[VoIP] more info on the VT1005

[Brandon Parsons]

After tinkering some more, I take back some of what I say about the
VT1005.  The settings I provide do 'stick', except for the new encryption
key.  I believe I now have a reliable recipe for hacking a vendor-locked
VT1005 reliably.  One nugget that may be useful to some of you is a
TERMINATE statement for dial plans.

----------------><---------- beginning of recipe
----------------><------------------

(1) if the VT1005 is vendor locked, it's likely that the Telnet port is not
open on either interface, so crack open the device (just a couple of screws
on the bottom), and remove the cover.  Using serial TTL connect to the
jumper on the board located opposite all of the plugs; it's 38.4 Kbps
8N1.  The 4 pins are (1 being nearest the LED, 4 being farthest):  1) +5V --
leave unconnected; 2) Gnd; 3) Tx -- from VT1005; 4) Rx -- to VT1005.  More
info can be found here:   http://www.0xdecafbad.com/node/16

(2) once you're in you can use a remote management function for setting the
sip tftp parameters (including the encryption key).  I've been asked not to
post the config file utility or documents--which contain the name and format
of the command--so just ask if you need them.  This is the point that had
tripped me up before and confused me regarding the stickiness of settings.
After modifying the encryption key to all zeros (no encryption), it will
load your TFTP file (when you reboot the device, and maybe when it times
out).  Those settings from teh TFTP file will stay in NVRAM (not sure if it
the device actually has to register for them to be committed), however I've
been unable to get the config file parameter that changes the encryption key
to work, so the next attempt to fetch the TFTP file will use the factory
programmed encryption key again.  The format for the config file parameter
'TeleSipRc4EncryptionKey' isn't specified, so I'm not sure if it's just
plain hex syntax, double quoted string of hex digits with leading 0x (or
without leading 0x), etc.  All I know is that it's 256 bits (64 hex
nibbles).

(3) using the config utility and sample config files (referenced in other
posts and in step (2)), create the TFTP binary, and load it.  Occasionally
it tries to reload the tftp file, but since I'm unable to get the encryption
permanently turned off it fails.  Doesn't matter because the settings are
stored in NVRAM, and if you enable it in the config file you'll have telnet
access on the WAN or LAN interface (or both) where you can manually disable
the encryption for another reload if necessary.

(4) Dial plan notes.  Instead of using a plain old DIGITMAP entry with a
static number of digits, you can specify variable length via a couple of
methods.  Standard DIGITMAP entry:
BTIOPT TeleSipDialPlanEntry[0]             = "DIGITMAP:1XXXXXXXXXX"  #
standard NA dial plan

You could also specify something like:
BTIOPT TeleSipDialPlanEntry[0]             = "DIGITMAP:011[2-9]X.T"  #
international calling NA style (T means timeout)

and an easy method is to use a dial terminator.  This is what I use to dial
any sipbroker based number from my sipphone account:
BTIOPT TeleSipDialPlanEntry[0]             = "TERMINATE:*XXXX.:#"
   broken down as follows:
    *XXX  --  specifier to access any of the sipbroker networks
    X.      -- 1-N digit extension at any of the sipbroker networks
    :       -- just a delimeter
    #       -- terminating character (either * or # )

so to hear the monkeys at the unfix network
(http://unfix.org/projects/voip/) I dial  *512 103#
or *011188888# for the sipbroker welcome call

----------------><---------- end of recipe
----------------><------------------

So that's all I know.  Many thanks to David Josephson.  When I'm done
tinkering with the device in the next couple of weeks, and get an SPA3102,
I'll send it to David.  If he doesn't want it, first person to ask can have
it, free of charge.  Still have to manually clear the encryption key each
time to load a tftp file, but telnet ports are now open on both LAN and WAN,
so it's not too much trouble.  If I can get the info on how to set
permanently (or semi-permanently) set the key to zero, it'll be that much
better.  I don't have any pulse-dial equipment, so this box is mostly a test
vehicle for different SIP services.  I really want that little box with 1
FXS and 1 FXO port.  It would be awesome to find a box with 1 FXO and 2 FXS
for $120 or less that's not more than 3 times the size of the VT1005.

brandon