Unlocking VOIP adapter VDV21

Use USB JTAG NT on VOIP device so we can unlock the device or configure the device.
Post Reply
auroden
Junior Member
Posts: 9
Joined: Tue Sep 18, 2012 10:26 pm
Location: Netherlands

Unlocking VOIP adapter VDV21

Post by auroden »

I was wondering what am I doing wrong when I try to connect my USBJTAG to this Vonage Router/Phone Adapter.
When I try to ID the flash the software reports: -detect/ IDCODE FFFFFFFF
Another detail is that DEBUG IS ON all the time. When I try to turn it off with F5 or g, it comes back ON right away.
Can someone verify if my cable is connected properly? I used the odd numbers of the wires to connect the points 1,3,5,7 and 9 on the board.
I connected only cable wire 2 to the ground point on the board, also marked with 2. The rest of the even numbers were all ground so I skipped those.
There were 3 missing jumper resistors which I bridged with wire since they are usually 0 Ohms.
I have included pictures of the connection including part of the JTAG adapter that shows where is the #1 wire from the cable.
The VOIP adapter is OK, connects to the internet fine and the USBJTAG is also connecting fine with other devices.
Hardware Version: 155
Software Version: 3.1.2-0.3.5
usbbdm
Junior Member
Posts: 8962
Joined: Mon Jul 18, 2005 9:33 pm

Post by usbbdm »

http://www.usbjtag.com/jtagnt/voip/vdv21.php
I remember there are some resistors missing. Check closely near the JTAG port, the resistors missing should be 0 ohms.
The pull up resistors are not important and JTAG will still work if those resistors are missing.
auroden
Junior Member
Posts: 9
Joined: Tue Sep 18, 2012 10:26 pm
Location: Netherlands

Post by auroden »

usbbdm wrote: I remember there are some resistors missing. Check closely near the JTAG port, the resistors missing should be 0 ohms.
The pull up resistors are not important and JTAG will still work if those resistors are missing.
Thanks for your reply. 4 resistors were missing next to the JTAG port. There was only one in place, R28 while R51,53,55,and 56 were missing.
I replaced them all with short piece of wire. Maybe I should have shorted R53 only. Could this be related to the firmware version? This one currently is 3.1.2-035.
Do you think I have done my wiring correctly? Do you know what would cause the interface to go to "DEBUG ON"? I pressed F5 and it switched to DEBUG OFF for a second and it came back to DEBUG ON again and again. It wouldn't stay OFF. Maybe this is telling you something. I got this DEBUG ON issue earlier on SB5101 when my connector was misaligned. Thanks again for your support..
usbbdm
Junior Member
Posts: 8962
Joined: Mon Jul 18, 2005 9:33 pm

Post by usbbdm »

auroden wrote:Thanks for your reply. 4 resistors were missing next to the JTAG port. There was only one in place, R28 while R51,53,55,and 56 were missing.
I replaced them all with short piece of wire. Maybe I should have shorted R53 only. Could this be related to the firmware version? This one currently is 3.1.2-035.
Do you think I have done my wiring correctly? Do you know what would cause the interface to go to "DEBUG ON"? I pressed F5 and it switched to DEBUG OFF for a second and it came back to DEBUG ON again and again. It wouldn't stay OFF. Maybe this is telling you something. I got this DEBUG ON issue earlier on SB5101 when my connector was misaligned. Thanks again for your support..
If you get all FFFFFFFF and get DEBUG ON then this means nothing. You should get proper CPU when missing resistors are placed.
auroden
Junior Member
Posts: 9
Joined: Tue Sep 18, 2012 10:26 pm
Location: Netherlands

Post by auroden »

usbbdm wrote:If you get all FFFFFFFF and get DEBUG ON then this means nothing. You should get proper CPU when missing resistors are placed.
Is my wiring correct? Did you look at the pictures of my connection. Maybe I don't have it done right. The serial console works fine and I got Teraterm to connect OK. But I wanted to replace the firmware with the USBJTAG-NT because I got stuck when the console came to that point. Thanks.
usbbdm
Junior Member
Posts: 8962
Joined: Mon Jul 18, 2005 9:33 pm

Post by usbbdm »

USB JTAG NT should work on the box just fine. However, I no longer have the unit and cannot give you any instruction.
merkin
Junior Member
Posts: 246
Joined: Thu Jun 28, 2007 8:49 pm

Post by merkin »

Looks like standard 14-pin EJTAG. As long as you line up pin1 on usbjtagnt with red wire you are good.

My locked voip devices were easily unlocked via IVR. No need to open up.

Check this if you havent already...
http://webcache.googleusercontent.com/s ... clnk&gl=us
auroden
Junior Member
Posts: 9
Joined: Tue Sep 18, 2012 10:26 pm
Location: Netherlands

Post by auroden »

merkin wrote:Looks like standard 14-pin EJTAG. As long as you line up pin1 on usbjtagnt with red wire you are good.

My locked voip devices were easily unlocked via IVR. No need to open up.
Thanks merkin, I appreciate your feedback. It looks like you are the right person to talk to about this stuff. The master is to busy preparing for the vacation, LOL.
First of all, how did you interact with this device without opening up.
I have used exactly the same website (the voipfan.net) to connect my serial console but I got stuck at the tftp server. Before that I tried to retrieve the password but it seemed that the firmware version was one of the latest that has random address for the password so I got wrong password. When I tried to downgrade I couldn't get the tftp server to transfer the file although it was trying to. Since I haven't investigated everything that could go wrong I will have to play a little bit more and will be back with results.
The JTAG connection would have saved some of the troubles regarding the password but unfortunately it wouldn't read the flash in my case. I have just shorted all 4 missing resistors and maybe that's the reason for the failure. I will put tomorrow 4k7 resistors instead to see if that'll help. If not I will have to try another VDV21. Maybe it's the unit. Thanks again for your input.
usbbdm
Junior Member
Posts: 8962
Joined: Mon Jul 18, 2005 9:33 pm

Post by usbbdm »

auroden wrote:Thanks merkin, I appreciate your feedback. It looks like you are the right person to talk to about this stuff. The master is to busy preparing for the vacation, LOL.
First of all, how did you interact with this device without opening up.
I have used exactly the same website (the voipfan.net) to connect my serial console but I got stuck at the tftp server. Before that I tried to retrieve the password but it seemed that the firmware version was one of the latest that has random address for the password so I got wrong password. When I tried to downgrade I couldn't get the tftp server to transfer the file although it was trying to. Since I haven't investigated everything that could go wrong I will have to play a little bit more and will be back with results.
The JTAG connection would have saved some of the troubles regarding the password but unfortunately it wouldn't read the flash in my case. I have just shorted all 4 missing resistors and maybe that's the reason for the failure. I will put tomorrow 4k7 resistors instead to see if that'll help. If not I will have to try another VDV21. Maybe it's the unit. Thanks again for your input.
You should NOT put all missing resistors. I think some of them are pull ups and can be missing. If you short it then you simply DISABLED the JTAG.
If I am right, there is only ONE resistors needs to put back.
auroden
Junior Member
Posts: 9
Joined: Tue Sep 18, 2012 10:26 pm
Location: Netherlands

Post by auroden »

usbbdm wrote:You should NOT put all missing resistors. I think some of them are pull ups and can be missing. If you short it then you simply DISABLED the JTAG.
If I am right, there is only ONE resistors needs to put back.
Yepp, shorting all resistors (except the built one) definitely disabled the JTAG.
I removed all of them except R53 (which is 0 ohms) and it did connect recognizing the CPU but not the flash type:

USB JTAG NT 0.57
Target: VDV21
-detect
IDCODE 0336817F
Broadcom BCM3368
IMPCODE 00800904
EJTAG V1, V2.0
DMA supoorted
Unknown flash type!
Report these values http://www.usbjtag.com/vbforum 0bf0,0170

-getram Boot
Time 00:00:00 (.282)
-getram 9f400000 800000
Time 00:00:34 (.344)
Do not forget to program the target
-program 9f400000 800000
Detect the flash type first!

I did put 4k7 resistors in the rest of the places but that did not change anything, the flash type was still unknown.
With this configuration, I was able to save a backup file but I couldn't write back using the DLL for the password. Any ideas?
merkin
Junior Member
Posts: 246
Joined: Thu Jun 28, 2007 8:49 pm

Post by merkin »

You cannot write to flash without first proper detect.

Config page says flash is 28f640 which is intel and uses 0x89 for CFI ID, which means perhaps the TVDV21.xml needs adjustment for a different flash window start. Maybe updated firmware caused this change.

Try this and post the output

Code: Select all

search 9f000000 A0000000 100000
usbbdm
Junior Member
Posts: 8962
Joined: Mon Jul 18, 2005 9:33 pm

Post by usbbdm »

auroden wrote:Yepp, shorting all resistors (except the built one) definitely disabled the JTAG.
I removed all of them except R53 (which is 0 ohms) and it did connect recognizing the CPU but not the flash type:

USB JTAG NT 0.57
Target: VDV21
-detect
IDCODE 0336817F
Broadcom BCM3368
IMPCODE 00800904
EJTAG V1, V2.0
DMA supoorted
Unknown flash type!
Report these values http://www.usbjtag.com/vbforum 0bf0,0170

-getram Boot
Time 00:00:00 (.282)
-getram 9f400000 800000
Time 00:00:34 (.344)
Do not forget to program the target
-program 9f400000 800000
Detect the flash type first!

I did put 4k7 resistors in the rest of the places but that did not change anything, the flash type was still unknown.
With this configuration, I was able to save a backup file but I couldn't write back using the DLL for the password. Any ideas?
This is much better.
I would try to enter DEBUG ON or TRAP ON and then detect the flash. Please wait me back to help you remotely.
merkin
Junior Member
Posts: 246
Joined: Thu Jun 28, 2007 8:49 pm

Post by merkin »

Well there you have it...flash starts at bf000000 which is different than the target xml. so try to detect flash at new location.
auroden
Junior Member
Posts: 9
Joined: Tue Sep 18, 2012 10:26 pm
Location: Netherlands

Post by auroden »

merkin wrote:Well there you have it...flash starts at bf000000 which is different than the target xml. so try to detect flash at new location.
Thanks for your input merkin
I replaced the XML file in the config directory and it's still an unknown flash type. The output looks like this:

======================
Copyright (C) 2010,2011,2012
USB JTAG NT 0.57
Target: VDV21
-detect
IDCODE 0336817F
Broadcom BCM3368
IMPCODE 00800904
EJTAG V1, V2.0
DMA supoorted
Unknown flash type!
Report these values http://www.usbjtag.com/vbforum 0000,0000
================================================

The values reported are different than before.
usbbdm
Junior Member
Posts: 8962
Joined: Mon Jul 18, 2005 9:33 pm

Post by usbbdm »

auroden wrote:Thanks for your input merkin
I replaced the XML file in the config directory and it's still an unknown flash type. The output looks like this:

======================
Copyright (C) 2010,2011,2012
USB JTAG NT 0.57
Target: VDV21
-detect
IDCODE 0336817F
Broadcom BCM3368
IMPCODE 00800904
EJTAG V1, V2.0
DMA supoorted
Unknown flash type!
Report these values http://www.usbjtag.com/vbforum 0000,0000
================================================

The values reported are different than before.
Try to get to TRAP ON first and then detect the flash. That should help a lot.
Post Reply

Who is online

Users browsing this forum: No registered users and 7 guests