I Ate Your Baby

Unlocking Vonage DLINK VTA-VR

by on Mar.31, 2010, under Mods

Unlocking the Vonage DLINK VTA-VR firmware 1.00.09


So, Vonage charged me a $50 disconnection fee because apparently i was on a ‘2 year’ contract.

In return, i felt obligated to own their stupid little Vonage ATA and make it work with other SIP providers.

The model I had was the D-LINK VTA-VR. In theory it’s a 2-line ATA that has hardware very similar to the Linksys PAP2. Practically, it has some annoying quirks that make it, in my case, only work for one line – or in some other cases, completely useless.

Files/programs you’ll need:

CYT46 for unlocking
the Vonage VTA-11.4.0-r060331-1.00.07-r060418.img firmware.
toro’s 1.09 unlocked firmware
tftpd maybe

So, quick overview of what we’re gonna do. We’re gonna somehow gain access to the Admin or Support accounts, then we’re gonna downgrade the firmware to 1.00.07, then we’ll unlock it with CYT46. Then we’ll put an unlocked version of 1.00.09 (created by toro) on there and quickly configure it.

Now, my problem was mine had been used on Vonage for a while, and I couldn’t get into the Admin or Support accounts. If you google around, the passwords are usually blank, the same as the username, or ‘tivonpw’. None of that worked for me though. User/User only. OK, we’ll start from there then.

This article assumes a certain degree of understanding. Like, I’m going to assume you know the IP of your VTA-VR, and you can disable your internet connection on your own and maintain local network connectivity. In my case, I have DHCP giving out static IP’s on my network, and I can disconnect the PPPoE session on the router to kill the internet.

OK so here goes:

Pull up the web interface of your currently locked VTA-VR. In this guide, i’m gonna use 192.168.1.73 as my example, since that’s what mine was.  Try to login with username : Support and a blank password. This did not work for me. I had to login as user/user and then paste in the following link:

192.168.1.73/cgi-bin/webcm?getpage=/usr/www_safe/html/home/home_system.htm&var:OldProvisioned=on&=&var:OldUnProvisioned=on&=&var:isFirstTime=no

you may have to change the OldProvisioned option in there to ‘off’, but in my case, it came up properly. And by properly, I mean, i wanted to restore the Provisioned Parameters  and Non-Provisioned Parameters to default. Using that URL came up with both options checked. I was able to hit ‘factory reset’ now, and did so. After the VTA-VR rebooted, i was able to login successfully as ‘Support’ with no password.As ‘Support’ i now had the ‘firmware’ tab i need to downgrade to 1.00.07.

Now disconnect your internet, so that the device wouldn’t re-download its config from Vonage.

In the firmware tab, flash VTA-11.4.0-r060331-1.00.07-r060418.img . This is Vonage’s 1.00.07 firmware, which can be cracked using CYT46. Wait for the VTA-VR to reboot.

When the device comes back up, re-open the web interface, and login as user/user again.

Open up a CMD prompt and navigate to the folder you unzipped CYT46 to. Run “CYT46 DLINK” (without the quotes). The ‘DLINK’ option is important. Use option 3 to set your target IP to your VTA-VR’s. In my case, 192.168.1.73. Now hit option 1. Hit Enter to reset the Admin pw and set SIP defaults. It might take a minute or it might take 3 to 5, but it should succesfully crack the 1.00.07 firmware and give you access to the Admin account.

go back to your web interface window (should still be logged in as user/user). Log out, and log back in as Admin/Admin. If you can’t, try unplugging the VTA-VR for a full reboot. If Admin/Admin doesn’t work, try Admin and blank password.

Go to the ‘Tech Support’ tab and flash toro’s 1.00.09 NA unlocked firmware. When this completes, you should have toros firmware, fully unlocked with SIP defaults and full access to the Admin, Support and user accounts.

You can configure your VTA-VR from the web interface now.

A few notes about configuring the VTA now that it’s unlocked:

It sends the CALLERID field as the username, instead of the username. This screwed me up for wayyy too long. So make sure you set the CALLERID and USERNAME fields as the username you want to send to your SIP provider.

Another strange glitch is it seems to have trouble sending some characters in the username. Some people are saying it has trouble with some letters (e? and above?). Mine didn’t have this problem, but mine wouldn’t send an _ (underscore) in the username field. This meant that i had to use a fully numeric username with no special characters.

I also had trouble with the REG_EXPIRE_TIMER setting. I set it to 3600, thinking 60 seconds x 60 minutes for a 1 hr registration. But i found my device was re-registering every minute. I downloaded someone else’s config, and theirs was set to 60000. This still resulted in a 1 minute registration. I set mine to 6000000. This somehow made registrations 1 hour. Don’t ask me why.

The time on my device is still 4 hours ahead. I can’t figure out how to fix this. If someone knows, please help.

And the final annoyance, apparently if you use it for 2 lines, they both send the registrations at the same time on the same port, so its kinda random if both lines connect or not.  Or something like that. I dunno.

Now, you can configure it via the web interface, but you can also run TFTPD and provision it with an XML file. Basically you run tftpd, point it at the directory with the tiMAC.xml, and set the Provisioning Profile Base URL in the ‘Admin’ tab of your VTA-VR to tftp://yourpcip

If you google around you can find a few pre-configured xml example files and modify them – that’s what I did. You may alse want to set the Provisioning Profile Base URL in the ‘Admin’ tab to http://127.0.0.1 long term. Some people have reported their device re-locks to Vonage after a day or two if they don’t do this.

Some extra reading:
HydraGlass’s post on page 39 of this thread
CYT unlock thread
Jolpots guide to unlocking the VTA-VR
Toros thread releasing his 1.09 firmware

I didn’t proof-read this, so hopefully its right.

:, , , ,

16 Comments for this entry

  • DAVID
    June 30th, 2010 on 12:42 pm

    nice inf
    I unlock de device with the new firmware 1.09 but i cant get the line to work with justvoip what did you do to make it work??

    than you for your help
    david

  • Groove
    August 5th, 2010 on 7:20 pm

    David – sorry for the slow reply, I’ve been away.

    I’m betting it has something to do with the issue that it sends the CALLERID Number field as the username, AND seems to have problems with usernames that have letters or special characters.

    So, make sure you put your username (or justvoip login name) in the ‘CALLERID Number’ field of the admin interface.

    If that still doesn’t work, try a making username that is numbers only (ex> 123456) or a simple one like ‘ABCD’. Personally i couldn’t use a username that had an underscore in it. It wouldn’t send the underscore properly and therefore wouldn’t register.

    Its pretty annoying.

  • Dan
    February 22nd, 2011 on 2:33 pm

    I think we could skip a step and load Toro’s firmware without loading 1.00.07. I don’t have a locked VTA maybe somebody can try and report back.

  • Russ
    February 25th, 2011 on 7:30 pm

    Dan, I actually tried skipping that step, and it doesn’t work. For some reason, you first must downgrade to 1.00.07, use CYT to unlock, then upgrade to the special unlocked 1.00.09. Not sure why that is.

    I’ve spent a good deal of time on this page following the instructions, and I successfully unlocked my VTA. Can anybody advise on what the web GUI settings need to look like in order to use it as a SIP extension with my Asterisk switch? I seem to be missing something simple because it doesn’t look like it’s even trying to register with my switch.

    Thanks for the awesome article. It’s very satisfying to get this device away from Vonage.

  • Russ
    March 7th, 2011 on 1:40 pm

    I can add that the author of the unlocked firmware for the VTA (Toro) has a good set of instructions for provisioning the VTA using its web interface for various VOIP providers. If anyone needs a hand setting up the VTA after you’ve unlocked it, just go to voipfan.net.

    I have my VTA working nicely with my Asterisk switch. The only thing I still haven’t figured out is setting its clock so your caller-ID timestamps make sense.

  • Twist
    March 24th, 2011 on 2:12 pm

    Hey guys, i need a copy of toro’s firmware, it seems the rapidshare has died, a reupload would be useful 🙂

  • Bill
    April 28th, 2011 on 6:47 pm

    hi, David, I try to hack it, but how can I get into the interface webpage? I cannot figure out the address of the device!!!

  • Vin
    July 4th, 2011 on 10:16 pm

    I can’t reset the Support password using the URL however I reset the Support password by press hold the reset button for 2-3 mins 🙂

  • Groove
    January 2nd, 2012 on 10:00 pm

    Hey Vin – thanks for the tip about holding the reset button – the URL thing was a bit tricky for me as well

    And thanks Anne for linking the ‘b’ version (and thanks to Toro for his hard work) – it looks very interesting! Mine works great so until it breaks i’m not touching it, but if it ever does go wacky i’ll definitely give the ‘b’ version a try!

  • Jason K
    September 4th, 2012 on 7:27 pm

    I know this is an old post but I thought I would post a tip to sovle a problem it took me 2 hours to figure out on my own. The computer you are running the CYT tool from CAN NOT be dual-homed. That is, if you are running this for example from a laptop that has WiFi connected to one network and you are trying to crack your Vonage device via your LAN NIC (even if it is using a totally different network) – this will NOT work. I assume it is because the CYT tool is binding to the wrong networking adapter. The simple solution is to just disable all other adapters temporarily while you’re running the tool

  • Sid
    September 8th, 2012 on 1:06 pm

    Hi There,

    Trying my luck even though it is quite a old thread. I have a VTR-VD vonage voip adapter. The firmware ver mentioned on the bottom of VTR-VD is 1.00.07 but on the login screen the ver is 1.00.09. I have tried all methods in the above post but I am still not able to login with either admin or support user.

    I want to provision the adaptor with Localphone.com.

    Any help on this will be greatly appreciated.

    Thanks

  • gold price
    December 24th, 2012 on 2:43 pm

    Neither firmware 1.00.08 or 1.00.09 have this issue as far as I know. I just tried one of my adapters with an account named like “johndoe” and everything is working fine.

  • Jeremy
    January 21st, 2013 on 1:29 am

    Hi, do you happen to have Toro’s 1.09b firmware stashed away? It’s disappeared from RapidShare. Maybe stick it on DropBox and share a link? That would be so great if you do! 🙂

    Also I found a spammy ad site copying your site content and plastering it with awful ads. It’s got a decent Google ranking too, so it might be worth hitting their provider with a cease and desist.

    http vonagedlinkvta dot blogspot dot co dot nz/2005/10/unlocking-vonage-dlink-vta-vr-firmware dot html

  • Groove
    January 21st, 2013 on 4:27 am

    hrm – he’s even hotlinkig to some of my files. classy!

    thanks for letting me know

    Try this =)

Leave a Reply

Looking for something?

Use the form below to search the site:

Still not finding what you're looking for? Drop a comment on a post or contact us so we can take care of it!

Visit our friends!

A few highly recommended friends...

Archives

All entries, chronologically...