Unlock Your Vonage Cisco ATA 186
Unlock Your Vonage Cisco ATA 186
Like many of you I was stuck with several Vonage locked VOIP ATA's. I searched all over the internet but couldn't really find anything to help me unlock it. I read stories of Vonage unlocking these devices for $15 if you called them but that turns out to be a myth.
So, I continued to look for information. I found some good info at these sites.
Some were offering an unlock service for the Rev. A.0 ATA's . The Rev. A.0 ATA's and REV.B.0 ATA's are very similar in design and make up 99% of what Vonage distributed to its customers. All of the Software and user settings are stored on an SST 28SF040A SuperFlash EEPROM. It is a 512K PLCC32 Chip. In the Rev.A.0 units this chip is socketed so users can simply remove the chip from its socket and read the chip in an eprom reader to uncover the password. In the Rev. B.0 units Vonage had gotten wise to this technique and started mounting the chips directly on the board instead of using the socket.
You can identify your units Rev. by examining the label on the bottom of the unit. The Rev. info is found on the lower right of the unit.
On this page I will discuss the basics of hacking your ATA186 to retrieve your unlock password. Once you have this password you can unlock the device using the IVR interface. When the device is unlocked you are free to use your Cisco ATA186 with any voip provider or load any legal version of Cisco's ATA software on the device. I will not answer any questions about hacking or stealing Cisco's OS for these devices. The Vonage ATA's come with the SIP image preloaded and licensed for that device. If you want to change it that's your business.
Remove the 4 screws on the bottom of the unit and the plastic cover. Under the cover is a metal radio shield. Straighten the tabs and remove the top of the RF shield exposing the SST 28SF040A SuperFlash EEPROM.
Using Desoldering Braid and a soldering iron of 30w to 45W remove the excess solder from the pads around the base of the chip on all sides.
Removal of the SST 28SF040A SuperFlash EEPROM is the hardest part. Remove the sticker on top of the chip and place a dime on the chip. The dime has a copper core and will deflect and absorb some the the heat.
Using a Hot air device or small butane torch, heat the base of the chip moving the torch quickly around the base of the unit while GENTLY lifting the corner of the device. If you try and force it off you might lift the pads from the board and that would be very bad. If you don't move the torch quickly it will burn the chip or the PCB. Once you let the smoke out you can't put it back in!
When the chip lifts use some small pliers to remove the dime and place the chip on a damp paper towel and fold it over to cool the chip quickly.
Once the chip is out, clean the pads using a 15w soldering iron. Smooth the pads and clean impurities off. If a pad is too flat there is not enough solder on it and you should apply a TINY amount so the pad has a raised bump.
Once the pads are clean use your torch again and heat the pads for a second to melt them. When the melt they will become smooth and even. Afterwords Apply a small amount of flux to the pads and bottom of the socket.
Align the socket on the pads correctly and use your 15w iron to tack down 1-2 pins on each side of the socket to hold it in place. Use the 15w iron to solder each pin to its respective pad. This is important!!!!! If you don't get a good solder on every pin the device wont work.
Read the SST 28SF040A SuperFlash EEPROM in your eprom reader and view the dump of the chip in a binary editor such as Free Hex Editor .
You will find your 8 digit Unlock password around address x0003f970
Place the chip into the new socket on the ATA
- Power on the ATA, the Red Light should blink a few times. If it does your golden, If not check your soldering work.
- Hook up the ATA 186 device. Plug in the power and network connection.
- Plug in a telephone into the "PHONE 1" jack on the ATA 186.
- Pick up the receiver on the phone.
- Press the red Function light/button.
- You'll hear the IVR on the 186 ATA 186 via the handset on your phone.
- Dial # FACTRESET # (32273738)
- The IVR will prompt you for P-A-S-S-W-D
- Enter the 8 digit unlock code and press #
- Now the IVR will ask you to save, press *
- Hang up the phone while the ATA reboots
Congratulations, Your ATA is unlocked!
To access the web interface of the device you must determine the IP of the device using the IVR #23. The voice will tell you the ip. In your web browser go to http://(device's ip)/dev and it will prompt you for a login/password enter admin and blank password.
If you decide to do this, may the force be with you! I take no responsibility for you breaking your stuff.
Last Updated (Thursday, 22 July 2010 09:48)