======UTStarcom F1000 / F1000G SIP Phone======
=====Description=====

The F1000 is a SIP protocol wifi phone manufactured by UTStarcom in 2005.
It supports Wireless B on F1000 and wireless B/G on F1000G.

=====Agere T8307 Data Sheet=====
Processor
https://www.tripleoxygen.net/wiki/_media/phone/t8307_v0.2_datasheet.pdf

LCD
https://www.tripleoxygen.net/wiki/_media/phone/gp-lcd-spec_kgm082b0_.pdf

=====Serial Interface=====
This device has a serial interface for communication with a PC.

**Be CAREFUL! This device uses 1.8V standard for TX/RX lines. Using 3.3 or more may damage your device.**

It is possible to access it by two means.

==== Recommended way ====

The USB port at the bottom isn't a normal USB port. Its pinout configuration is:

Vcc | On/Off with 100Ohms resistor | TX with 1k ohm series resistor | RX with 1k ohm series resistor | Ground
or simply;

Vcc | On/Off | TX | RX | GND


Note that it uses the additional unused 4th pin on the USB cable.

==== Second way (not recommended) ====

Open the device (which may crack the housing since it is difficult to open). Check the board for TX, RX and GND test points.


=====Firmware=====
====Vonage Unlock====

Previously, to do Vonage's unlock people were using the ATE menu to do a full reset. But this menu is not available in many devices. What we need to do is find the actual vonage's admin password to do a factory reset via web browser menu. And this is quite simple. You just need to open your device and hook it to a serial ttl cable. 115200bps speed with default serial settings.

"DONT TOUCH THE CIRCUITS ON THE DEVICE WHILE ITS TURNED ON. LEAVE THE DEVICE ON THE TABLE. TOUCHING THE CAPACITOR,RESISTORS ON THE BOARD CAN DAMAGE THE DEVICE!" It happened to me!

First, with your device plugged only to the battery, make it connect to your AP or Open AP if you dont know the user pass to add a new SSID with password.

After a successful connection, turn off the device and plug the serial cable to it. You just need to connect TX,RX and GND.

Open your serial terminal program and turn on the device. Wait it boot and connect to your AP. After some time it will give an error about cannot register if you dont have a vonage account anymore. Its ok.
Just give the device some time to load.

Then look at the serial output the device just printed on your screen. (if your terminal software create a .txt output file this step might be easier)

On this step you want to search for the following text:
<code>
httpInit: Upload RPM successfully initialized.
httpInit: System File Registry successfully initialized.
httpInit: System File Manager successfully initialized.
httpInit: File System RPM successfully initialized.
httpInit: RPM dispatcher successfully initialized.
httpInit: MIME type guessing RPM successfully initialized.
httpInit: HTTP server connected successfully to WindManage Backplane.
httpInit: Post RPM successfully initialized.
httpInit: http Password Checking successfully initialized.
httpInit: http Access Control successfully initialized.
httpPwdConfAdd OK YWRtaW46ODRKaTIzZGphVw==
httpPwdConfAdd OK dXNlcjo4ODg4ODg=
before taskSpawn sysPause
</code>
Take a closer look on this 2 lines:

httpPwdConfAdd OK YWRtaW46ODRKaTIzZGphVw==

httpPwdConfAdd OK dXNlcjo4ODg4ODg=

The chars after OK are the user and password encrypted with base64 for admin and user accounts.

Copy those strings to any base64 online decoder to get the admin password. Vonage's admin passwords are random number/letter strings.

Now it is only joy.

You can change the admin password to anything you want by accessing the webpage.

Now follow meisted_sd tutorial and after flashing a 4.50 version, do a factory reset via web menu using admin account.

PS. I do not recommend the 4.50 version. I prefer flashing 3.80 because you cannot downgrade it or maybe cannot return to vonage's firmware by rewriting the vonages tftp link.


===Meisted_sd flashing===

Unlocking the UTStarCom F1000
This unlocking guide was made in a large part
from the unlocking guide 'rkworth' posted here:
»www.vonage-forum.com/fto ··· 464.html
I've added a few comments, which are [in brackets]
and then taken the extra step to totally remove
vonage from the phone. Here is his guide, and then
mine follows at the end.

-------------------------


Password for firmware upgrade - utvonpw

then-

So I've managed to unlock the Vonage UT starcom F1000
wifi phone from Vonage. I think it's a first because
there's no other info on how to do this anywhere on the web.

You'll need a Windows pc for this...

The first thing to do is download the firmware from here:

File name is F1000_V3.80st.exe

just google for f1000 firmware.

Run this self extracting archive - it's German but no need
to worry - just accept the defaults.
It should unpack 4 files.

Next make sure your Vonage wifi phone is connected and registered
i.e. you can make a call. [Here, the phone never actually has to
connect to the internet. The password "utvonpw" is factory set
into the phone. You just need it connected on your wireless]

Scroll through the menus on your phone and choose Wi-Fi
Settings / Network Parameters / Network Info.

Take note of the IP address (you may not need this but it's
handy to have). Mine is 192.168.1.14.

Exit out of the Network Info menu and go to the Misc menu

Select Local TFTP Update.
At the Code prompt enter utvonpw
You'll see a message that says TFTP is a long process..

Select Update
The Screen will say Connecting...

Back to Windows PC and launch the fwupgrade.exe application

After a split second you should see a phone list that shows the
IP address we had earlier.

Click Update

You'll get a warning not to turn off either the Computer, Phone
or Access Point...don't turn them off!

Mine took about 45 seconds to push the firmware.

The screen on the phone will read Processing...

then Decompressing...

Windows will say that the task was complete...you can close the
updater by clicking Cancel

Phone is still Decompressing 3 minutes later...

Then it will switch off.

***DO NOT TURN IT BACK ON**** or your work will be undone by Vonage!

-------THIS STEP IS REALLY IMPORTANT-------

Disconnect your broadband. [You never actually had to have it connected]

Don't power it off, just disconnect either the phone cable if DSL or
the Coax if on cable. It's important that your wireless network stays up.

Check that you can no longer browse the internet on your windows pc.

Turn the F1000 on and it will connect to your wireless network.

It will try and register via your network but of course you are
disconnected so it can't - this is good!

Go to the Misc menu on the phone and select remote TFTP server - it
should have a Vonage server address in here...change it to a single
letter "a" (Or any other setting to remove the vonage URL)
[This step isn't really needed if you keep the unit off a
wireless connection and complete my steps at the end of
this part. I've also been told this doesn't always work
to keep the unit from getting provisioned again if it
gets a wireless connection.]

Turn the phone off

Reconnect your broadband and ensure you CAN browse to a
webpage or two.

Turn phone on and it will connect to your wireless network but
it will never Register as it can't find Vonage servers!

Usng a web browser open the IP address that we remember from earlier.
(This actually connects you to the phones internal web server)
Login as user with password 888888 (six 8's)

Click User Menu on the left and go immediately to SIP & RTP Config


=====Provisioning file=====
This device is capable of automatic provisioning of its settings via either TFTP or HTTP.
The server must provide the file with the following name: ut000000000000.ini where the zeroes should be changed to your device's mac address.

The full provision options and parameters is unknown. The list below was extracted from the device's firmware.
A # symbols means that line is commented. Remove to activate.
<code>
#Config protocol=tftp
#Vendor Name=
#Enterprise Code=
#Product ID=F1000
#Model Name=
#Time zone offset=-0
#Display Name=
#Autosan flag=1
#Auto scan interval=60
##User password=888888
#Administrator password=psw
#SIP terminal use outbound proxy=0
##SIP terminal use register=sipserver.com
#SIP proxy Domain Name=sipproxy.com
#SIP proxy IP address=0.0.0.0
#SIP proxy port=5060
#SIP register Domain Name=sip.register.com
#SIP register IP address=0.0.0.0
#SIP register port=5060
#SIP terminal user name=username
##SIP terminal pass word=password
#SIP terminal port=5060
#SIP terminal use Null packet=0
#SIP terminal use DNS=3
#DNS Query type=0
#Set Registration duration=60
#Terminal audio RTP port=10010
#Terminal audio Packetize time=20
#g711u=5
#g711a=4
#g729a=3
#g726=2
#DTMF transfer mode=0
#use STUN=0
#Stun server port=10000
#Stun server=stun.server.net

##NTP
#Enable NTP=
#NTP Server DNS flag=
#DST flag=0
#Primary NTP Server Domain name=ntp.nasa.gov
#Secondary NTP Server Domain name=
#Primary NTP Server IP=198.123.30.132
#Secondary NTP Server IP=
#NTP server port=123
#NTP synchronize Interval=36000

##SYS
#Syslog server Domain name=syslog.server.com
#Syslog server IP address=
#Syslog Server name Flag=
#Syslog Level=0
#level 0-3
#Syslog server port=514
#Syslog duration=20

##GENERAL
#Wifi parameters data structure Version=1.2
##IP
#DHCP work mode=
#Terminal IP Address=
#Terminal subnet mask=255.255.255.0
#Terminal Gatewate IP address=
#Primary DNS Server IP Address=
#Second DNS Server IP Address=
#DNS Server IP address source=

##CALL
#Set Call Transfer=
#Set Repeat Dial on busy flag=
#Set Reject Anonymous flag=
#Set Call Waiting flag=
#Set Caller ID block flag=
#3way flag=
#Incoming call timer=
#Outgoing call timer=
#Set Repeat Dial on busy interval=120
#Set Repeat Dial on busy counts=
#HTTP authentication website=www.baidu.com
#Sip authentication string=authstring

##CONFIGURATION
#TFTP Resync Period=300
#Upgrade Error retry delay=
#Configuration Server= FQDN
#Configuration Path=F1000/
#Current Config Filename=

##FIRMWARE
#Firmware Upgrade Server= FQDN
#Firmware Upgrade Path=
#Firmware File name=vxworks_romresident.bin.z
#Upgrade protocol=

##DEBUG
#dump flag=

##UNKNOWN
#Reserved Parameter
#Key
#Encrypt Key
#Factory reset password
#Silence timer=500
#Jitter buffer compensate size=30
#Mail access num=*86
#Mail box num=
#Mai box psw www.nat.server.com

#Reserved Codec
#Max Connections
#Max buffer size packets
#Max latency packets
#Max hold threshold %125
#Min buffer size packets
#Min stable events
#HWM grow rate %100
#HWM shrink rate %70

#Wifi work mode=
#AP1 PSKUTStarcomAP2 PSKAP3 PSKAP4 PSKwww.pppoeserver.comSSID1SSID2SSID3SSID4
#WEPKey11(5Btyes)WEPKey12(13Btyes)WEPKey21(5Btyes)WEPKey22(13Btyes)WEPKey31(5Btyes)WEPKey32(13Btyes)WEPKey41(5Btyes)WEPKey42(13Btyes)
#HWepkey select 00001111
#Manually config SIP timer=T1T24000T45000TimerB32000TimerFTimerHTimerDTimerJ
</code> 

========
This software can create provisioning files for F1000
https://www.tripleoxygen.net/wiki/_media/phone/provisioning_1_1_42_x86.zip
From: https://sourceforge.net/projects/provisioning/


More info:

[[http://web.quick.cz/lake/f1000_faq.htm|UTStarcom F1000 FAQ]]
[[https://www.dslreports.com/forum/r31016698-Definitive-Unlock-for-Vonage-F-1000-UTstarcom|DSL Reports Post]]

==== Acknowledgments ====

People involved in discussions, tips, or general chat. List in alphabetical order.

facsi, Steve Hiddenvision, Tripleoxygen