a new username/pw. Go ahead and set whatever you’d like. Now navigate to Setup/basic setup/network setup/router IP – and change the router IP from its current setting of 192.168.1.1 – to 192.168.1.2. This is to make sure that if your main router uses 192.168.1.1 (like mine does) they won’t conflict. Hit Apply.
Step2. Change the Wireless settings: IE will be waiting for the router to reset on 192.168.1.1 – but now its @ 192.168.1.2 – so change the address in IE to 192.168.1.2 and you’re back in the DD-WRT setup page. Navigate to Wireless/basic settings/. Set Wireless mode: Client bridge. The rest of the settings will be the same as our main router. So if your main routers SSID is ‘ateyourbaby’ – that’s what you’ll set here. Check to see that ‘network configuration’ is set to bridged. Hit ‘Apply’.
Step3. Navigate to ‘Wireless Security’ and once again duplicate the settings on your main router. Same SSID, same passphrase, etc. Hit Apply.
Step4. Re-enable DHCP on your computer. Give it a minute or two, but at this point the WL-520GU should be connected to your main WLAN. Your PC should get an IP through the WL-520GU from your main router and be able to surf. Some people have reported that they have to set a static IP on machines behind the bridge, but i didn’t have this problem.
Voila! You have hacked your $40 router to be a wireless bridge!
P.S. Vegas is nice this time of year
P.P.S. If i have any blatant errors here feel free to point them out – i wrote this guide by memory so some things might be a little … off.