I Ate Your Baby

Unlocking the Vonage DLINK VTA-VR firmware 1.00.09

So, Vonage charged me a $50 disconnection fee because apparently i was on a ‘2 year’ contract.

In return, i felt obligated to own their stupid little Vonage ATA and make it work with other SIP providers.

The model I had was the D-LINK VTA-VR. In theory it’s a 2-line ATA that has hardware very similar to the Linksys PAP2. Practically, it has some annoying quirks that make it, in my case, only work for one line – or in some other cases, completely useless.

Files/programs you’ll need:

CYT46 for unlocking
the Vonage VTA-11.4.0-r060331-1.00.07-r060418.img firmware.
toro’s 1.09 unlocked firmware
tftpd maybe

So, quick overview of what we’re gonna do. We’re gonna somehow gain access to the Admin or Support accounts, then we’re gonna downgrade the firmware to 1.00.07, then we’ll unlock it with CYT46. Then we’ll put an unlocked version of 1.00.09 (created by toro) on there and quickly configure it.

Now, my problem was mine had been used on Vonage for a while, and I couldn’t get into the Admin or Support accounts. If you google around, the passwords are usually blank, the same as the username, or ‘tivonpw’. None of that worked for me though. User/User only. OK, we’ll start from there then.

This article assumes a certain degree of understanding. Like, I’m going to assume you know the IP of your VTA-VR, and you can disable your internet connection on your own and maintain local network connectivity. In my case, I have DHCP giving out static IP’s on my network, and I can disconnect the PPPoE session on the router to kill the internet.

OK so here goes:

Pull up the web interface of your currently locked VTA-VR. In this guide, i’m gonna use 192.168.1.73 as my example, since that’s what mine was.  Try to login with username : Support and a blank password. This did not work for me. I had to login as user/user and then paste in the following link:

192.168.1.73/cgi-bin/webcm?getpage=/usr/www_safe/html/home/home_system.htm&var:OldProvisioned=on&=&var:OldUnProvisioned=on&=&var:isFirstTime=no

you may have to change the OldProvisioned option in there to ‘off’, but in my case, it came up properly. And by properly, I mean, i wanted to restore the Provisioned Parameters  and Non-Provisioned Parameters to default. Using that URL came up with both options checked. I was able to hit ‘factory reset’ now, and did so. After the VTA-VR rebooted, i was able to login successfully as ‘Support’ with no password.As ‘Support’ i now had the ‘firmware’ tab i need to downgrade to 1.00.07.

Now disconnect your internet, so that the device wouldn’t re-download its config from Vonage.

In the firmware tab, flash VTA-11.4.0-r060331-1.00.07-r060418.img . This is Vonage’s 1.00.07 firmware, which can be cracked using CYT46. Wait for the VTA-VR to reboot.

When the device comes back up, re-open the web interface, and login as user/user again.

Open up a CMD prompt and navigate to the folder you unzipped CYT46 to. Run “CYT46 DLINK” (without the quotes). The ‘DLINK’ option is important. Use option 3 to set your target IP to your VTA-VR’s. In my case, 192.168.1.73. Now hit option 1. Hit Enter to reset the Admin pw and set SIP defaults. It might take a minute or it might take 3 to 5, but it should succesfully crack the 1.00.07 firmware and give you access to the Admin account.

go back to your web interface window (should still be logged in as user/user). Log out, and log back in as Admin/Admin. If you can’t, try unplugging the VTA-VR for a full reboot. If Admin/Admin doesn’t work, try Admin and blank password.

Go to the ‘Tech Support’ tab and flash toro’s 1.00.09 NA unlocked firmware. When this completes, you should have toros firmware, fully unlocked with SIP defaults and full access to the Admin, Support and user accounts.

You can configure your VTA-VR from the web interface now.

A few notes about configuring the VTA now that it’s unlocked:

It sends the CALLERID field as the username, instead of the username. This screwed me up for wayyy too long. So make sure you set the CALLERID and USERNAME fields as the username you want to send to your SIP provider.

Another strange glitch is it seems to have trouble sending some characters in the username. Some people are saying it has trouble with some letters (e? and above?). Mine didn’t have this problem, but mine wouldn’t send an _ (underscore) in the username field. This meant that i had to use a fully numeric username with no special characters.

I also had trouble with the REG_EXPIRE_TIMER setting. I set it to 3600, thinking 60 seconds x 60 minutes for a 1 hr registration. But i found my device was re-registering every minute. I downloaded someone else’s config, and theirs was set to 60000. This still resulted in a 1 minute registration. I set mine to 6000000. This somehow made registrations 1 hour. Don’t ask me why.

The time on my device is still 4 hours ahead. I can’t figure out how to fix this. If someone knows, please help.

And the final annoyance, apparently if you use it for 2 lines, they both send the registrations at the same time on the same port, so its kinda random if both lines connect or not.  Or something like that. I dunno.

Now, you can configure it via the web interface, but you can also run TFTPD and provision it with an XML file. Basically you run tftpd, point it at the directory with the tiMAC.xml, and set the Provisioning Profile Base URL in the ‘Admin’ tab of your VTA-VR to tftp://yourpcip

If you google around you can find a few pre-configured xml example files and modify them – that’s what I did. You may alse want to set the Provisioning Profile Base URL in the ‘Admin’ tab to http://127.0.0.1 long term. Some people have reported their device re-locks to Vonage after a day or two if they don’t do this.

Some extra reading:
HydraGlass’s post on page 39 of this thread
CYT unlock thread
Jolpots guide to unlocking the VTA-VR
Toros thread releasing his 1.09 firmware

I didn’t proof-read this, so hopefully its right.