The F1000 is a SIP protocol wifi phone manufactured by UTStarcom in 2005. It supports Wireless B on F1000 and wireless B/G on F1000G.

Processor https://www.tripleoxygen.net/wiki/_media/phone/t8307_v0.2_datasheet.pdf

LCD https://www.tripleoxygen.net/wiki/_media/phone/gp-lcd-spec_kgm082b0_.pdf

This device has a serial interface for communication with a PC.

Be CAREFUL! This device uses 1.8V standard for TX/RX lines. Using 3.3 or more may damage your device.

It is possible to access it by two means.

The USB port at the bottom isn't a normal USB port. Its pinout configuration is:

Vcc | On/Off with 100Ohms resistor | TX with 1k ohm series resistor | RX with 1k ohm series resistor | Ground or simply;

Vcc | On/Off | TX | RX | GND

Note that it uses the additional unused 4th pin on the USB cable.

Open the device (which may crack the housing since it is difficult to open). Check the board for TX, RX and GND test points.

Previously, to do Vonage's unlock people were using the ATE menu to do a full reset. But this menu is not available in many devices. What we need to do is find the actual vonage's admin password to do a factory reset via web browser menu. And this is quite simple. You just need to open your device and hook it to a serial ttl cable. 115200bps speed with default serial settings.

“DONT TOUCH THE CIRCUITS ON THE DEVICE WHILE ITS TURNED ON. LEAVE THE DEVICE ON THE TABLE. TOUCHING THE CAPACITOR,RESISTORS ON THE BOARD CAN DAMAGE THE DEVICE!” It happened to me!

First, with your device plugged only to the battery, make it connect to your AP or Open AP if you dont know the user pass to add a new SSID with password.

After a successful connection, turn off the device and plug the serial cable to it. You just need to connect TX,RX and GND.

Open your serial terminal program and turn on the device. Wait it boot and connect to your AP. After some time it will give an error about cannot register if you dont have a vonage account anymore. Its ok. Just give the device some time to load.

Then look at the serial output the device just printed on your screen. (if your terminal software create a .txt output file this step might be easier)

On this step you want to search for the following text:

httpInit: Upload RPM successfully initialized.
httpInit: System File Registry successfully initialized.
httpInit: System File Manager successfully initialized.
httpInit: File System RPM successfully initialized.
httpInit: RPM dispatcher successfully initialized.
httpInit: MIME type guessing RPM successfully initialized.
httpInit: HTTP server connected successfully to WindManage Backplane.
httpInit: Post RPM successfully initialized.
httpInit: http Password Checking successfully initialized.
httpInit: http Access Control successfully initialized.
httpPwdConfAdd OK YWRtaW46ODRKaTIzZGphVw==
httpPwdConfAdd OK dXNlcjo4ODg4ODg=
before taskSpawn sysPause

Take a closer look on this 2 lines:

httpPwdConfAdd OK YWRtaW46ODRKaTIzZGphVw==

httpPwdConfAdd OK dXNlcjo4ODg4ODg=

The chars after OK are the user and password encrypted with base64 for admin and user accounts.

Copy those strings to any base64 online decoder to get the admin password. Vonage's admin passwords are random number/letter strings.

Now it is only joy.

You can change the admin password to anything you want by accessing the webpage.

Now follow meisted_sd tutorial and after flashing a 4.50 version, do a factory reset via web menu using admin account.

PS. I do not recommend the 4.50 version. I prefer flashing 3.80 because you cannot downgrade it or maybe cannot return to vonage's firmware by rewriting the vonages tftp link.

Unlocking the UTStarCom F1000 This unlocking guide was made in a large part from the unlocking guide 'rkworth' posted here: »www.vonage-forum.com/fto ··· 464.html I've added a few comments, which are [in brackets] and then taken the extra step to totally remove vonage from the phone. Here is his guide, and then mine follows at the end.

Password for firmware upgrade - utvonpw

then-

So I've managed to unlock the Vonage UT starcom F1000 wifi phone from Vonage. I think it's a first because there's no other info on how to do this anywhere on the web.

You'll need a Windows pc for this…

The first thing to do is download the firmware from here:

File name is F1000_V3.80st.exe

just google for f1000 firmware.

Run this self extracting archive - it's German but no need to worry - just accept the defaults. It should unpack 4 files.

Next make sure your Vonage wifi phone is connected and registered i.e. you can make a call. [Here, the phone never actually has to connect to the internet. The password “utvonpw” is factory set into the phone. You just need it connected on your wireless]

Scroll through the menus on your phone and choose Wi-Fi Settings / Network Parameters / Network Info.

Take note of the IP address (you may not need this but it's handy to have). Mine is 192.168.1.14.

Exit out of the Network Info menu and go to the Misc menu

Select Local TFTP Update. At the Code prompt enter utvonpw You'll see a message that says TFTP is a long process..

Select Update The Screen will say Connecting…

Back to Windows PC and launch the fwupgrade.exe application

After a split second you should see a phone list that shows the IP address we had earlier.

Click Update

You'll get a warning not to turn off either the Computer, Phone or Access Point…don't turn them off!

Mine took about 45 seconds to push the firmware.

The screen on the phone will read Processing…

then Decompressing…

Windows will say that the task was complete…you can close the updater by clicking Cancel

Phone is still Decompressing 3 minutes later…

Then it will switch off.

*DO NOT TURN IT BACK ON** or your work will be undone by Vonage!

——-THIS STEP IS REALLY IMPORTANT——-

Disconnect your broadband. [You never actually had to have it connected]

Don't power it off, just disconnect either the phone cable if DSL or the Coax if on cable. It's important that your wireless network stays up.

Check that you can no longer browse the internet on your windows pc.

Turn the F1000 on and it will connect to your wireless network.

It will try and register via your network but of course you are disconnected so it can't - this is good!

Go to the Misc menu on the phone and select remote TFTP server - it should have a Vonage server address in here…change it to a single letter “a” (Or any other setting to remove the vonage URL) [This step isn't really needed if you keep the unit off a wireless connection and complete my steps at the end of this part. I've also been told this doesn't always work to keep the unit from getting provisioned again if it gets a wireless connection.]

Turn the phone off

Reconnect your broadband and ensure you CAN browse to a webpage or two.

Turn phone on and it will connect to your wireless network but it will never Register as it can't find Vonage servers!

Usng a web browser open the IP address that we remember from earlier. (This actually connects you to the phones internal web server) Login as user with password 888888 (six 8's)

Click User Menu on the left and go immediately to SIP & RTP Config

This device is capable of automatic provisioning of its settings via either TFTP or HTTP. The server must provide the file with the following name: ut000000000000.ini where the zeroes should be changed to your device's mac address.

The full provision options and parameters is unknown. The list below was extracted from the device's firmware. A # symbols means that line is commented. Remove to activate.

#Config protocol=tftp
#Vendor Name=
#Enterprise Code=
#Product ID=F1000
#Model Name=
#Time zone offset=-0
#Display Name=
#Autosan flag=1
#Auto scan interval=60
##User password=888888
#Administrator password=psw
#SIP terminal use outbound proxy=0
##SIP terminal use register=sipserver.com
#SIP proxy Domain Name=sipproxy.com
#SIP proxy IP address=0.0.0.0
#SIP proxy port=5060
#SIP register Domain Name=sip.register.com
#SIP register IP address=0.0.0.0
#SIP register port=5060
#SIP terminal user name=username
##SIP terminal pass word=password
#SIP terminal port=5060
#SIP terminal use Null packet=0
#SIP terminal use DNS=3
#DNS Query type=0
#Set Registration duration=60
#Terminal audio RTP port=10010
#Terminal audio Packetize time=20
#g711u=5
#g711a=4
#g729a=3
#g726=2
#DTMF transfer mode=0
#use STUN=0
#Stun server port=10000
#Stun server=stun.server.net

##NTP
#Enable NTP=
#NTP Server DNS flag=
#DST flag=0
#Primary NTP Server Domain name=ntp.nasa.gov
#Secondary NTP Server Domain name=
#Primary NTP Server IP=198.123.30.132
#Secondary NTP Server IP=
#NTP server port=123
#NTP synchronize Interval=36000

##SYS
#Syslog server Domain name=syslog.server.com
#Syslog server IP address=
#Syslog Server name Flag=
#Syslog Level=0
#level 0-3
#Syslog server port=514
#Syslog duration=20

##GENERAL
#Wifi parameters data structure Version=1.2
##IP
#DHCP work mode=
#Terminal IP Address=
#Terminal subnet mask=255.255.255.0
#Terminal Gatewate IP address=
#Primary DNS Server IP Address=
#Second DNS Server IP Address=
#DNS Server IP address source=

##CALL
#Set Call Transfer=
#Set Repeat Dial on busy flag=
#Set Reject Anonymous flag=
#Set Call Waiting flag=
#Set Caller ID block flag=
#3way flag=
#Incoming call timer=
#Outgoing call timer=
#Set Repeat Dial on busy interval=120
#Set Repeat Dial on busy counts=
#HTTP authentication website=www.baidu.com
#Sip authentication string=authstring

##CONFIGURATION
#TFTP Resync Period=300
#Upgrade Error retry delay=
#Configuration Server= FQDN
#Configuration Path=F1000/
#Current Config Filename=

##FIRMWARE
#Firmware Upgrade Server= FQDN
#Firmware Upgrade Path=
#Firmware File name=vxworks_romresident.bin.z
#Upgrade protocol=

##DEBUG
#dump flag=

##UNKNOWN
#Reserved Parameter
#Key
#Encrypt Key
#Factory reset password
#Silence timer=500
#Jitter buffer compensate size=30
#Mail access num=*86
#Mail box num=
#Mai box psw www.nat.server.com

#Reserved Codec
#Max Connections
#Max buffer size packets
#Max latency packets
#Max hold threshold %125
#Min buffer size packets
#Min stable events
#HWM grow rate %100
#HWM shrink rate %70

#Wifi work mode=
#AP1 PSKUTStarcomAP2 PSKAP3 PSKAP4 PSKwww.pppoeserver.comSSID1SSID2SSID3SSID4
#WEPKey11(5Btyes)WEPKey12(13Btyes)WEPKey21(5Btyes)WEPKey22(13Btyes)WEPKey31(5Btyes)WEPKey32(13Btyes)WEPKey41(5Btyes)WEPKey42(13Btyes)
#HWepkey select 00001111
#Manually config SIP timer=T1T24000T45000TimerB32000TimerFTimerHTimerDTimerJ

This software can create provisioning files for F1000 https://www.tripleoxygen.net/wiki/_media/phone/provisioning_1_1_42_x86.zip From: https://sourceforge.net/projects/provisioning/

More info:

UTStarcom F1000 FAQ DSL Reports Post

People involved in discussions, tips, or general chat. List in alphabetical order.

facsi, Steve Hiddenvision, Tripleoxygen