So I want to add the ability to configure these devices for GV using oauth without obitalk, similar to the changes for the obi100 (and add an ssh server, for grins).

I think I have the MD5s in the firmware file worked out (its the same "Goodbye! Reboot Now" garbage as the 100), and I see where the oauth refresh token code is, so it should be pretty straightforward unless there is code signing that I missed.

The only hiccup is... I don't actually have an OBi20x :-(

Anyone have one of these devices that wants to be a guinea pig? You should definitely have a way to SPI the flash back *when* i brick the thing the first couple tries...

[or if someone has one sitting in the closet, you could just send it to me. ill name the fw after you ]

EDIT: speaking of flash, its supposed to have a w25x128 on board, but is it the SOIC package or some BGA madness?

QUICK SUMMARY:
Custom firmware made for all obi devices, thanks to the help of generous hardware donations and bold testers.
See obifirmware.com to download latest.

PM sent.

I can help testing the modded FW.

ok great.

did i also get the impression from the other thread that you also had changes to obiapp? it should be a lot easier since we can run a debugger on the box »randywestergren.com/reve ··· -part-3/

I'd be very curious to know if it's possible to mod the firmware so that Google Voice will run on a 300/302.

Ya, moving the function to make more space is a little harder on this ARM code cause all the offsets are relative to the PC. Looks like maybe a dozen to change, between the function calls and the constants...

... and then there's the ELF wrapping...hmmm... maybe it should be easier to just overwrite it in place (hard to do it conditionally then)

Turns out to be a w25q128bvieg, a WSON package, whatever the fuck that is.

That was a new one for me too. Looks like a bitch to solder them.

ya, but pin spacing is still 0.05", so it might still work if anyone had one of them fancy SOIC clips

on the other hand, u-boot over serial should help, if i could figure out how to use sf or md successfully...

fuck it. ill just be confident and web-gui flash the thing without a backup:

As I remember there was a way to boot it into a recovery mode with it's own kernel and rootfs. You should be able to flash any FW version in that mode. In FW 4330 there were /obi/recovery utility that activated recovery mode after device reboot. Here is the code that it were executing:

  puts("Prepare to enter recovery mode: ");
  FLASHSPI_clear(0xC00000, 0x10000);
  puts("This unit will enter recovery mode after power cylce"); 
 

ya, im just worried that ill fuck up the recovery ones too

apparantely the recovery is the partition that i originally overwrote, cause it only has uclibc. when i booted and didnt see my changes i had to switch to the other squashfs that had a rootfs, and it apparantely has real glibc so now i have to rebuild all the tools i was going to sneak on...

ETA: i did atleast turn telnetd on

shouldnt i be able to backup this thing from userspace? anyone understand the /dev/mtd* stuff?

i have dev devices: mtd[0-8], mtd[0-8]ro, mtdblock[0-8], mtdchar[0-7]...

# cat /proc/mtd
dev: size erasesize name
mtd0: 00800000 00001000 "mtd-ram fs ro"
mtd1: 00800000 00001000 "mtd-ram"
mtd2: 00050000 00010000 "u-boot"
mtd3: 00280000 00010000 "kernel"
mtd4: 000c0000 00010000 "scratch"
mtd5: 006c0000 00010000 "rootfs"
mtd6: 01000000 00010000 "flash0"
mtd7: 00240000 00010000 "obi app"
mtd8: 00100000 00010000 "bluetooth"

i just wanna dump the whole goddamn thing

If you have mtd_utils cross compiled for the platform than you should be able do dump mtd6 which is mapped to the whole flash.

oh, ha. totally missed mtd6. poor reading comprehension i guess.

cant i just cat /dev/mtd6 > somefile.bin ?

i'm not sure about mtd6, but it should work with mtdchar6.

# /lib/libc.so.6
GNU C Library stable release version 2.5, by Roland McGrath et al.
Copyright (C) 2006 Free Software Foundation, Inc.
This is free software; see the source for copying conditions.
There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A
PARTICULAR PURPOSE.
Compiled by GNU CC version 4.2.1.
Compiled on a Linux >>2.6.20-16-generic<< system on 2007-09-27.
Available extensions:
        crypt add-on version 2.1 by Michael Glad and others
        GNU Libidn by Simon Josefsson
        GNU libio by Per Bothner
        NIS(YP)/NIS+ NSS modules 0.19 by Thorsten Kukuk
        Native POSIX Threads Library by Ulrich Drepper et al
        Support for some architectures added on, not maintained in glibc core.
        BIND-8.2.3-T5B
Thread-local storage support included.
For bug reporting instructions, please see:
<http://www.gnu.org/software/libc/bugs.html>.
 

anybody got an easy way to build a arm toolchain with glibc 2.5? crostools-ng-1.23.0 in obsolete mode only goes back to 2.12.1 :-(

As I remember I built gcc 4.9.1 with libc-2.18 for this platform. I was able to rebuild mtd-tools and run.

Not sure if I run in chroot though. It was about 3 years ago. Still should have this toolchain somewhere.

quick update: i got a crosscompiling toolchain setup for the old-as-fuck glibc/kernel, and i got dropbear compiled and running on the box... just gotta figure out how to set a root password and package up a fw with it...

heres a problem: i dont really want to leave dropbear open to the outside world with a hardcoded root password. and i cant change the password from whatever i initially flash because its mounted readonly.

ideas?
limit to LAN side (assuming someone out there is smart enough with iptables to do this)?
some /etc over-mount foolishness?
something obvious and easier that im missing?
fuck anyone who doesn't firewall their obi in the first place?

You can do over-mount for a single file:

 mount --bind /else/where/passwd /etc/passwd 
 

nice. i guess itd be nice to have a 'passwd'-like script to encrypt a password and shove the passwd in for root in the /else/where/passwd overlay.

ETA: atleast then there would be a chance in hell that anyone might actually change it...

and by script i mean ill just compile busybox's passwd after changing the file location...

bsdiff for OBi202-3-2-1-5757EX.fw

modifications:
1) add dropbear ssh server. default root passwd = "obi". (hint: login and change it asap)

Nice. Does that mean we can now change oauth2 credentials directly through ssh?

Not yet.

Since I don't see any tools that can increase the size of ELF sections (anyone?), I probably just gotta find some unused/unimportant space to stick some strings. That might make room to do an AuthPassword switch and still have the obitalk client/secret as a fallback all within the same amount of code space.

Any chance for this?

@naf Thanks for all your hard work!

bsdiff for OBi202-3-2-1-5757EX.fw

modifications:
1) add dropbear ssh server. default root passwd = "obi". [now started by custom startup script in /scratch/etc/rc.custom, change as you please]
2) patch obiapp to use oauth token request override, for provisioning GV without obitalk. Uses same AuthPassword format and provisioning xml as the obi1xx-naf7, like »obi1.s3-website.us-east- ··· /OAuth2/

Great.

I made the firmware file, but I don't have an OBI2 to test with. Like someone to test it please before I put it on the website, or maybe confirm the checksum is right.

»obi1.s3-website.us-east- ··· est.html

I also updated »obi1.s3-website.us-east- ··· TALK.xml which should be ok with all devices.

md5 is good (d18637277c17bd6d3b5b9176b12781ee)

but the xml appears to be having trouble counting to 4

omg. Ok, it's fixed now.

rebase to OBi202-3-2-1-5794EX.fw. otherwise, no changes from previous.

$ md5sum OBi202-3-2-1-5794EX-arrynrob3.fw
bc7aa0cc11e239137f672294a1833340

There is a problem with the unmodified 5794 fw.
»www.obitalk.com/forum/in ··· =13489.0

Need a tester with a 30x...

I've got a 302, will need to do the work after hours or on weekends though as it's in use at the office. Let me know what specifically I should do.

ok cool. now ive never seen a 30x, so i have no idea what "not supporting" GV means, so lets start off with some basics:
do 30x's have the web gui enabled? (i did say basic, right?)
is GoogleVoice in the ITSP Profile x's SignalProtocol dropdown?
if not, can you just ITSP provision it to be there?

example provisioning xml for ITSP Profile A:

<?xml version="1.0" encoding="UTF-8"?>
<ParameterList>
  <Object>
    <Name>VoiceService.1.VoiceProfile.1.</Name>
    <ParameterValueStruct>
      <Name>SignalingProtocol</Name>
      <Value>Google Voice</Value>
    </ParameterValueStruct>
  </Object>
</ParameterList>
 

is the status "Service not configured" or something else?
If "service not configured", can you configure it by using the super-secret oauth oauth token xml (»fw.obifirmware.com/Enabl ··· LK.xml)?

if all that is true, then just using the AuthPassword oauth override patched firmware would already work. if not, its back to IDA...

1) Yes the internal web GUI is enabled.

2) Yes, GoogleVoice appears in the dropdown.

3) Used the AuthPassword oauth override, got Service Not Configured.

4) Provisioned using the XML, and voila! SP3 is Connected to Google Voice!

I need to go to the office to actually make a call, but everything appears to be working. That was easier than I thought!

So it seems like the OBi302's limitation is not that it can't be used with Google Voice, but it can't be added to OBiTALK...I assume. I haven't tried that yet either.

TODO when I get physical access:

1) Verify calls via Google Voice work. (Edit: confirmed working.)

2) Find out what happens when you try to add a 302 to OBiTALK. (Edit: "Failed to add device: This device is customized for another service provider and cannot be added to your account."). I don't have a generic 302 to test with but I assume the response would be similar.

3) ???

ya thats the step im on too

Step 4=Profit!

(Ref: South Park, season 2, episode 17)

so thats a yes. guess we need a pretty website now ;-)

ETA: oh, i spoke too soon:

Domain Name: obifirmware.com
Creation Date: 2018-01-24T23:36:35.000Z
 

P.S. hehe, dont forget to link to the dropbear license »secure.ucc.asn.au/hg/dro ··· /LICENSE

my SIP provider (callcentric) works fine on 5794. much ado about nothing?

I believe the issue is specifically related to the use of IP phones configured to register to an OBi ATA, effectively using the OBi as a PBX.

ah, yes. poor reading comprehension again on my part.

Good day.

I don't use any of my three OBi200s for Google Voice, but, having started hacking (not cracking) in the eighties, I couldn't resist the tentation and updated one of them with the new FW.

It rebooted fine and I was able to login with ssh as I do with any other Linux box. As suggested, I changed root's password right away.

Tried to mount "/" and "/root" locally with sshfs, no joy.

Nosing around "/var/log/messages," noticed the following dropbear error messages:

# grep lastlog /var/log/messages
Jan 27 08:38:31 OBi202 authpriv.warn dropbear[985]: lastlog_perform_login: Couldn't stat /var/log/lastlog: No such file or directory
Jan 27 08:38:31 OBi202 authpriv.warn dropbear[985]: lastlog_openseek: /var/log/lastlog is not a file or directory!
Jan 27 08:39:33 OBi202 authpriv.warn dropbear[1016]: lastlog_perform_login: Couldn't stat /var/log/lastlog: No such file or directory
Jan 27 08:39:33 OBi202 authpriv.warn dropbear[1016]: lastlog_openseek: /var/log/lastlog is not a file or directory!
Jan 27 08:46:16 OBi202 authpriv.warn dropbear[1187]: lastlog_perform_login: Couldn't stat /var/log/lastlog: No such file or directory
Jan 27 08:46:16 OBi202 authpriv.warn dropbear[1187]: lastlog_openseek: /var/log/lastlog is not a file or directory!
#
 

Since they are only warnings, I assume they are harmless and nothing to worry about.

Thank you naf and others who helped for the updated firmware -- great work.

Any version for obi200?

Obi 200 and 202 use the same firmware. Look at the title of this thread.....

O.K. Thanks.

@Naf,

Great job on the firmware! Finally got around to testing it on my 202 model. Restored a backup then filled in the gv credentials. Nice to be able to swap gv accounts by just changing two lines.

Given the cryptic nature of the credentials line, I copied it into an unused text field under Service Providers/ITSP Profile (x)/General/{URL}. Saves a step in having to hunt through my notes for the correct entry.

I used the same client_id and secret for generating refresh tokens for the different accounts. Just the email addr and refresh token portion need to be changed when switching between accounts.

@OBi1FW Thanks for setting up the site. Should make it much easier for those not familiar with oauth in generating the needed keys.

Now that root access is available, any thoughts on where the settings changed in the webui are stored?

Settings are in OBI_PARAM_PT sections.
On the 20x, thats at offsets 0x00400000, 0x00420000, and 0x00460000 of the flash (mtd6).
Each individual setting is stored in a 256 byte chunk: 16 byte header + encrypted payload.
RC4 key is a mangled version of the first 15 bytes of the header. Something like adding 2 to the first word I think. Very tricky. Keeps all the boogie men out.

Ha! Wishful thinking for finding a database file with all the entries.

My OBi200 has CallWithUs, CallCentric, Localphone and Google Voice/Simon GV Gateway, all as SIP.
They all work fine. Fw 5794EX.

If I recall, the issue is having a sip device (client) connect to the obi. In your case, the obi box is the client itself.

Ya, I looked at the assembly of 5794 in the "receive a SIP connection" section and theres clearly logic to conditionally add a second nonce after adding the first to the header (this guy noticed it first »www.obitalk.com/forum/in ··· msg86872). It definitely doesn't look right, even in assembly...

Why do Obihai on their website link to fw 5757EX when the most up-to-date is 5794EX?

The "most up to date" is getting harder to discern.

Obihai has firmware configuration management issues, getting worse now that their customer's are distributing hacked firmware to compensate. Maybe Polycom will clean this up, starting by moving firmware management off their user forum and on to a proper product support page.

OE

^^How are obi's firmware issues exacerbated by third party firmware mods?

Probably important to note, most up to date is not necessarily the best firmware to use. Personally, if it's not broke don't fix it. I don't touch firmware updates unless I'm having issues or the update introduces features I want. Not to mention Obi is rather poor at documenting what changes are in the updates.

Obihai uses its product firmware to integrate and differentiate and market and support its product/service ecosystem. One off third party hacked (not developed) firmware that removes the customer and the product from this ecosystem, defeats various Obihai's goals for this ecosystem and will most likely complicate hacked device maintenance for those customers.

On the other hand, I could be wrong... a proliferation of third party firmware that unravels Obihai's business constructs could be the answer to their prayers.

OE

I don't know if I agree with your assessment. Consider various consumer grade routers which have third party firmware support (ddwrt, tomato, asus-merlin). I don't think router sales have diminished because of this. In fact, probably increased because these firmwares offer addtional functionality above and beyond what comes stock. In fact, I can't remember the last router I used which didn't get a third party firmware from day 1.

This may reduce said company's enterprise product sales but then again, few consumers need actual enterprise grade equipment for their home (small office?) use.

I have a 202 with the modded firmware. It has met my needs quite well - primarily to eliminate obitalk portal when provisioning a gv profile. I'm quite comfortable with this. For the more basic user (such as those with outdated 1xx units who are at a loss), there is sufficient documentation, other third party options (simonics gateway) or they can buy a new unit..... The obi200 appears to be in stock at the moment while the 202 is out of stock (amazon, newegg), or sold at inflated prices.

So i'd say obi's issues are of their own making. They could have just as easily offered an updated firmware for the 1xx units as the change google made is relatively minor. I can understand their position if the entire google voice platform changed requiring a significant firmware rewrite. But a cert change should be nonissue. The unit should be able to self update certs as they changed.

I'd say the obi10x firmware mod was pretty fucking customer focused.

Obihai always had (and still has) the option to meet its goals in ways that do NOT involve irritating its customers into buying their products. Instead, they've chosen the marketing-by-annoyance strategy which might be semi-successful short term, but creates near-zero brand loyalty. If that's their goal, I'll lose no sleep over playing a small part in helping defeat it. My 110 and 302 have been running completely trouble-free since day 1. Any good VoIP phone/ATA requires no maintenance.

I was suggesting that hacked firmware makes matters worse for Obihai.

I'm not defending Obihai.

OE

I bought a used Obi302 for a good price. I then followed these steps:

Check current firmware version 4747 (or similar).
Flash arrynrob3 firmware. Checksum error.
Flash stock 5757 firmware. Worked.
Flash arrynrob3 firmware. Worked.
Setup ITSP provisioning as described on the ObiFirmware.com/OAuth2 site and reboot.

Then I did the Google Developer steps and everything went well until the last page (of ObiFirmware):
There was no SignallingProtocol that I could find (to insert "Google Voice").
I could not copy and paste the AuthPassword (it is grayed out) and I could not type it in because the GUI doesn't let you see what your typing, just dots (........) and I would surely make a mistake. It needs to be a copy and paste deal.

So, I failed the idiot test. How should I proceed?

^^Did you perform the steps in this post?

»Re: Obihai OBi200/202 firmware mod

You'll also need to uncheck default box to be able to make edits to the respective fields.

naf asked: Is GoogleVoice in the ITSP Profile x's SignalProtocol dropdown?
I don't see "SignalProtocol". Is it in the General params?
The only dropdown in the General parameters is DTMFMethod: Auto

Clearly this is where the failure occurred. I'll try again.

naf asked: Is the status "Service not configured" or something else?
All 4 are "Service not configured".

What is the name of the setting directly above DTMFMethod?

Well, that is disappointing.

Can you please try the following and we'll see if there is any change:

1. Navigate to System Management >> Auto Provisioning.

2. From within ITSP Provisioning, set the following:

Method: System Start
ConfigURL: »toao.net/pub/signallingp ··· ocol.xml

Save and reboot. The device should reboot twice.

Now try to paste your username/password under Voice Services >> SP1 Service (don't use another SP for this test). Don't forget to uncheck the Default checkbox first. Save, reboot, and let us know if the status changes.

The param above DTMFMethod is "Name" and it is blank.

Sounds like the device was previously provisioned with SignalingProtocol set to access="no-access". To fix, just reset the configuration to factory settings, either from the web gui at System Manamement > Device Update (if device wasn't provisioned to disable that) or failing that using the physical reset button. After reset, you should now actually see SignalingProtocol above DTMFMethod.

You'll have to put in the provisioning from obifirmware again afterwards.

I tried the new XML, still no SignalingProtocol. I entered my gmail and password in SP1, still no SignalingProtocol and service status is "Service not configured".

I then tried the new XML again but, still the same.

It seems like the XML step is where it fails because from what I understand the purpose of it is to add the new param "SignalingProtocol". Is that right?

I have tried the reset from within the GUI. I don't see a physical reset button, is it inside?

It'll be interesting if Mr. Previous ITSP provisioned your box to block resetting. According to the guide:


Warning: It should be noted that the parameters ProtectFactoryReset and FactoryResetMode may be changed via provisioning only. The service provider must take extreme care before setting up these protections because that will limit the reset operation when user presses the hard reset button on the unit and may not recover the unit to factory default condition.


We could always clear the config directly in flash, in theory.

Yes, accessible with a paperclip from a hole on the bottom of the device. Procedure here: »www.obitalk.com/info/faq ··· ry-Reset

FYI, you got SignalingProfile in the wrong spot. Its a ITSP profile setting, not a voice service setting. (no "line.1." for its object)

I followed the link and it reset exactly as described.

I then tried the tao.net...xml for "startup". It boot twice but still no SignalingProtocol.

@Naf, given this is a 302 unit, is it possible this setting is set correctly through the xml, but doesn't appear in the webui?

wait, you're logging in to the web gui as admin, not user, correct? There's no way to ban *admin* from seeing settings that I know of. WTF...

Even without the web gui, Mango's method might still work if using corrected XML:

<?xml version="1.0" encoding="UTF-8"?>
<!--OBi Configuration File-->
<ParameterList>
  <Object>
    <Name>VoiceService.1.VoiceProfile.1.</Name>
    <ParameterValueStruct>
      <Name>SignalingProtocol</Name>
      <Value>Google Voice</Value>
    </ParameterValueStruct>
  </Object>
  <Object>
    <Name>VoiceService.1.VoiceProfile.1.Line.1.</Name>
    <ParameterValueStruct>
      <Name>X_GApiRefreshToken</Name>
      <Value>blam</Value>
    </ParameterValueStruct>
    <ParameterValueStruct>
      <Name>X_GApiInitAccessToken</Name>
      <Value>blorg</Value>
    </ParameterValueStruct>
  </Object>
</ParameterList>
 

I'm thinking 'same firmware --> same webgui'. I sure didn't see any switches in the assembly [could have missed it though]. And the whole UserAccess hiding shouldn't affect admins, which he has to be to even see anything near that setting. I would ask him to just ssh in and cat /obi/webfile/VS_1_VP_1_.xml, but I *know* whats in that cause its part of the firmware... But anyway it probably isn't set yet just because of the typo in mango's xml

Which error?

"VoiceService.1.VoiceProfile.1.Line.1."

Ya. Should look like mine above.

I'm logging into the gui using 192.168.1.3 in Firefox. Then admin and admin. Is there another way?

Can someone put your new xml on a host for me to use? I've never done it any other way.

You can use tftp with this too.

Tftpd64 works really well.

»tftpd32.jounin.net/tftpd ··· oad.html

For the config url you'd put something like

tftp://192.168.1.123/file.xml

You'd put file.xml in the same folder as you run tftpd from.

You can also setup your own http server.
»Re: ObiHAI Obi100/Obi110 Firmware Mod Discussion

I tried that just now and have these questions:

The address it shows when you hover over the files in Mongoose, is that the address I should use in the ConfigURL? It shows 192.168.10.100. That's what I tried and it did not boot twice (just once) so it probably did not find the host.

I'm sorry I wasn't clear. You need to use the IP address of the computer running Mongoose.

I'll try the tftp soon for my own education but I'm convinced the problem is not with the XML now because I have also used the one on the ObiFirmware.com site multiple times with the same result each time: boots twice but no SignalingProtocol. I tried downgrading the firmware and this happened:

Flash stock 5757. It said something like: "No changes made... same version"!!
Flash stock 4550 (or similar from Obi). Worked.
Flash arrynrob3. Checksum error.
Flash stock 5757. Worked.
Flash arrynrob3. Worked.

Then per the ObiFirmware.com site:

Under ITSP Provisioning, set these:
Method: System Start
ConfigURL: »fw.obifirmware.com/Enabl ··· TALK.xml

"Submit, reboot. Your OBi will reboot twice. The second time, Google Voice is enabled."

But is it "enabled"?

Is there a way of knowing if Google Voice is enabled? I'm hoping what you mentioned in your earlier post about it being set but not showing in the webui is true.

Ya, basically any status except "Not configured". "Authentication failed" would at least show you have the (mysteriously hidden) SignalingProtocol set to GV.

Thanks; corrected it.

Alright, now that the xml is corrected, try setting the ITSP Provisioning Method to System Start and the ConfigURL to »toao.net/pub/signallingp ··· ocol.xml and rebooting.

Even if you can't see it, if it does set SignalingProtocol to GV, the status of SP1 should go to "Backing Off: Authentication error" after a reboot and a few seconds.

If SP1 status remains "Service Not Configured", then clearly it didn't set SignalingProtocol to GV and we'll have to think up a new attack.

It's acting a little different but I'm thinking it's not actually reading the xml. Yesterday it was double booting and clearing those two parameters. Now it single boots and doesn't clear either param. What is needed to make it start dual booting again?

Still in the "Service Not Configured" condition but the single boot is frustrating.

It will only reboot if the provisioning xml actually changed a value in the configuration. Turn on syslog to see whats happening »www.obitalk.com/forum/in ··· ic=707.0

What do you mean "clearing those two parameters"?

I altered the XML to clear Method and ConfigURL again. I suspect that is not what was causing the problem, however you may wish to give it a try anyway, for completeness.

If anybody is bored, try scp'ing this to a obi2xx/3xx and running it to dump settings from flash and let me know how it looks.

EDIT: deleted attachment, superceded

Your brand new XML causes the dual boot and the values are clearing once again!

Should those two params get cleared to blanks after the double boot? As I mentioned to naf, after it would double boot, if I go back into Auto Provisioning, the "Start up" is set to "Disable" and the "ConfigURL" is blank. Now, with only a single boot it is leaving those params still set as I left them. It does change "TPRM0" to "0" (without the quotes.)

The edit is to mention it is double booting with the brand new XML and clearing the 2 params.

In this pic I'm concerned about "PhonePower" and CertificatesStatus "Installed"

I believe if CustomizationStatus != Generic, then you're device has "zero touch" configuration, which alters even the "factory" reset of options. If so, we gotta get rid of that crap so we can actually factory reset it.

Does the syslog show anything like "ZT: CustomID ###"?

Phonepower is there even after a button reset and boot without internet connection. Same with CertificatesStatus "Installed".

So, ZT config is either stored in the UNIT_INFO or OBI_PARAM_PT sections.

One way to tell would be to do a diff against a non-ZT 302's flash of those sections.

If it was my device, I would be pretty quick to just erase the OBI_PARAM_PT sections of the flash, but of course I would have a backup that I could bare-metal flash if that fucked everything up

I don't have an eprom burner but maybe you're talking newer tech than I'm familiar with. How can I read the flash?

you have an ssh shell available in arrynrob3, and the full flash is at /dev/mtd6, so something like:

ssh root@<IP_OF_302> "cat /dev/mtd6ro" > dump
 

I wish I knew Linux better. I'm logged in and have the bash prompt. When I type your command it says: -sh: can't create dump: read-only file system.

I do ls and it shows dev and others. I did cd dev and then ls and it shows mtd6ro (and others). cd mtd6ro says: cd: can't cd to mtd6ro. Edit: oh that's a file name. Now what?

Hello, Brown.

You have to do it from your computer, not while logged-in to the OBi ATA.

The dump will end up in whatever local directory you are logging-in from to the ATA.

With Linux is simple, not sure about Windows.

Good luck.

I'm on a Windows PC running Putty from the DOS prompt. Then, in Putty, 192.168.10.1 (address to Obi302), then "root", "obi". This gives the bash prompt.
I think I'm real close to getting the "dump" I just need some handholding.

Try to download plink: »www.chiark.greenend.org. ··· est.html

You can run it from a command prompt:

C:\>plink -l root -pw obi 192.168.10.1 "cat /dev/mtd6ro" > mtd6ro-Brown.txt
 

Thanks Mango,

Here is my file: dump-br.txt

I did a hard reset without the internet attached before the dump in case that matters.

got it, you may delete attachment if youd like

Nothing of interest in UNIT_INFO.

Even though I haven't decoded Brown's OBI_PARAM_PT sections yet, I think the ZT config is going to be in the one at 0x460000. I just noticed its encoded different from the ones at 0x400000 and 0x420000, and on my 202 its short and ends in the string "Generic".

Ill see if i can work out the RC4 key to Brown's OBI_PARAM_PT sections to see what that "powerphone" magic is...

K, decryption was easy. Apparently HW versions >= 1.4 obfuscate the RC4 keys by masking with the MAC address. more secure i guess ;-)

So ya, 0x460000 params are the ZT culprit. Don't know exactly the format, but here's the RAW decrypted bytes:

000000 31 8c 16 d1 04 00 00 03 2a 00 00 00 31 8c 16 d1  >1.......*...1...<
000010 00 00 70 03 25 a4 ed 70 0b 00 00 01 50 68 6f 6e  >..p.%..p....Phon<
000020 65 70 6f 77 65 72 00 25 a4 ed 70 00 00 70 01 a7  >epower.%..p..p..<
000030 80 dd db 11 00 00 01 31 38 31 37 36 37 38 34 31  >.......181767841<
000040 34 36 34 62 62 66 37 00 a7 80 dd db 00 00 70 01  >464bbf7.......p.<
000050 b0 3a 29 70 08 00 00 01 34 2e 32 2e 32 2e 31 00  >.:)p....4.2.2.1.<
000060 b1 3a 29 70 0f 00 00 01 32 30 38 2e 39 37 2e 32  >.:)p....208.97.2<
000070 32 32 2e 32 32 32 00 e6 45 eb 46 0d 00 00 05 53  >22.222..E.F....S<
000080 79 73 74 65 6d 20 53 74 61 72 74 00 15 a8 4c e6  >ystem Start...L.<
000090 e0 00 00 01 40 62 65 67 69 6e 20 49 46 20 28 20  >....@begin IF ( <
0000a0 24 46 57 56 20 3e 3d 20 33 2e 30 2e 30 2e 34 30  >$FWV >= 3.0.0.40<
0000b0 35 34 20 29 20 45 58 49 54 3b 0a 40 73 74 61 72  >54 ) EXIT;.@star<
0000c0 74 20 53 45 54 20 54 50 52 4d 32 20 3d 20 32 3b  >t SET TPRM2 = 2;<
0000d0 0a 20 20 20 20 20 20 20 46 57 55 20 2d 54 3d 54  >.       FWU -T=T<
0000e0 50 52 4d 32 20 68 74 74 70 3a 2f 2f 70 72 6f 76  >PRM2 http://prov<
0000f0 69 73 69 6f 6e 2e 70 68 6f 6e 65 70 6f 77 65 72  >ision.phonepower<
000100 2e 63 6f 6d 3a 34 31 39 35 2f 55 50 47 52 41 59  >.com:4195/UPGRAY<
000110 45 44 44 2f 4f 42 69 32 30 32 2d 33 2d 30 2d 30  >EDD/OBi202-3-0-0<
000120 2d 34 30 35 34 2e 66 77 3b 0a 20 20 20 20 20 20  >-4054.fw;.      <
000130 20 49 46 20 28 20 24 54 50 52 4d 32 20 21 3d 20  > IF ( $TPRM2 != <
000140 30 20 29 20 45 58 49 54 3b 0a 20 20 20 20 20 20  >0 ) EXIT;.      <
000150 20 57 41 49 54 20 36 30 3b 0a 20 20 20 20 20 20  > WAIT 60;.      <
000160 20 47 4f 54 4f 20 73 74 61 72 74 3b 0a 20 20 20  > GOTO start;.   <
000170 20 20 20 00 0d d1 d6 79 0d 00 00 05 50 65 72 69  >   ....y....Peri<
000180 6f 64 69 63 61 6c 6c 79 00 75 01 7d 7f f2 01 00  >odically.u.}....<
000190 01 40 62 65 67 69 6e 20 53 45 54 20 54 50 52 4d  >.@begin SET TPRM<
0001a0 31 20 3d 20 30 3b 20 0a 40 73 74 61 72 74 20 53  >1 = 0; .@start S<
0001b0 59 4e 43 20 68 74 74 70 73 3a 2f 2f 70 72 6f 76  >YNC https://prov<
0001c0 69 73 69 6f 6e 2e 70 68 6f 6e 65 70 6f 77 65 72  >ision.phonepower<
0001d0 2e 63 6f 6d 3a 34 31 39 34 2f 50 72 6f 76 69 73  >.com:4194/Provis<
0001e0 69 6f 6e 58 6d 6c 2e 70 68 70 3f 6d 61 63 3d 24  >ionXml.php?mac=$<
0001f0 4d 41 43 3b 0a 20 20 20 20 20 20 20 49 46 20 28  >MAC;.       IF (<
000200 20 24 54 50 52 4d 30 20 3d 3d 20 31 20 29 20 45  > $TPRM0 == 1 ) E<
000210 58 49 54 3b 20 0a 20 20 20 20 20 20 20 49 46 20  >XIT; .       IF <
000220 28 20 24 54 50 52 4d 31 20 3d 3d 20 33 20 29 20  >( $TPRM1 == 3 ) <
000230 53 45 54 20 54 50 52 4d 31 20 3d 20 34 3b 20 0a  >SET TPRM1 = 4; .<
000240 20 20 20 20 20 20 20 49 46 20 28 20 24 54 50 52  >       IF ( $TPR<
000250 4d 31 20 3d 3d 20 32 20 29 20 53 45 54 20 54 50  >M1 == 2 ) SET TP<
000260 52 4d 31 20 3d 20 33 3b 20 0a 20 20 20 20 20 20  >RM1 = 3; .      <
000270 20 49 46 20 28 20 24 54 50 52 4d 31 20 3d 3d 20  > IF ( $TPRM1 == <
000280 31 20 29 20 53 45 54 20 54 50 52 4d 31 20 3d 20  >1 ) SET TPRM1 = <
000290 32 3b 20 0a 20 20 20 20 20 20 20 49 46 20 28 20  >2; .       IF ( <
0002a0 24 54 50 52 4d 31 20 3d 3d 20 30 20 29 20 53 45  >$TPRM1 == 0 ) SE<
0002b0 54 20 54 50 52 4d 31 20 3d 20 31 3b 0a 20 20 20  >T TPRM1 = 1;.   <
0002c0 20 20 20 20 49 46 20 28 20 24 54 50 52 4d 31 20  >    IF ( $TPRM1 <
0002d0 3d 3d 20 31 20 29 20 57 41 49 54 20 33 30 3b 20  >== 1 ) WAIT 30; <
0002e0 20 0a 20 20 20 20 20 20 20 49 46 20 28 20 24 54  > .       IF ( $T<
0002f0 50 52 4d 31 20 3d 3d 20 32 20 29 20 57 41 49 54  >PRM1 == 2 ) WAIT<
000300 20 36 30 3b 20 20 0a 20 20 20 20 20 20 20 49 46  > 60;  .       IF<
000310 20 28 20 24 54 50 52 4d 31 20 3d 3d 20 33 20 29  > ( $TPRM1 == 3 )<
000320 20 57 41 49 54 20 31 32 30 3b 20 20 0a 20 20 20  > WAIT 120;  .   <
000330 20 20 20 20 49 46 20 28 20 24 54 50 52 4d 31 20  >    IF ( $TPRM1 <
000340 3d 3d 20 34 20 29 20 53 45 54 20 54 50 52 4d 31  >== 4 ) SET TPRM1<
000350 20 3d 20 30 3b 20 0a 20 20 20 20 20 20 20 49 46  > = 0; .       IF<
000360 20 28 20 24 54 50 52 4d 31 20 3d 3d 20 34 20 29  > ( $TPRM1 == 4 )<
000370 20 57 41 49 54 20 33 36 30 30 3b 0a 20 20 20 20  > WAIT 3600;.    <
000380 20 20 00 27 9b 21 1c 06 00 00 04 66 61 6c 73 65  >  .'.!.....false<
000390 00 27 9b 21 1c 00 00 70 04 fb 3a 32 b1 04 00 00  >.'.!...p..:2....<
0003a0 05 53 49 50 00 fb 3a 32 b1 00 00 70 05 3c a1 0c  >.SIP..:2...p.<..<
0003b0 62 04 00 00 05 53 49 50 00 3c a1 0c 62 00 00 70  >b....SIP.<..b..p<
0003c0 05 7d 07 e7 12 04 00 00 05 53 49 50 00 7d 07 e7  >.}.......SIP.}..<
0003d0 12 00 00 70 05 be 6d c1 c3 04 00 00 05 53 49 50  >...p..m......SIP<
0003e0 00 be 6d c1 c3 00 00 70 05 8d 75 5f 58 0d 00 00  >..m....p..u_X...<
0003f0 05 50 65 72 69 6f 64 69 63 61 6c 6c 79 00 8d 75  >.Periodically..u<
000400 5f 58 00 00 6c 05 31 91 a3 f1 04 00 00 03 b4 00  >_X..l.1.........<
000410 00 00 31 91 a3 f1 00 00 6c 03 f5 55 39 8b 30 00  >..1.....l..U9.0.<
000420 00 01 68 74 74 70 73 3a 2f 2f 70 72 6f 76 2e 6f  >..https://prov.o<
000430 62 69 74 61 6c 6b 2e 63 6f 6d 2f 6f 62 68 73 6e  >bitalk.com/obhsn<
000440 70 72 6f 76 2f 69 6e 69 74 2f 69 6e 69 74 6b 65  >prov/init/initke<
000450 79 00 f5 55 39 8b 00 00 6c 01 b2 48 c8 4f 00 00  >y..U9...l..H.O..<
000460 6c 01 b3 48 c8 4f 00 00 6c 01 b4 48 c8 4f 00 00  >l..H.O..l..H.O..<
000470 6c 01 b5 48 c8 4f 00 00 6c 01 b6 48 c8 4f 00 00  >l..H.O..l..H.O..<
000480 6c 01 b7 48 c8 4f 00 00 6c 01 b8 48 c8 4f 00 00  >l..H.O..l..H.O..<
000490 6c 01 b9 48 c8 4f 00 00 6c 01 ff ff ff ff ff ff  >l..H.O..l.......<
0004a0 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff  >................<
0004b0 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff  >................<
0004c0 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff  >................<
0004d0 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff  >................<
0004e0 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff  >................<
0004f0 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff  >................<
 

ETA: oh, i see. its the same format as the 0x400000 and 0x420000 OBI_PARAM_PT chunks, just without each setting being padded to 0x100 bytes. So its 4-byte setting id/hash, 2 byte data length, 2 byte type, data

OK, here is a program to overwrite the OBI_PARAM_PT at 0x460000 with a "Generic" config, encoded with Brown's MAC address (so it won't work for anyone else).

Brown: run this on your obi302. *danger*: it writes to flash. It might brick your device. It might kill your cat. Caveat emptor, etc, etc.

If it works, a reboot afterwards should show your CustomizationStatus as "Generic", at which point a Reset Configuration should bring back all the settings that were hidden/locked, SignalingProtocol = GV included.

This will be all new to me so I'll need some help.
Will I be patching it directly on the Obi?
Is it possible to copy the original (not cat'ed), patch, and copy back?
I don't know linux syntax and I'm on a Win XP laptop with Putty.
If it's easier I can install Ubuntu (or anything) and follow your commands.

get pscp from same place as plink above

then do something like this:

pscp -scp -l root -pw obi genericize_flash_brown 192.168.1.3:/var/tmp
plink -l root -pw obi 192.168.1.3 "chmod +x /var/tmp/genericize_flash_brown"
plink -l root -pw obi 192.168.1.3 "/var/tmp/genericize_flash_brown"
 

Thanks naf,

Okay it did not brick it.

It's showing CertificatesStatus Installed
Customization status Contacting server: networking is not available

I have the cable disconnected.

When I go to ITSP Profile x The requested URL was not found

Same if I go to any of the Voice services.

Crap. As soon as it hits the network its going to re-download that silly forced config. I guess I missed zero-ing the ZT id. Must have been in the encrpyted part of UNIT_INFO. I'll have to decrypt that and change it and re-encrpyt it I guess. Let me get back to you on that.

Atleast it booted again

I tried connecting it and you're exactly right, as soon as it hit the network it downloaded Phonepower again so now it's back to zero hour.

I'll restrain myself until further direction.

Can you block access to phonepower via your router or firewall?

I tried it just now. I setup my router to block all https sites to/from the Obi, re-patched the flash, reset Obi without internet attached. Then put cable in and it rebooted and now sits with flashing power LED (no internet). I will have to be more specific about what I block in the router. Any suggestions?

I tried 'https://provision.phonepower.com' but the router backfired with "cannot block https" sites so I just had it block the word Phonepower but it didn't succeed.

Blocking ZT config from the obi site won't work because the device won't let you configure it until it has got the ZT config downloaded (you saw that when you couldn't access the configuration web gui).

Blocking phonepower wont work cause after the ZT config is downloaded you are stuck with SignalingProtocol = SIP (note how that word appears 4 times in the 0x460000 dump above?) and other phonepower config you dont want.

Let me see if its easier to find the "i already got ZT-configed" setting and turn it on, or find the "i require ZT config" setting and turn it off, or just fucking patch obiapp to skip oiver all this ZT madness.

In the meantime, can you get syslog running? It would be nice to see your the ZT logging: »www.obitalk.com/forum/in ··· ic=707.0

so the "i require ZT config" is just a check against the 5th and 6th letter of your serial number being "ZT".

to change the serial number, we would have to also update the md5 in the UNIT_INFO section, which is itself the md5 of the RC4 encryption key for the private key (an md5 of an md5. cute) so we would have to re-encrypt the private key also.

or we could just change a byte in obiapp to ignore it. ya i think lets do that.

Brown, I sent you a PM with a link to a patched obiapp. To try it out, do something like:

pscp -scp -l root -pw obi obiapp3 192.168.1.3:/var/tmp
plink -l root -pw obi 192.168.1.3 "chmod +x /var/tmp/obiapp3"
plink -l root -pw obi 192.168.1.3 "mount --bind /var/tmp/obiapp3 /obi/obiapp"
plink -l root -pw obi 192.168.1.3 "killall obiapp"
 

That did it, it's "Generic".

THANK YOU naf

If you need further testing done on it just let me know.

So you completed the rest of the steps in »www.obifirmware.com/OAuth2/ and google voice is working, or no?

(That patch won't survive a power cycle, but I'll spin a new firmware version with the patch in it to make it permanent in a hot minute)

It's "backing off", I'll do the Oauth now if you want.

ya that should work now.

I haven't done Oauth2 yet only because Google said I had 11 more uses available so I'm kinda waiting for closure on the flash/firmware etc.

I'm curious, how will you handle the hard coded MAC addresses? Or, is it no longer necessary to modify that area of the flash?

This is something new for me. Can you please tell me more about this?

The other day when I went through the process there was a indication from Google that the countdown had started on how many iterations are allowed. When I go through it again I'll take notes and give you an update. If no one else has seen it then, more likely, I was looking at the wrong thing.

I was just sitting here thinking the same thing.

The patched obiapp just pretends that your serial number doesnt have ZT in it, but it doesn't clear the settings that were already there.

I *could* patch it to always clear those ZT settings (the code is conveniently bytes away from the patched area), but it seems strange for a firmware to silently erase settings that someone might have needed/used.

Ideally I'd make a util that reads the MAC from the flash, does the RC4 of a clean generic param section and writes it to into 0x460000. Then people could use it or not.

People might be more comfortable with a separate Obi202 and Obi302 firmware set and procedure.

Could this be triggered by a web browser or a star code?

Patching additional functionality into the binary is hard cause you gotta make room for it, It'll just be a command line tool to run in the shell. Its only for zerotouch people and you only have to do it once...

I don't think it would be terrible to require the ZT obi30x's be hard reset (maybe soft) without the internet connected prior to running your magic "util".

bsdiff for OBi202-3-2-1-5757EX.fw (since there was no love for 5794)

modifications:
1) add dropbear ssh server. default root passwd = "obi". [custom startup script in /scratch/etc/rc.custom, passwd to change password, fixed lastlogin errors]
2) patch obiapp to use oauth token request override, for provisioning GV without obitalk. Uses same AuthPassword format and provisioning xml as the obi1xx-naf7
3) patch obiapp to bypass "zero touch" forced configuration. added clear_zt_params util to clear old zero touch params

Yes, looks good. I bspatch'ed it, soft reset, updated firmware (it updated without needing a downgrade first), Mango's xml, added username and password (not Oauth2 yet), and I'm at "backing off (869s): Authentication error" with new arrynrob4 version. I'll do Oauth2 next.

Outstanding work once again, Thank you naf

Here's a tool to dump all the stored params (including the ones not accessible via webgui)

Updated from previous to work with hw rev 1.4 devices and their fancy mac masking of the RC4 key.

Let me know if you try it...

Looks like it works as intended; thanks!

I'm seeing a bug (possibly) in the firmware. It seems to have a hard coded 8 byte string in the AuthPassword field. It just shows as 8 dots. No matter what I type in after submit it shows the 8 bytes again before reboot or after reboot. After a reset the field is empty but as soon as anything is entered and submitted the 8 byte string is back.

Edit: I went back to arrynrob3 and patched the flash and it works the same as above. I think that is "normal" because I went through the Oauth2 process and it connected. I made a call out and it seems fine. All the LED's are lit up which seems wrong because I only have 1 phone attached but maybe that's the way it's supposed to work. I guess I should put the arrynrob4 version back in but maybe I'll try it this way for a few days. It's 3:21am so I'll talk later.

That's typical. It's so you can't view source and retrieve your password.

was that talking about param_dump or the no-zt firmware?

That was about the new param_dump. I'll try arrynrob4 on the weekend.

What's the command syntax for param_dump?

just copy it to the box and run it. its just displays every setting on the box. on windows it would be something like:

pscp -scp -l root -pw obi param_dump 192.168.1.3:/var/tmp
plink -l root -pw obi 192.168.1.3 "chmod +x /var/tmp/param_dump"
plink -l root -pw obi 192.168.1.3 "/var/tmp/param_dump"
 

the key is to identify any interesting setting that has a ??? next to it. i dumped all the ones from the webgui into the tool (and a couple of others that i knew off the top), so the other ones are more interesting

(dont paste the output, its got all your passwords and everything in it)

Could you write a program that would capture the digits of incoming numbers that have caller ID blocking switched on? Is it possible? Maybe it would write the number to an obscure location in the GUI.

um

wget http://192.168.1.3/callhistory.htm | grep "whatever youre looking for"
 

?

Dear naf, I have noticed, that the modified fw for OBi200/202 made by arrynrob3 is based on fw. ver. 5757EX. I have noticed, that a ver. 5775 and a ver. 5793 also exists. Why is the modified fw based on 5757 and not 5775 or 5794?
Greetings, Nis in Copenhagen, Denmark

arrynrob3 was actually made against both 5757 *and* 5794. take your pick.

after i made 5794-arrynrob3, it was pointed out that 5794-stock breaks features that were previously working (see »www.obitalk.com/forum/in ··· =13489.0) and provides no enhancements or bug fixes that we know of because obihai doesn't release changelogs [or even build accouncements] anymore.

so for arrynrob4 (which you only need if you have a ZT in your serial number) i didn't bother producing a 5794 variant because I consider 5757 the latest 'working' build [and im lazy. patching an extra function or two into a 3MB executable aint a walk in the park, so i prefer to not do it to multiple different versions in parallel]

Thank you very much for your help!

Hi, is there a how-to guide about how to install and use your modified firmware in Obi200/202?

Take a read through »www.obifirmware.com/ and let us know if you have any questions.

So all I need to do is to install the customized firmware? It is easy! Thank you all for your good work!

I went through the instructions given in naf's website. The generation of the Refresh Token is essentially the same as what RonR described before, right?
My question is, in "Google Voice on OBi ATA Manual Configuration" step, what I should use for the AuthPassword? the generated refresh token? If it is, do I need to enter "OAuth Client ID" and "OAuth Client secret" somewhere as in Asterisk xmpp.conf?

»Re: ObiHAI Obi100/Obi110 Firmware Mod Discussion

Thanks. It works fine with naf's firmware.

I'm just getting back to it. My 302 reset last week on its own and lost the Oauth credentials. I reconnected my 110 because I was busy and that was quick. I'm wondering maybe if the model name shown in the status screen was changed from OBI302 to OBI202 then we could also use Obitalk to configure service. I realize you started this thread for the sole purpose of eliminating the Obitalk requirement but then, the 302 conversion happened which made your firmware even more desirable. Let me know your thoughts.

Thanks

I think the easier solution is that you work on your "reset on its own" problem, probably just by disabling all auto-provisioning and turning off the obitalk service.

Everything was disabled. Now I'm wondering if arrynrob4 should not be installed over arrynrob3 which is what I did. When I get back to it I'll go back in versions to stock 4350 (or whatever), then stock 5757 then arrynrob4. My reason for thinking this has to do with my earlier experience of not being able to install arrynrob3 over stock 4350 where it gave a checksum error.

Don't bother. If the firmware flashed onto the device, then its on there.
Its in a separate flash area from the settings anyway: notice how your settings dont go away when you upgrade...

When you say "reset", do you mean just the configuration to one of the SPs, just the oauth credentials, or everything like a factory reset?

I made a mistake saying "reset" on its own. The Obi was rebooting on its own possibly related to when a call comes in after a certain number of rings. I did not narrow it down with a syslog yet. The first thing I thought of is a weak power supply so I tried another with similar results. After a couple more of these auto reboots I decided to flash stock 4350 firmware then stock 5757 and then I stopped.

a reboot followed by losing saved settings sounds a lot like a provisioning happening to me, but ya a syslog will have a reboot reason in there.

A clarification on the settings: They were not being reset by the reboots. Google Voice stopped after I downgraded the firmware so I could do a cleaner installation of arrynrob4.

So today: I flashed arrynrob4 back on (over stock 5757), used the XML from ObiFirmware.com, configured oAuth2, setup Syslog, made a call and received a call and it's working fine. I'll leave the log going for a couple days maybe or at least restart it if the reboots start happening again.

The only "Auto Provisioning" setup is "LUA Script Update" at system start. Should it be disabled? Do you want to see what's in the script?

So it sounds like you never had a problem but all this firmware switching

It was rebooting on its own when calls came in. That's a big problem.

Is there any successful case for Obi302? These can be bought for less than $30 from eBay.

depends what you mean by successful...

i believe with 5757-arrynrob4 you can unlock a vendor-configured obi302 to do anything an obi202 can (including GV) except that you can't configure it via obitalk's website, but you can use the local web gui instead [rant]which you should have been doing anyway[/rant]

if you do get one, report back your success/failure.

Hi Naf;

Can we now try to hack the ObiHai 1062 powerphone so that it can be programmed as a non-provisioned device?
How do we go about this? I think I can try to use a programmer to download the firmware if I know how to do this.
It will be an interesting project. And, I will also learn a bit about hacking these devices up close and person.

Sure, why not? Firmware appears to be similar to the obi2xx. If you start a new thread, I'll hop over there and lets see what we can do.

Is this the "latest" firmware: »fw.obihai.com/OBiPhone-5 ··· -4027.fw ?

Yes. The version above is the final version. I have opened up a new thread, but it will require moderator approval.

Maybe I'm missing something.

I have an OBi1022 phone that was never subscribed to OBitalk and never provisioned by any vendor. I configured it myself to my heart's content.

Are you speaking about a vendor locked OBi SIP phone?

Yes, I am talking about vendor locked OBI phones. They get provisioned after a hardware reset, do not offer google voice and the like.

Sounds like the obi3xx. Does your model # have "ZT" as the 5th and 6th characters by any chance?

Thanks, old fart.

Jesus christ if obihai cant even fucking put out an announcement for what the fuck firmwarm is the latest they could atleast open up a directory listing at fw.obihai.com, assholes.

No the model number is the same for provisioned and non provisioned phones as far as I can tell. The mods want the discussion on this thread. So, we should probably continue the discussion here.

Sorry. I meant serial number. What about that?

Sent you the serial number via private message.

Email didn't come through right. Try an IM instead?

hm, ok so its not Zero Touch forcing config. Have to look into that later.

in the meantime, firmware looks very moddable. same md5 chunks as the obi2xx so we should be able to do this via the web interface (you're web interface does allow fw upgrades, correct?)

do you have a way to backup/restore your whole flash chip in case we fuck it up?

ETA: all the chunks look like: uncompressed size bigendian + zlib-stream. unzlibbed gives us a ubifs image. so far so good. looks like we got Linux-3.4.20 with gcc 4.3 and glibc 2.13 on (some variant of?) a little endian arm. ill try to build a cross-compiling toolchain to match... [wait, why the fuck do i have to keep guessing at the toolchain these obihai fools use? i can't help but notice that its all GPL. where's my "scripts used to control compilation and installation of the executable", eh?]

Yes, the web interface allows fw updates or at least gives me the option.
Also, the config is possibly pushed by Obi based on the serial number. I have two of these boxes so, we can push ahead before I get the SPI programmer. I can always clone the box.
Is there a schematic for an spi progammer that I can use?

ok, i think i understand the format enough by now that there shouldn't be too much risk in needing to go back to an original backup, but hey its your box

regarding programmers: maybe, which flash chip does it use?

ok lots of questions for you on configs: how do you know it is forcing a config on you? like you reset and it still forces or hides settings, or what? what is it that your vendor has locked down that you want to change? and whats your current CustomizationStatus and obitalk/ITSP provision settings look like?

status update: got the toolchain built, got dropbear compiled, and (hopefully) scripted it to get started on boot.

im kind of scared to increase the size of the ubifs image on the first try at it without a backup. (any ubi experts out there?)

maybe we should start instead by just enabling the already-included telnet server...

this phone has built-in software to take pcap packet dumps to a usb drive? wtf?

That's pretty common, at least to local RAM which can then be exported. Shot above is from an old Yealink.

olisom, I PM-ed you a link to a modified version of OBiPhone-5-1-4-4027.fw with just a couple small changes:

diff -r -u rootfs-orig/css/sercomm.sh rootfs-mod/css/sercomm.sh
--- rootfs-orig/css/sercomm.sh     2014-12-18 17:54:18.000000000 -0600
+++ rootfs-mod/css/sercomm.sh      2018-03-03 18:39:03.000000000 -0600
@@ -1,7 +1,10 @@
 #!/bin/sh
 
-# Enable telnet
-telnetd &
+## Enable telnet
+#telnetd &
+
+# Enable telnet that won't be killed by 'killall telnetd'
+busybox telnetd &
 
 # MOUNT debug system
 mount -t debugfs none /sys/kernel/debug
diff -r -u rootfs-orig/etc/passwd rootfs-mod/etc/passwd
--- rootfs-orig/etc/passwd 2014-08-12 17:58:04.000000000 -0500
+++ rootfs-mod/etc/passwd  2018-03-03 18:14:24.000000000 -0600
@@ -1,4 +1,4 @@
-root::0:0:root:/home/root:/bin/sh
+root:RjzQVrYR2O2vw:0:0:root:/home/root:/bin/sh
 daemon:*:1:1:daemon:/usr/sbin:/bin/sh
 bin:*:2:2:bin:/bin:/bin/sh
 sys:*:3:3:sys:/dev:/bin/sh
 

the ubifs partition looked ok in nandsim.

if you're conservative, probably smarter to wait until you have a means of taking a full flash backup.
if you're bold, atleast get syslog going before upgrading to it so you get hear your phone's last words.

Love your sense of humor -- almost fell off my chair laughing.

@naf You have a pretty good track record. Haven't let us down yet

almost forgot, i silently fixed the lastlog warnings you saw on the obi200 in arrynrob4 i believe. (still didnt compile sftp-server for sshfs though) wont be so funny for olisum when he bricks his $100 phone...

besides, i do actually want to see the syslog.

My Obi302 is working perfect after the install of arrynrob4 over stock 5757. No more rebooting on incoming calls. The initial install over arrynrob3 had problems so avoid doing that.

That reminds me of several years ago updating routers with DD-WRT firmware which had specific versions for the initial flash and full feature versions for second flash. If it was done wrong it could brick the router and require a JTAG or serial connection.

Thanks again.

I think we scared him off :-(

@Naf,

Firmware version: 3.2.1 (Build: 5757EX-arrynrob3)
device: obi202

Issue: Trying to configure sp4 for gv manual oauth2. Coming back with backing off errors in status.

Syslog shows the following:

Using AuthPassword as token request override
XMPP:Authentication Error:Refresh token available

Using the same credentials in a different sp slot (say sp2) works properly.

I even generated a new refresh token for the account with same results. Suggestions?

Thanks!

Update: Eventually it took, but I noticed something else strange.

It seems once a GV oauth2 profile is configured and connected to, changing it doesn't actually change it. It still reverts to connecting to the initially configured profile. Even inputting an erroneous Authpassword results in it still connecting to the previous configured credentials.

I'm not sure if this is because of the mod or because the firmware is so well (¿?) written. A factory reset fixes this. It's not a big deal as its unlikely the account used is changed often.

My factory reset workaround is below.

A) Block internet access for obi

B) Backup settings prior to factory reset. Everything except passwords get saved. I save those in one of the SIP comment fields

B1) Factory reset

C) skip this step for 200, for 202, re-enable wan access (»www.obitalk.com/info/faq ··· from-WAN)

D) Enable local oauth2 configuration
I run a local tftpd server and point the ITSP autoprovisiong using the file from the second page of this »www.obifirmware.com/OAuth2/

Otherwise, you'll need to enable internet access to pull the file from »fw.obifirmware.com/Enabl ··· TALK.xml . I'm not sure what sort communications there is to the mothership, so I rather keep internet access blocked until all the settings are restored (including disabling any obitalk communications). The unit will reboot twice.

E) I restore configuration saved from step B. Unit will reboot again.

F) Paste passwords for each configured voice service.

G) Reboot. While rebooting re-enable obi internet access. I have the obi's on a separate vlan so it's literally just a matter of flipping a toggle in the firewall.

All this takes less than 5 minutes to do.

jsolo1: strangely enough that sounds normal i think. what happens is this: you log into GV with the access token. they're good for like a couple hours or whatever. the refresh token that you input is just used to get an access token. and the firmware only attempts to get a new access token when the old access token fails/expires. That's why you get these weird cases where you've change the refresh token (even to a different user) but since the access token hasn't expired, it's still used and the refresh token is not put in use yet. as you noticed, a reset is the quick way to clear the access token and not wait for it to expire.

EDIT: changed auth token --> access token

Thank you for explaining.

I wonder what happens if the changes are pushed through obitalk. Perhaps it too does a factory reset (or some form of one) before reprovisioning.

Gotta bide my time waiting on the reappearance of olisum somehow... Im guessing that obitalk just provisions a X_GApiInitAccessToken setting to clear the old access token. You can do that too by just provisioning the EnableGoogleVoiceWithoutOBiTALK.xml or similar after modifying the refresh token to get immediate results. (haven't tried myself)

Or do what I usually do: force the old access token to invalidate by revoking oauth permission from the google side.

^^You mean step D above? I tried that, didn't make any difference. Do those two values, blam and blorg have any significance or are just arbitrary fillers?

I hadn't though of revoking permissions through google itself and regenerating the token. Only issue is I also use this account in freepbx for outbound calls. That would require updating it there too.

ah, D, yes. (my poor reading comprehension strikes again)

blam/blorg were just arbitrary values to pass the not-null check to avoid the "Not configured" state after a reset (and the value of X_GApiRefreshToken would actually be used during token refresh if AuthPassword was blank, but it would have to be a token generated against the obihai client_id/secret, i.e. it would have to come from obitalk configuration)

thats what im fucking talking about!

telnet user/pass should be: root/obi
if that doesn't work, maybe i missed the home dir or shell or something?

if telnet works, lets see the output of a few things:
# dmesg | grep -B3 -A10 "MTD partitions"
# cat /proc/mtd
# mount
# ubinfo
# ls -l /dev/ubi*

after seeing those we should be able to figure out how to take a backup of the whole flash (the box's individualized settings are the important part - cant get those back if we fuck em up).

EDIT: to change my mind a shitton of times

DSPG v1.2.4-rc2 OBiPhone

OBiPhone login: root
Password:
root@OBiPhone:~# dmesg | grep -B3 -A10 "MTD partitions"
[ 0.516565] Bad eraseblock 613 at 0x000004ca0000
[ 0.544402] Bad eraseblock 926 at 0x0000073c0000
[ 0.554848] 12 cmdlinepart partitions found on MTD device dmw_nand
[ 0.557978] Creating 12 MTD partitions on "dmw_nand":
[ 0.560579] 0x000000000000-0x000000100000 : "u-boot"
[ 0.564877] 0x000000100000-0x0000001c0000 : "u-boot-env"
[ 0.569129] 0x0000001c0000-0x000000400000 : "devtree"
[ 0.573348] 0x000002400000-0x000002800000 : "kernel"
[ 0.577374] 0x000002800000-0x000003c00000 : "rootfs"
[ 0.581488] 0x000003c00000-0x000004400000 : "obiapp"
[ 0.585544] 0x000000400000-0x000000800000 : "kernel1"
[ 0.589695] 0x000000800000-0x000001c00000 : "rootfs1"
[ 0.594069] 0x000001c00000-0x000002400000 : "obiapp1"
[ 0.598182] 0x000004400000-0x000006c00000 : "scratch"
root@OBiPhone:~# cat /proc/mtd
dev: offfset size erasesize name
mtd0: 00000000 00100000 00020000 "u-boot"
mtd1: 00100000 000c0000 00020000 "u-boot-env"
mtd2: 001c0000 00240000 00020000 "devtree"
mtd3: 02400000 00400000 00020000 "kernel"
mtd4: 02800000 01400000 00020000 "rootfs"
mtd5: 03c00000 00800000 00020000 "obiapp"
mtd6: 00400000 00400000 00020000 "kernel1"
mtd7: 00800000 01400000 00020000 "rootfs1"
mtd8: 01c00000 00800000 00020000 "obiapp1"
mtd9: 04400000 02800000 00020000 "scratch"
mtd10: 06c00000 01400000 00020000 "misc"
mtd11: 00000000 08000000 00020000 "all"
root@OBiPhone:~# mount
rootfs on / type rootfs (rw)
ubi0:rootfs on / type ubifs (rw,relatime)
proc on /proc type proc (rw,relatime)
sysfs on /sys type sysfs (rw,relatime)
none on /dev type tmpfs (rw,relatime,mode=755)
devpts on /dev/pts type devpts (rw,relatime,gid=5,mode=620)
tmpfs on /var/volatile type tmpfs (rw,relatime)
tmpfs on /media/ram type tmpfs (rw,relatime)
none on /sys/kernel/debug type debugfs (rw,relatime)
ubi1:obiapp on /obi type ubifs (rw,relatime)
ubi2:scratch on /scratch type ubifs (rw,sync,relatime)
root@OBiPhone:~# usbinfo
-sh: usbinfo: command not found
root@OBiPhone:~# ubinfo
UBI version: 1
Count of UBI devices: 3
UBI control device major/minor: 10:62
Present UBI devices: ubi0, ubi1, ubi2
root@OBiPhone:~# ls -l /dev/ubi*
crw------- 1 root root 252, 0 Dec 31 1969 /dev/ubi0
crw------- 1 root root 252, 1 Dec 31 1969 /dev/ubi0_0
crw------- 1 root root 248, 0 Dec 31 1969 /dev/ubi1
crw------- 1 root root 248, 1 Dec 31 1969 /dev/ubi1_0
crw------- 1 root root 247, 0 Dec 31 1969 /dev/ubi2
crw------- 1 root root 247, 1 Dec 31 1969 /dev/ubi2_0
crw------- 1 root root 10, 62 Dec 31 1969 /dev/ubi_ctrl

i cut too close around the MTD line, lost the chip id and last 2 partitions. try bumping up the buffers:
# dmesg | grep -B15 -A20 "MTD partitions"

root@OBiPhone:~# dmesg | grep -B15 -A20 "MTD partitions"
[ 0.166603] 5b00000.serial: ttyS1 at MMIO 0x5b00000 (irq = 24) is a DSPG_UART
[ 0.382035] console [ttyS1] enabled
[ 0.417169] galcore 600000.gpu: GPU initialized, clocked at 300MHz
[ 0.432629] brd: module loaded
[ 0.440699] loop: module loaded
[ 0.444751] dvf9a 6300000.dvf9a: successfully registered (DVF9A version 2)
[ 0.450675] NAND device: Manufacturer ID: 0xc2, Chip ID: 0xf1 (Macronix NAND 128MiB 3,3V 8-bit)
[ 0.455149] Scanning device for bad blocks
[ 0.463627] Bad eraseblock 77 at 0x0000009a0000
[ 0.479305] Bad eraseblock 241 at 0x000001e20000
[ 0.486704] Bad eraseblock 303 at 0x0000025e0000
[ 0.492719] Bad eraseblock 349 at 0x000002ba0000
[ 0.516565] Bad eraseblock 613 at 0x000004ca0000
[ 0.544402] Bad eraseblock 926 at 0x0000073c0000
[ 0.554848] 12 cmdlinepart partitions found on MTD device dmw_nand
[ 0.557978] Creating 12 MTD partitions on "dmw_nand":
[ 0.560579] 0x000000000000-0x000000100000 : "u-boot"
[ 0.564877] 0x000000100000-0x0000001c0000 : "u-boot-env"
[ 0.569129] 0x0000001c0000-0x000000400000 : "devtree"
[ 0.573348] 0x000002400000-0x000002800000 : "kernel"
[ 0.577374] 0x000002800000-0x000003c00000 : "rootfs"
[ 0.581488] 0x000003c00000-0x000004400000 : "obiapp"
[ 0.585544] 0x000000400000-0x000000800000 : "kernel1"
[ 0.589695] 0x000000800000-0x000001c00000 : "rootfs1"
[ 0.594069] 0x000001c00000-0x000002400000 : "obiapp1"
[ 0.598182] 0x000004400000-0x000006c00000 : "scratch"
[ 0.602456] 0x000006c00000-0x000008000000 : "misc"
[ 0.606549] 0x000000000000-0x000008000000 : "all"
[ 0.610751] dmw_nand 5400000.nand: initialized
[ 0.613704] UBI: attaching mtd4 to ubi0
[ 0.615645] UBI: physical eraseblock size: 131072 bytes (128 KiB)
[ 0.618816] UBI: logical eraseblock size: 126976 bytes
[ 0.621557] UBI: smallest flash I/O unit: 2048
[ 0.623958] UBI: VID header offset: 2048 (aligned 2048)
[ 0.626996] UBI: data offset: 4096
[ 0.698872] UBI: max. sequence number: 653

ok cool, lets try to make a backup: (we'll do a proper nanddump later)
# cat /dev/mtd11 > /var/volatile/dump

that dump file should be ~128MB [+oob data? nand confuses me] [hope you have that much ram. should have asked to see # free]

then maybe use netcat to get that file off the device. if youre unfamiliar, see here: »nakkaya.com/2009/04/15/u ··· ansfers/ no serial number, so we can't lookup the form factor in case we need to manually flash to restore. but so far so good...

Is there only one NAND chip on there. Maybe we are trying to dump a flash into the flash? I have a flash drive, but I don't know if there are drivers for a usb drive on that thing.

root@OBiPhone:~# cat /dev/mtd11 > /var/volatile/dump
cat: write error: No space left on device
root@OBiPhone:~#

/var/volatile should be ram.

output of
# free
should tell us how much space is available.

dd is available if we have to split it up...

--- to be continued tomorrow, got a hot date [its my anniversary ]

Happy anniversary! See ya tomorrow
I managed to secure two more devices the 1022 and 1032.
They should be here in about a week or so.

root@OBiPhone:~# free
total used free shared buffers
Mem: 114672 112376 2296 0 20
-/+ buffers: 112356 2316
Swap: 0 0 0
root@OBiPhone:~# cd /var/volatile/
root@OBiPhone:/var/volatile# ls
cache dump lock log misc ppp run tmp
root@OBiPhone:/var/volatile# ls -l dump
-rw-r--r-- 1 root root 38113280 Mar 12 17:44 dump
root@OBiPhone:/var/volatile# ls -l
drwxr-xr-x 3 root root 60 Dec 31 1969 cache
-rw-r--r-- 1 root root 38113280 Mar 12 17:44 dump
drwxrwxrwt 3 root root 60 Dec 31 1969 lock
drwxr-xr-x 2 root root 100 Mar 12 13:43 log
drwxr-xr-x 8 root root 200 Dec 31 1969 misc
drwxr-xr-x 2 root root 80 Dec 31 1969 ppp
drwxr-xr-x 5 root root 260 Dec 31 1969 run
drwxrwxrwt 2 root root 500 Mar 12 10:41 tmp
root@OBiPhone:/var/volatile# rm dump
root@OBiPhone:/var/volatile# ls
cache lock log misc ppp run tmp
root@OBiPhone:/var/volatile# free
total used free shared buffers
Mem: 114672 75164 39508 0 20
-/+ buffers: 75144 39528
Swap: 0 0 0
root@OBiPhone:/var/volatile#

ok so we got atleast 38MB of free RAM to work with. lets just get each mtd piece off one at a time then.
conveniently mtd0-10 cover the whole flash contiguously, so...

for mtd 0-8 and 10:
# dd if=/dev/mtd0 of=/var/volatile/dump-mtd0 bs=$((0x10000))
(netcat file off of device, delete file to free space)
# dd if=/dev/mtd1 of=/var/volatile/dump-mtd1 bs=$((0x10000))
(netcat file off of device, delete file to free space)
... rinse and repeat...

mtd9 > 38MB, so it must be split into two, netcat off and delete in between:
# dd if=/dev/mtd9 of=/var/volatile/dump-mtd9a bs=$((0x10000)) count=$((0x140))
# dd if=/dev/mtd9 of=/var/volatile/dump-mtd9b bs=$((0x10000)) skip=$((0x140))

also lets see the output of
# fw_printenv

p.s. might help to put output in [code ] blocks: »Re: Posting How To - Examples

and lets get the ubi partitions as ubi partitions instead of raw mtd also:

(netcat file off of device and delete in between, should have the drill down by now)
# dd if=/dev/ubi0_0 of=/var/volatile/dump-ubi0_0 bs=$((0x10000))
# dd if=/dev/ubi1_0 of=/var/volatile/dump-ubi1_0 bs=$((0x10000))
# dd if=/dev/ubi2_0 of=/var/volatile/dump-ubi2_0a bs=$((0x10000)) count=$((0x140))
# dd if=/dev/ubi2_0 of=/var/volatile/dump-ubi2_0b bs=$((0x10000)) skip=$((0x140))

hi naf; is there any way to mount an USB drive readwrite? It's ow mounted as a write only drive. That way we can get the whole file on the usb drive.

maybe. what does dmesg and mount look like when you inserted it?

ETA: looks like theres a script (/usr/sbin/auto_mount.sh) that udev calls (/etc/udev/rules.d/81-usb-storage.rules) to auto mount things with 'mount -o ro'. should be able to just umount it and mount it again without the ro option...

Ah, I see now. So in the phone firmware, in addition to doing zero touch configuration for ZT serial numbers by forcing a network connection to obihai to get provider config, they also have the capability to force config from a usb-based zerotouch file (isnt it "one-touch" if you have to insert a usb stick?).

So thats probably how phonepower got you locked. We just need to clear those settings out to be back to Generic, just like on the 30x, but minus the "dont connect to get them again" patch

[ 0.820261] usbcore: registered new interface driver rtl8192cu
[ 0.823212] Initializing USB Mass Storage driver...
[ 0.825877] usbcore: registered new interface driver usb-storage
[ 0.828910] USB Mass Storage support registered.
[ 0.831255] musb-fdrc: version 6.0, ?dma?, otg (peripheral+host)
[ 0.841851] musb-fdrc musb-fdrc: MUSB FDRC host driver
[ 0.844475] musb-fdrc musb-fdrc: new USB bus registered, assigned bus number 1
[ 0.848360] usb usb1: New USB device found, idVendor=1d6b, idProduct=0001
[ 0.851802] usb usb1: New USB device strings: Mfr=3, Product=2, SerialNumber=1
[ 0.855473] usb usb1: Product: MUSB FDRC host driver
[ 0.857990] usb usb1: Manufacturer: Linux 3.4.20-rt31-dvf-v1.2.4-rc2 musb-hcd
[ 0.861610] usb usb1: SerialNumber: musb-fdrc
[ 0.864782] hub 1-0:1.0: USB hub found
[ 0.866734] hub 1-0:1.0: 1 port detected
[ 0.869329] musb-fdrc musb-fdrc: USB Host mode controller at c8100000 using PIO, IRQ 30

root@OBiPhone:/# df -h
Filesystem Size Used Available Use% Mounted on
ubi0:rootfs 15.0M 13.7M 1.3M 91% /
none 56.0M 732.0K 55.3M 1% /dev
tmpfs 56.0M 19.7M 36.3M 35% /var/volatile
tmpfs 56.0M 0 56.0M 0% /media/ram
ubi1:obiapp 4.5M 4.1M 396.0K 91% /obi
ubi2:scratch 33.3M 68.0K 31.5M 0% /scratch
/dev/sda1 967.2M 436.3M 530.9M 45% /media/sda
root@OBiPhone:/# parted -ls
-sh: parted: command not found
root@OBiPhone:/# lsblk -f
-sh: lsblk: command not found
root@OBiPhone:/# lsblk -f
-sh: lsblk: command not found
root@OBiPhone:/# ls -ld /media
drwxr-xr-x 7 root root 480 Mar 7 2014 /media
root@OBiPhone:/# umount /dev/sda1
root@OBiPhone:/# sudo mount -o rw,users,umask=000 /dev/sda1
-sh: sudo: command not found
root@OBiPhone:/# mount -o rw,users,umask=000 /dev/sda1 /media/
hdd/ net/ ram/ sda/ sdb/
root@OBiPhone:/# mount -o rw,users,umask=000 /dev/sda1 /media/
hdd/ net/ ram/ sda/ sdb/
root@OBiPhone:/# mount -o rw,users,umask=000 /dev/sda1 /media/sd
sda/ sdb/
root@OBiPhone:/# mount -o rw,users,umask=000 /dev/sda1 /media/sda/
mount: mounting /dev/sda1 on /media/sda/ failed: Invalid argument
root@OBiPhone:/# ls

how do i figure out the second argument to mount?

should just be
# mount /dev/sda1 /media/sda

Sent you the dump file via private message. Do you want me to run the other separate dumps too?

nice. good call on using the usb

dont need the seperate mtd's, but do need the seperate ubis:
# cat /dev/ubi0_0 > /media/sda/ubi0_0
# cat /dev/ubi1_0 > /media/sda/ubi1_0
# cat /dev/ubi2_0 > /media/sda/ubi2_0

Sent you the three files.

alright gimme a hot minute to figure out how to decrypt these OBI_PARAM_PT sections and ill get back to you.

ok, that was easy. almost same as obi20x, but it uses the mac as an encryption key mask even with hardware rev 1.3:

$ ./param_dump
mac: 9cadef######, hw_vers: 000103ff
using mac as rc4 key mask: true
-- params at 00340000 --
318c16d1 04000003: d1168c31 (???) = 0x2a000000
318c16d1 00007003: d1168c31 (???) = 0x
25a4ed70 0b000001: 70eda425 (???) = "Phonepower"
25a4ed70 00007001: 70eda425 (???) = ""
a780dddb 11000001: dbdd80a7 (???) = "9fd40cf4499348fe"
a780dddb 00007001: dbdd80a7 (???) = ""
b03a2970 08000001: 70293ab0 (DI_NS_.xml/Internet Settings/DNSServer1) = "4.2.2.1"
b13a2970 0f000001: 70293ab1 (DI_NS_.xml/Internet Settings/DNSServer2) = "208.67.222.222"
e645eb46 0d000005: 46eb45e6 (DM_S_.xml/Auto Firmware Update/Method) = "System Start"
15a84ce6 e0000001: e64ca815 (DM_S_.xml/Auto Firmware Update/FirmwareURL) = "@begin IF ( $FWV >= 3.0.0.4054 ) EXIT;
@start SET TPRM2 = 2;
       FWU -T=TPRM2 http://provision.phonepower.com:4195/UPGRAYEDD/OBi202-3-0-0-4054.fw;
       IF ( $TPRM2 != 0 ) EXIT;
       WAIT 60;
       GOTO start;
      "
0dd1d679 0d000005: 79d6d10d (DM_S_.xml/ITSP Provisioning/Method) = "Periodically"
75017d7f f2010001: 7f7d0175 (DM_S_.xml/ITSP Provisioning/ConfigURL) = "@begin SET TPRM1 = 0;
@start SYNC https://provision.phonepower.com:4194/ProvisionXml.php?mac=$MAC;
       IF ( $TPRM0 == 1 ) EXIT;
       IF ( $TPRM1 == 3 ) SET TPRM1 = 4;
       IF ( $TPRM1 == 2 ) SET TPRM1 = 3;
       IF ( $TPRM1 == 1 ) SET TPRM1 = 2;
       IF ( $TPRM1 == 0 ) SET TPRM1 = 1;
       IF ( $TPRM1 == 1 ) WAIT 30;
       IF ( $TPRM1 == 2 ) WAIT 60;
       IF ( $TPRM1 == 3 ) WAIT 120;
       IF ( $TPRM1 == 4 ) SET TPRM1 = 0;
       IF ( $TPRM1 == 4 ) WAIT 3600;
      "
279b211c 06000004: 1c219b27 (???) = "false"
279b211c 00007004: 1c219b27 (???) = ""
fb3a32b1 04000005: b1323afb (VS_1_VP_1_.xml/General/SignalingProtocol) = "SIP"
fb3a32b1 00007005: b1323afb (VS_1_VP_1_.xml/General/SignalingProtocol) = ""
3ca10c62 04000005: 620ca13c (VS_1_VP_2_.xml/General/SignalingProtocol) = "SIP"
3ca10c62 00007005: 620ca13c (VS_1_VP_2_.xml/General/SignalingProtocol) = ""
7d07e712 04000005: 12e7077d (VS_1_VP_3_.xml/General/SignalingProtocol) = "SIP"
7d07e712 00007005: 12e7077d (VS_1_VP_3_.xml/General/SignalingProtocol) = ""
be6dc1c3 04000005: c3c16dbe (VS_1_VP_4_.xml/General/SignalingProtocol) = "SIP"
be6dc1c3 00007005: c3c16dbe (VS_1_VP_4_.xml/General/SignalingProtocol) = ""
 

so, we just need to clear mtd2 @ 0x180000-0x190000 and be done with that crap.

ive never manually written to nand before [how fun for you!].
before doing anything dumb, lets see the output of
# mtdinfo /dev/mtd2
and take some nanddump snapshots with various options: (shotgun approach)
# nanddump -f /media/sda/nanddump-mtd2 /dev/mtd2
# nanddump -o -f /media/sda/nanddump-mtd2-o /dev/mtd2
# nanddump -n -f /media/sda/nanddump-mtd2-n /dev/mtd2
# nanddump -n -o -f /media/sda/nanddump-mtd2-no /dev/mtd2

OBiPhone login: root
Password:
root@OBiPhone:~# mtdinfo /dev/mtd2
mtd2
Name: devtree
Type: nand
Eraseblock size: 131072 bytes, 128.0 KiB
Amount of eraseblocks: 18 (2359296 bytes, 2.2 MiB)
Minimum input/output unit size: 2048 bytes
Sub-page size: 2048 bytes
OOB size: 64 bytes
Character device major/minor: 90:4
Bad blocks are allowed: true
Device is writable: true

root@OBiPhone:~# nanddump -f /media/sda/nanddump-mtd2 /dev/mtd2
ECC failed: 0
ECC corrected: 0
Number of bad blocks: 0
Number of bbt blocks: 0
Block size 131072, page size 2048, OOB size 64
Dumping data starting at 0x00000000 and ending at 0x00240000...
root@OBiPhone:~#
root@OBiPhone:~# nanddump -o -f /media/sda/nanddump-mtd2-o /dev/mtd2
ECC failed: 0
ECC corrected: 0
Number of bad blocks: 0
Number of bbt blocks: 0
Block size 131072, page size 2048, OOB size 64
Dumping data starting at 0x00000000 and ending at 0x00240000...
root@OBiPhone:~# nanddump -n -f /media/sda/nanddump-mtd2-n /dev/mtd2
Block size 131072, page size 2048, OOB size 64
Dumping data starting at 0x00000000 and ending at 0x00240000...
root@OBiPhone:~# nanddump -n -o -f /media/sda/nanddump-mtd2-no /dev/mtd2
Block size 131072, page size 2048, OOB size 64
Dumping data starting at 0x00000000 and ending at 0x00240000...
root@OBiPhone:~#

[WARNING: tested in nandsim, but normal caveats regarding killing your cat and bricked devices definitely apply here]
to clear those forced config params, it should be as simple as this:
# flash_erase /dev/mtd2 0x180000 1

then just restart and factory reset and check that your CustomizationStatus is "Generic"

We will have to wait to open up the dead cat now. I erased that part of the nand. I asked obi to reboot. Obi was happy to reboot on the webscreen. I don't know why it's been playing dead for the past 3 minutes and didn't care to rejoin the world of the living ... Oh at least it didn't reconnect to the wifi network. So, until I get home the suspense continues ... We shall see how dead the cat is!

Reminds me of Schrodinger's cat! Is it dead or alive? Until the observation can be made it's both dead and alive! How exciting is that for an otherwise dull day!

ah shit

ETA: was the output of flash_erase atleast something like: Erasing 128 Kibyte @ 180000 -- 100 % complete?

if we were smarter, we would have read back that flash section after erasing to make sure we erased the right hunk... crap.

Yes. That was the message. No worries. We still have three more cats ready to die. It will probably be another 3 hours before I get home. So chill out. I am not worried about that phone: dead or alive.

hm, so if we erased the right offset, i dont see how that would have killed it, cause even though i didnt get as fancy as i did on the obi300 genericizer and actually write out an encrypted "I'm Generic!" record, I've seen the area be completely erased on Mango's factory-fresh dump and that worked fine. hm.

Anyway, let me know when you find out which way that wave function collapsed...

Ok. The phone lost its wifi settings after we touched the NAND. I had to scan and enter the password again. I did a factory reset, but for some reason its still on the telnet version of the firmware. No auto provisioning.

So, it turns out the cat was dead and it was alive. Where is my nobel?

phew, i thought it was a goner... ya, the reset button just clears the settings, it doesn't mess with the firmware itself. i shouldnt have said "factory" reset i guess.

No auto provisioning = victory?
CustomizationStatus?

OBiPhone login: root
Password:
root@OBiPhone:~# flash_erase /dev/mtd2 0x180000 1
Erasing 128 Kibyte @ 180000 -- 100 % complete

This was the message from earlier.

I think that zt network pull stuff only applies to serials with ZT where you have NA. If not I can just patch it out like on the 30x.

Take another dump of mtd11 and let's see if it came back.

I make it a habit to block obi's internet access anytime the device is factory reset. It's unblocked once all the auto update crap is disabled.

Sent an im with the dump.

well, you're definately right about it re-downloading:

$ ./param_dump
mac: 9cadef######, hw_vers: 000103ff
using mac as rc4 key mask: true
-- params at 00340000 --
318c16d1 04000003: d1168c31 (???) = 0x2a000000
318c16d1 00007003: d1168c31 (???) = 0x
25a4ed70 0b000001: 70eda425 (???) = "Phonepower"
25a4ed70 00007001: 70eda425 (???) = ""
a780dddb 11000001: dbdd80a7 (???) = "9fd40cf4499348fe"
a780dddb 00007001: dbdd80a7 (???) = ""
b03a2970 08000001: 70293ab0 (DI_NS_.xml/Internet Settings/DNSServer1) = "4.2.2.1"
b13a2970 0f000001: 70293ab1 (DI_NS_.xml/Internet Settings/DNSServer2) = "208.67.222.222"
e645eb46 0d000005: 46eb45e6 (DM_S_.xml/Auto Firmware Update/Method) = "System Start"
15a84ce6 e0000001: e64ca815 (DM_S_.xml/Auto Firmware Update/FirmwareURL) = "@begin IF ( $FWV >= 3.0.0.4054 ) EXIT;
@start SET TPRM2 = 2;
       FWU -T=TPRM2 http://provision.phonepower.com:4195/UPGRAYEDD/OBi202-3-0-0-4054.fw;
       IF ( $TPRM2 != 0 ) EXIT;
       WAIT 60;
       GOTO start;
      "
0dd1d679 0d000005: 79d6d10d (DM_S_.xml/ITSP Provisioning/Method) = "Periodically"
75017d7f f2010001: 7f7d0175 (DM_S_.xml/ITSP Provisioning/ConfigURL) = "@begin SET TPRM1 = 0;
@start SYNC https://provision.phonepower.com:4194/ProvisionXml.php?mac=$MAC;
       IF ( $TPRM0 == 1 ) EXIT;
       IF ( $TPRM1 == 3 ) SET TPRM1 = 4;
       IF ( $TPRM1 == 2 ) SET TPRM1 = 3;
       IF ( $TPRM1 == 1 ) SET TPRM1 = 2;
       IF ( $TPRM1 == 0 ) SET TPRM1 = 1;
       IF ( $TPRM1 == 1 ) WAIT 30;
       IF ( $TPRM1 == 2 ) WAIT 60;
       IF ( $TPRM1 == 3 ) WAIT 120;
       IF ( $TPRM1 == 4 ) SET TPRM1 = 0;
       IF ( $TPRM1 == 4 ) WAIT 3600;
      "
279b211c 06000004: 1c219b27 (???) = "false"
279b211c 00007004: 1c219b27 (???) = ""
fb3a32b1 04000005: b1323afb (VS_1_VP_1_.xml/General/SignalingProtocol) = "SIP"
fb3a32b1 00007005: b1323afb (VS_1_VP_1_.xml/General/SignalingProtocol) = ""
3ca10c62 04000005: 620ca13c (VS_1_VP_2_.xml/General/SignalingProtocol) = "SIP"
3ca10c62 00007005: 620ca13c (VS_1_VP_2_.xml/General/SignalingProtocol) = ""
7d07e712 04000005: 12e7077d (VS_1_VP_3_.xml/General/SignalingProtocol) = "SIP"
7d07e712 00007005: 12e7077d (VS_1_VP_3_.xml/General/SignalingProtocol) = ""
be6dc1c3 04000005: c3c16dbe (VS_1_VP_4_.xml/General/SignalingProtocol) = "SIP"
be6dc1c3 00007005: c3c16dbe (VS_1_VP_4_.xml/General/SignalingProtocol) = ""
b18c5279 06000004: 79528cb1 (VS_1_VP_1_L_1_.xml/Calling Features/X_SkipCallScreening) = "false"
b18c5279 00006004: 79528cb1 (VS_1_VP_1_L_1_.xml/Calling Features/X_SkipCallScreening) = ""
0c5869df 06000004: df69580c (VS_1_VP_1_L_1_.xml/Calling Features/X_SMSNotify) = "false"
0c5869df 00006004: df69580c (VS_1_VP_1_L_1_.xml/Calling Features/X_SMSNotify) = ""
47815edf 02000001: df5e8147 (VS_1_VP_1_L_1_.xml/Calling Features/X_XMPPPriority) = "0"
47815edf 00006001: df5e8147 (VS_1_VP_1_L_1_.xml/Calling Features/X_XMPPPriority) = ""
0caa81e0 06000004: e081aa0c (VS_1_VP_1_L_1_.xml/Calling Features/X_GTalkSimultaneousRing) = "false"
0caa81e0 00006004: e081aa0c (VS_1_VP_1_L_1_.xml/Calling Features/X_GTalkSimultaneousRing) = ""
3269de28 06000004: 28de6932 (VS_1_VP_1_L_2_.xml/Calling Features/X_SkipCallScreening) = "false"
3269de28 00006004: 28de6932 (VS_1_VP_1_L_2_.xml/Calling Features/X_SkipCallScreening) = ""
8d4385b5 06000004: b585438d (VS_1_VP_1_L_2_.xml/Calling Features/X_SMSNotify) = "false"
8d4385b5 00006004: b585438d (VS_1_VP_1_L_2_.xml/Calling Features/X_SMSNotify) = ""
2849bd44 02000001: 44bd4928 (VS_1_VP_1_L_2_.xml/Calling Features/X_XMPPPriority) = "0"
2849bd44 00006001: 44bd4928 (VS_1_VP_1_L_2_.xml/Calling Features/X_XMPPPriority) = ""
0ddfb9f3 06000004: f3b9df0d (VS_1_VP_1_L_2_.xml/Calling Features/X_GTalkSimultaneousRing) = "false"
0ddfb9f3 00006004: f3b9df0d (VS_1_VP_1_L_2_.xml/Calling Features/X_GTalkSimultaneousRing) = ""
b3456ad8 06000004: d86a45b3 (VS_1_VP_1_L_3_.xml/Calling Features/X_SkipCallScreening) = "false"
b3456ad8 00006004: d86a45b3 (VS_1_VP_1_L_3_.xml/Calling Features/X_SkipCallScreening) = ""
0e2fa18b 06000004: 8ba12f0e (VS_1_VP_1_L_3_.xml/Calling Features/X_SMSNotify) = "false"
0e2fa18b 00006004: 8ba12f0e (VS_1_VP_1_L_3_.xml/Calling Features/X_SMSNotify) = ""
09111caa 02000001: aa1c1109 (VS_1_VP_1_L_3_.xml/Calling Features/X_XMPPPriority) = "0"
09111caa 00006001: aa1c1109 (VS_1_VP_1_L_3_.xml/Calling Features/X_XMPPPriority) = ""
0e14f206 06000004: 06f2140e (???) = "false"
0e14f206 00006004: 06f2140e (???) = ""
3422f687 06000004: 87f62234 (VS_1_VP_1_L_4_.xml/Calling Features/X_SkipCallScreening) = "false"
3422f687 00006004: 87f62234 (VS_1_VP_1_L_4_.xml/Calling Features/X_SkipCallScreening) = ""
8f1abd61 06000004: 61bd1a8f (VS_1_VP_1_L_4_.xml/Calling Features/X_SMSNotify) = "false"
8f1abd61 00006004: 61bd1a8f (VS_1_VP_1_L_4_.xml/Calling Features/X_SMSNotify) = ""
ead87a0f 02000001: 0f7ad8ea (???) = "0"
ead87a0f 00006001: 0f7ad8ea (???) = ""
0f492a1a 06000004: 1a2a490f (VS_1_VP_1_L_4_.xml/Calling Features/X_GTalkSimultaneousRing) = "false"
0f492a1a 00006004: 1a2a490f (VS_1_VP_1_L_4_.xml/Calling Features/X_GTalkSimultaneousRing) = ""
8d755f58 0d000005: 585f758d (DM_S_.xml/OBiTalk Provisioning/Method) = "Periodically"
8d755f58 00006c05: 585f758d (DM_S_.xml/OBiTalk Provisioning/Method) = ""
3191a3f1 04000003: f1a39131 (DM_S_.xml/OBiTalk Provisioning/Interval) = 0xb4000000
3191a3f1 00006c03: f1a39131 (DM_S_.xml/OBiTalk Provisioning/Interval) = 0x
f555398b 30000001: 8b3955f5 (DM_S_.xml/OBiTalk Provisioning/ConfigURL) = "https://prov.obitalk.com/obhsnprov/init/initkey"
f555398b 00006c01: 8b3955f5 (DM_S_.xml/OBiTalk Provisioning/ConfigURL) = ""
b248c84f 00006c01: 4fc848b2 (DM_S_.xml/OBiTalk Provisioning/GPRM0) = ""
b348c84f 00006c01: 4fc848b3 (DM_S_.xml/OBiTalk Provisioning/GPRM1) = ""
b448c84f 00006c01: 4fc848b4 (DM_S_.xml/OBiTalk Provisioning/GPRM2) = ""
b548c84f 00006c01: 4fc848b5 (DM_S_.xml/OBiTalk Provisioning/GPRM3) = ""
b648c84f 00006c01: 4fc848b6 (DM_S_.xml/OBiTalk Provisioning/GPRM4) = ""
b748c84f 00006c01: 4fc848b7 (DM_S_.xml/OBiTalk Provisioning/GPRM5) = ""
b848c84f 00006c01: 4fc848b8 (DM_S_.xml/OBiTalk Provisioning/GPRM6) = ""
b948c84f 00006c01: 4fc848b9 (DM_S_.xml/OBiTalk Provisioning/GPRM7) = ""
 

im too lazy [or drunk, whatever] to read the dissassembly to look at where its downloading this crap from.
can you turn on syslog? see »www.obitalk.com/forum/in ··· ic=707.0
then repeat the flash_erase command and reboot while recording the syslog output? it should show us some log strings to grep in the dissassembly to find where it download this sht config to disable it.

No, you need to set the syslog Server field to an ip of a machine on your local network that is running syslogd. If its windows, just run this with no args: »www.obihai.com/docs/syslogd.zip
Once you set the Server field and save that configuration, you should see a bunch of log messages being printed in the syslogd window.

I will try to do that a little later today.

Here's a wiki for syslog:
»www.obitalk.com/forum/in ··· ic=707.0
'https://www.obitalk.com/forum/index.php?topic=707.0'

Maybe sometime Brown or olisom will clue the rest of us in on how they get a hold of cheap Phonepower (supposed to have been) locked devices...

Used, on ebay, with no real guarantee.

Well, I just got it from a system administrator at my office. He wasn't sure it would work as they were locked and there were plenty of units around in an office he manages form after they moved to a different provider.

log
Sent you the log naf

I had an idea naf. Can we change the serial number and mac since these are used to push the configuration? Once we change these, the OBI phone should stop trying to get a new configuration file? Although, they could probably use the Obi number ...

The other idea I had was to create a .zt file and update the configuration using the .zt file. I don't know to create one though ...

On my Obi302 ZT before the naf firmware, Phonepower showed even after a reset with the internet disconnected; it was hard coded into the Obi.

During the testing, naf made a patch that got rid of Phonepower but with hard coded MAC for my unit. It worked with arrynrob3 firmware (his then current version) and I used it for a few days. He then later added that patch (without MAC I presume) to the firmware to create his arrynrob4 version.

Not really, there's an obihai-signed PKI cert stored in the UNIT_INFO section that you couldn't recreate with different device info. But no worries, we can just patch the obiapp executable to think its generic.

Just gotta track down the logic. Looks like the obiphone firmware replaced the "does serial# contain ZT" check to check some global instead. Currently backtracking that to see what its based on, but in the end I think thats where I'll patch to ignore, just like on obi30x.

nm

I have one more serial number if that will help.

ok instead of being lazy and just erasing the forced param section (which by definition has to trigger the forced download, duh), lets do the complicated dance of encrypting an "im generic!" record in its place.

two files attached: param_dump and clear_zt_params. copy them both to /var/tmp

(if any of these steps fail: stop, don't reboot the phone, and we'll fix it before proceeding)
run param_dump. should show some params at 0x340000. one of them should say "Phonepower".
run clear_zt_params. if the mac shown matches your mac AND theres no warnings AND the erasesize shown is 131072 (AND you have misplaced confidence in my skills), then when it asks to flash answer 'y'. should then show 'flash written!'
run param_dump again. should show fewer params at 0x340000, and this time one should say 'Generic'.
take a dump of mtd11 here for good measure
reboot with no internet connection to phone. web gui should show CustomizationStatus of Generic.
perform "Reset Configuration" via web gui, reboot still without internet connected.
run param_dump one more time. should be very little to the output cause we cleared all the settings.
disable all provisioning and the obitalk service.
re-enable internet connection to phone. lets see if it overwrites that generic record or not.

The param_dump file won't download. It always fails.

sent you links via PM. also edited the instructions above to add a Reset Config step.

Sent you a PM with a segfault after the second parm_dump. Let me know if you wan the dump I took after the clear_zt_params.

wow. im not doing good at this.

ya let me see dump3 so i can maybe recreate the segfault. its not good that it was able to read 0x340000 fine *before* i wrote custom data there, but not after :-(

ok looks like clear_zt_params just erased the flash at where the forced params are stored but the write didn't work, so i just need to figure out how to write some code that actually does the write correctly.

here's current attempt that clears but fails to write, if anyone has suggestions:

static const int CUSTOM_OFFSET=0x180000;
static const int LEN = 0x200;
 
unsigned char buf[LEN];
 
// fill buf
 
int fd = open("/dev/mtd2", O_RDWR);
 
erase_info_t ei;
ei.length = 0x20000;
ei.start = CUSTOM_OFFSET;
 
ioctl(fd, MEMUNLOCK, &ei);
ioctl(fd, MEMERASE, &ei);
 
lseek(fd, CUSTOM_OFFSET, SEEK_SET);
write(fd, buf, sizeof(buf));
 
close(fd);
 

is min_io_size a problem i wonder?

root@OBiPhone:~# mtdinfo /dev/mtd2
mtd2
Name: devtree
Type: nand
Eraseblock size: 131072 bytes, 128.0 KiB
Amount of eraseblocks: 18 (2359296 bytes, 2.2 MiB)
Minimum input/output unit size: 2048 bytes
Sub-page size: 2048 bytes
OOB size: 64 bytes
Character device major/minor: 90:4
Bad blocks are allowed: true
Device is writable: true
 

Just throwing a dart in the dark here. Does the size of the new entry match the size of the erased entry, i.e., the new entry should be "0x20000" ? Do you have padding after the "I am generic" entry to get to that size?

Increasing the write size is worth a shot (no harm since we know we have to erase the whole 0x20000 block anyway. atleast *that* part of flash memory i understand). Here's a new try.

Note this requires there be an existing entry at 0x340000, so make sure to let the device connect to the internet and redownload a forced config before attempting a clear (i.e. param_dump should show the Phonepower entry before clearing. param_dump segfaulting just means the whole entry is erased [and that i write shit code])

reboot to force update?

ya that should work. it should then reboot itself to store the forced params.
either watch syslog to see the "PARAM SET DEFAULT ALL !!!!!! We are goint to use the same PT / MTD writing start @180000... / PARAM: CUSTOM value stored .." lines, or just wait until running param-dump runs without segfault (haha)

[note that mtd2 starts at offset 0x1C0000 relative to the whole flash at mtd11, so mtd2+0x180000 = mtd11+0x340000]

c99fc57c ad450ffa: 7cc59fc9 (???) = >>
8585b9a3 04000003: a3b98585 (???) = 0xd5ea5250
9a0a77e2 0c000001: e2770a9a (???) = "75.75.75.75"
-- params at 00340000 --
a780dddb 09000001: dbdd80a7 (???) = "18733115"
318c16d1 04000003: d1168c31 (???) = 0x01000000
25a4ed70 08000001: 70eda425 (???) = "Generic"

root@OBiPhone:~# cat /dev/mtd11 > /media/sda/dump4

Seems to be working.

yes much better. guess they weren't lying about "minimum i/o size"

alright keep going from the "reboot with no internet connection to phone. web gui should show CustomizationStatus of Generic." part from the instructions above if you can. (might be tough to do that part remotely :-P)

Not what we expected. I can't seem to upload the screenshots anymore.
»ufile.io/uls69

Thats fine. It just means its *about* to force them again. No worries, we'll just patch obiapp to not do that.

Also, half the menu is missing on the left. I think this is the configuration where it will keep seeking the configuration before doing anything. I tried to disable obi configuration and it told me I am busy, go away. Request denied ...

Normal menu. It appears that I have no more space left to upload images to DSL reports.

ah yes, you're in "limited functionality pending zerotouch download" mode. you might actually have to let it download again to get out of that mode. you can always re-run clear_zt_params afterwards.

to stop the vicious cycle of re-downloading forced configs, i sent you a modified obiapp.
backup the old one and try the new one instead:

# cp /obi/obiapp /mnt/sda/obiapp-orig
# cp /mnt/sda/obiapp-mod /obi/obiapp
# chmod +x /obi/obiapp
# killall obiapp
 

EDIT: changed the backup location to be the usb drive because you might not have enough room for two copies on the flash

Selected text from my attempts to replace the obi app. It just won't move the same sized app into the same place!

flash written!
root@OBiPhone:~# /media/sda/param_dump
....
....
....
Settings/PreferredAccessPoint) = "Access Point 1"
-- params at 00340000 --
....
318c16d1 04000003: d1168c31 (???) = 0x01000000
25a4ed70 08000001: 70eda425 (???) = "Generic"

root@OBiPhone:~# cp /media/sda/obiapp-mod /obi/obiapp
cp: write error: No space left on device

root@OBiPhone:~# rm /obi/obiapp

root@OBiPhone:~# cp /media/sda/obiapp-mod /obi/obiapp
cp: write error: No space left on device
root@OBiPhone:~# ls -l /obi
.....
.....
-rwxr-xr-x 1 root root 6925 Jan 11 2017 obi
-rwxr-xr-x 1 root root 704512 Mar 16 14:47 obiapp
-rwxr-xr-x 1 root root 6159 Jan 11 2017 obicmd
-rwxr-xr-x 1 root root 6279 Jan 11 2017 obid
....

root@OBiPhone:~# cp /obi/marimba.mp3 /media/sda/
root@OBiPhone:~# rm /obi/marimba.mp3
root@OBiPhone:~# cp /media/sda/obiapp-mod /obi/obiapp
cp: write error: No space left on device
root@OBiPhone:~# ls -l /obi/obiapp
-rwxr-xr-x 1 root root 741376 Mar 16 14:51 /obi/obiapp
root@OBiPhone:~# rm /obi/obiapp
root@OBiPhone:~# cp /media/sda/obiapp-mod /obi/obiapp
cp: write error: No space left on device
root@OBiPhone:~# ls -l /obi/
....
....
....
-rwxr-xr-x 1 root root 6925 Jan 11 2017 obi
-rwxr-xr-x 1 root root 737280 Mar 16 14:52 obiapp

i think its not reclaiming the space cause its still executing. (and fyi it has a watchdog to restart it if you kill it). try like this maybe?

# killall obiapp && cp /media/sda/obiapp-mod /obi/obiapp

if not i can just put it in a firmware image sooner than later. just need a clever name for the firmware...

ok, trying now. I think obi app is the GUI. So the phone turned into the boot screen and the command is still executing ...

come again? did the copy work or no?

md5sum obiapp-mod = 1d1f44ecb4d1b686e1c724ee906df8a7

$ md5sum /obi/obiapp
 

got a screenshot of what your talking about half loading?

Sorry I had trouble with dslreports not loading your message. I tried the killall it's been trying to replace the app for 5 minutes now. I doubt it will replace the app. The phone went from the normal screen to a "blank" screen, like the one it displays during boot. I don't think the app can be replaced.

give it a couple minutes. it is 3MB going to flash. that aint quick.

if you still have a shell, i would try to fix this before you reboot, cause you never know ifs its coming back.

can you unmount /obi/, or is it in use?

# umount /obi

if that doesn't work try
# umount -f /obi

if we can unmount it, we can just flash the whole damn ubifs.

It won't respond to a control-c. I suspect. The telnet session is history too.

see if it lets you start another telnet session. you can kill the cp and unmount from there maybe?

Nope. The phone is stuck. We lost her Now, I get to bring out the screw drivers
I think the obiapp is the GUI.

tried reboot? telnet gets started after obiapp is run in background... might work unless watchdog is just permanently pissed (which it might be)

Ok. I can try something else, if I can get my hands on an ethernet cable. Maybe the linux system is still up, but the GUI is controlled by obi app. So is the Wifi ...

ya obiapp runs the gui and the webserver (and the phone parts). basically everything. your only hope is telnet being up for enough time so we can fix obiapp. not sure enough about linux wifi stuff to know if you should have that are not. but ethernet cable is definately a good idea.

if not, to the screwdriver and see how screwed you are based on the size/layout of the flash chip and presence/lack of a serial/uart header.

Nope. No telnet either.

well crap. :-(

i actually thought that overwrite was relatively safe. didn't think we'd get like 1/2 an executable on there and fuck ourselves. in retrospect i shoulda made a firmware image and just used the webgui to flash it on. live and learn.

anyway, to the screwdrivers! (you wanted an electronics project anway, right?)

anyone know how to look at a uboot config and tell if its the "wait for key on a uart" kind or the "throw a tftp request out by default just in case" kind?

Ok I got the box open. Pictures to follow. We have a jumper. We may have some way to go.
»ufile.io/betvb
»ufile.io/fek9q
»ufile.io/ab7t0
»ufile.io/7ipoo

Ok, we still have one more 1062 to play with. So, whenever you are ready with the firmware we can give it a shot. I can see why this was unexpected. I still don't understand why it was killed and not fully replaced before being executed again ... Or not be replaced at all ...

Ya that MX30LF1G08AA-TI is your flash. 48TSOP. Pretty tiny pin spacing @ 0.020"

not gun-shy at all, eh? ok let me put together that obiapp patch for zertouch with my normal gv-enable patch, and throw dropbear in a firmware instead of stupid telnet. might take a minute, but ill send it your way when its packaged up.

Na, let's move forward. I need to wait for a cable to fix the other flash anyway.

fw link sent. ssh instead of telnet. param_dump and clear_zt_params are included. obiapp has gv-enabled and zt-disabled.

param_dump segfaults

Ok used the old working param_dump program. Went through all the steps. The device no longer accepts the push from obi. How do I configure GV locally? Obitalk won't let me add the device. It knows its registered to some other provider.

»www.obifirmware.com/OAuth2

ah shit. still had it pointed at my local files. easy fix i guess.

Ok Done.

Done = victory / success / champagne?

Stays generic after reboot? can make gv calls?

Yep time to open the champagne!

do me a favor and just check the upgrade to the link im sending you. just fixing param_dump to keep my facade of professionalism

Sure thing. But I am confused about the exact link. The later one has an earlier time stamp.

i spoke faster than google drive could upload. should have link now. (olisom3)

if it flashes ok (cause the checksums worked) and param_dump is ok, i think ill publish that bad boy.

just a sanity check is the mod 15mb? the previous firmware was 32mb. Still the same web flash method?

oh shit. good call. wrong file. (too much champagne?) new link coming.

Segfault again?

The clear_zt_config works. So, must be something about the param_dump

hm? o well, fuck it. time to celebrate for tonight.

we can deal with the stupid param_dump at a later date.

congrats on your new phone

Yes stays generic after reboot. Can make gv calls. Receive gv calls even.

Sure We still have a 1032 and a 1022 to liberate
Well not right now but next week

gotta pour some of this champagne out for that first 1062 that was so close, but just couldn't make it over that finish line with us.

actually come to think of it i bet somebody has a tsop48 clip and a ft2232h somewhere...

I am getting a programmer for the NAND, but I was hoping there is a way to program this thing without removing the tsop48 from the board.

its possible. a lot depends on how much the capacitance of the rest of the board slows down the signals your programmer is trying to push. hard to tell without trying. this also assumes you are patient enough to get the dozen or so connections to the flash made assuming you dont have a fancy test clip. (wow, people want $500 for one? thats crazy. id be using wirewrap and shit)

id still try some non-flash ideas first. is there not a short time-period were telnet is up during boot before the things get frozen?

I found a programmer for $25 ish, but the clip is $40. The clip is called the 360-clip. I am not sure I want a clip. Not worth it, I might just go with some wire. Besides most of the pins are no connections. We need seven or so wires according to the datasheet.

I don't think the telnet comes up anymore. There is a hardware reset still available (home+cancel). However, I think it goes to the iam generic part and therefore won't download from Obi. I was wondering if we can change the version number of the firmware and put it on a flash drive and use the (home+cancel) reset on boot to see if that will pickup the firmware as an update and overwrite the one on the device ...

ya that 360-clip is sexy, but for $40 damn. which programmer you lookin at?

the "i am generic" configuration is only read by obiapp. and it aint reading anything anymore. all the "resets" do is clear the non-0x340000 config area. they dont modify the actual firmware.

you try hooking to ethernet and making continuous telnet connection attempts during boot?
syslog still transmit? (if you left it configured, unlikely after all those resets)

»www.embeddedcomputers.ne ··· roducts/
Flashcartusb classic may work. The FlashcartUSB xport definitely works.

I wonder what the 4 pin jumper does or how to use that 4 pin jumper. (The one just below the MXIC NAND.)
»ibb.co/fRAfXx

No the device does not try to get an ip address. I may be able to use a crossover ethernet cable connected directly to a computer. But I don't have a crossover cable.

Well the sylog utility was running on the PC but obi syslog port isn't set. So nothing useful there.

I am wondering if the obi 110 and obi 220 devices can be modded to accept a cheaper USB wifi dongle. The Wifi dongle sold by Obi is $25. There are cheaper USB 5g dongles. The device drivers should be linux kernel modules. I wonder if there are specific arm friendly chipsets ....

looks promising on a 202 with some free-after-rebate pos like this »www.tigerdirect.com/appl ··· =9150700

# dmesg
usb 1-1: new high speed USB device using ffxav-ehci and address 2
usb 1-1: New USB device found, idVendor=0bda, idProduct=818b
usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
usb 1-1: Product: 802.11n NIC
usb 1-1: Manufacturer: Realtek
usb 1-1: SerialNumber: 00e04c000001
usb 1-1: configuration #1 chosen from 1 choice
 

need to build network tools though: no ifconfig/iwconfig/iwlist. i know the guy to blame for not including them though...

can you try this version of param_dump real quick? i feel like i want to include one that *doesn't* segfault so i don't look like an idiot...

upload didnt work. sent you a PM with link.

Yes, it does not segfault.

Maybe cross compile the kernel module and upload to the device?

bsdiff was too big, but i sent a link to OBi1FW with OBiPhone-5-1-4-4027-olisom4.fw, so if all goes well it will show up on obifirmware.com soon.

modifications:
1) add dropbear ssh server. default root passwd = "obi"
2) patch obiapp to use oauth token request override, for provisioning GV without obitalk. Uses same AuthPassword format and provisioning xml as the obi1xx-naf7 and obi2xx-arrynrob4
3) patch obiapp to bypass "zero touch" forced configuration. added clear_zt_params util to clear old zero touch params

Do you want me to test it?

guess that would be smart. sent you the link also. should be same as olisom3 but with the non-segfaulting param_dump

No segfault. Both param_dump and clear_zt_param appear to be functional. Nothing else seems off ... So, I suppose this worked

ok, i see its up on obifirmware.com now: »fw.obifirmware.com/OBiPh ··· isom4.fw

Yay! Champagne time!

Excellent work, thank you.

The phones have a way of importing your Google contacts. This feature shows you the name of the person calling (if they're in your contacts) after the first ring. See »www.obitalk.com/forum/in ··· c=8983.0
'http://www.obitalk.com/forum/index.php?topic=8983.0'

Is this feature sustained and also can it be added to 20x and 30x machines?

gave it a look. unfortunately my particular device driver wasn't in kernel-2.6 and didn't make it into backports-3.14, which is when the minimum kernel version bumped to 3.0. so no 2.6 device driver for me.

but i did notice that the obi2xx fw does have lsusb, just not the busybox symlink for some reason. so if you have a usb wireless dongle you would like to try, just run:
# busybox lsusb
and grep the second 'xxxx:xxxx' string in kernel-2.6.30 or backports-3.14 to see if a driver is available.

I hear that if you pay obi a buncha money for ObiExtras *and* have use of obitalk portal, they enable that exact feature for you on the obi2xx firmware. i dont have any money and i don't use the portal, so i can't confirm.

others apparantely just forward their numbers through callcentric NY to pick up CNAM and then import their gv-contacts to callcentric to have the same effect.

well now this doesn't make a damn bit of sense.

Is the CNAM data by default included by Google with an incoming call (like it is with SIP), and the OBi discards it unless OBiEXTRAS is enabled?

If so, perhaps this is based on a hidden configuration option, like enabling Google Voice. To see if I am correct, we would need to subscribe to OBiEXTRAS, download their configuration, decrypt it, and analyze the XML. I won't have time until later in the week. If someone gets to it before me, let me know the results!

I have not seen any mention of CNAM in the ObiExtras brochure, only Google Voice "contacts". It is hard for me to believe that Google would strip off CNAM info if it came to them but, I don't know the routing, so maybe GV numbers can never get CNAM attached to them without a middleman (gateway). My Obi302 ZT is not compatible with ObiExtras so I cannot help there. I hope someone will subscribe (or is already) so we can figure this out.

Hmmz, let me check what my phone does. I don't have an official Obi1000 series phone. I do have an Obi 202. However, this feature seems to be aimed at the Obi 1000 series phone aka 1022/1032/1062 phone. So obitalk isn't going to be kind to me.

Hmmz, let me check what my phone does. I don't have an official Obi1000 series phone. I do have an Obi 202. However, this feature seems to be aimed at the Obi 1000 series phone aka 1022/1032/1062 phone. So obitalk isn't going to be kind to me. Also, notice that I have a menu on the obi app which reads "Import" "Group Filter" The import menu isn't active. So for what it's worth, that may be an entry into the code were the magic happens. The import menu is under Extras in the address menu. Possibly entry points in the obiapp

Hmmz, let me check what my phone does. I don't have an official Obi1000 series phone. I do have an Obi 202. However, this feature seems to be aimed at the Obi 1000 series phone aka 1022/1032/1062 phone. So obitalk isn't going to be kind to me. Also, notice that I have a menu on the obi app which reads "Import" "Group Filter" The import menu isn't active. So for what it's worth, that may be an entry into the code were the magic happens. The import menu is under Extras in the address menu. Possibly entry points in the obiapp.

On the Obi 202, a CSV list may be difficult to match to a CNAME entry. I don't think the 1000 firmware is doing a CNAME. Rather it's downloading a CSV file from google contacts or equivalent and loading it into the GUI as far as I can tell. Maybe I am wrong ...

@naf I might be testing the firmware on 1022 and 1032 tomorrow. Do I need to do anything different? Or is this the one ring to rule them all?

If they worked on stock OBiPhone-5-1-4-4027, then olisom4 will work fine.

And as long as param_dump can correctly decode the zt-forced custom params at 0x340000, then clear_zt_params can correctly encode a proper generic record to overwrite it with.

[295485.563224] usb 1-1: new full-speed USB device number 2 using musb-fdrc
[295485.703652] usb 1-1: not running at top speed; connect to a high speed hub
[295485.712858] usb 1-1: New USB device found, idVendor=7392, idProduct=7811
[295485.719741] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[295485.727070] usb 1-1: Product: 802.11n WLAN Adapter
[295485.732023] usb 1-1: Manufacturer: Realtek
[295485.736267] usb 1-1: SerialNumber: 00e04c000001

Guess this is a dead end as far as backports goes? I have another trick up my sleeve. I am getting a Obihai 5g usb. Maybe we can figure out the manufacturer id and then patch the firmware to remove the vendor id check for a generic with the same chipset.

That device does have a driver in backports:

$ grep 7392.*7811 -lrI backports-3.14.22-1/*
backports-3.14.22-1/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c
 

Wow if we can get this working, everyone can buy one for $9 ish on Amazon. And it has a slim profile and one of the best ratings on Amazon.

ok let me try to guess/recreate the .config that obi used to build their kernel so I can make some backports kmods (you know, the one they agreed to release per the GPL in exchange for getting to use all that code for free? ya that one)

»github.com/ksclarke/rtl8192cu

Maybe this will work?

they have the rpi's kernel .config.

i just need to keep removing CONFIG_ settings until theres no undefined symbols when i load it. shouldnt be too hard...

Try putting the attached drivers on the obi2xx for that realtek dongle, and loading them with something like this:

# /sbin/insmod compat.ko
# /sbin/insmod compat_firmware_class.ko
# /sbin/insmod cfg80211.ko
# /sbin/insmod mac80211.ko
# /sbin/insmod rtlwifi.ko
# /sbin/insmod rtl_usb.ko
# /sbin/insmod rtl8192c-common.ko
# /sbin/insmod rtl8192cu.ko
# dmesg
# /usr/sbin/iwconfig
 

Ok, I will try the realtek dongle. Before I do that, I just wanted to post that the firmware works for 1022. Except for the fact that there are six SP's enabled with no way to access the 6th line because there are only 5 buttons. So, the firmware works on 1022. I will now try the 1062.

Same error as earlier incomplete file. I can't ever seem to download from DSLreports.

pm-ed you a link

root@OBiPhone:~# /sbin/insmod /media/sda/rtl8192/compat.ko
insmod: can't insert '/media/sda/rtl8192/compat.ko': invalid module format
root@OBiPhone:~# /sbin/insmod /media/sda/rtl8192/compat
compat.ko compat_firmware_class.ko
root@OBiPhone:~# /sbin/insmod /media/sda/rtl8192/compat
compat.ko compat_firmware_class.ko
root@OBiPhone:~# /sbin/insmod /media/sda/rtl8192/compat_firmware_class.ko
insmod: can't insert '/media/sda/rtl8192/compat_firmware_class.ko': invalid module format
root@OBiPhone:~# dmesg
[ 0.000000] Booting Linux on physical CPU 0
[ 0.000000] Linux version 3.4.20-rt31-dvf-v1.2.4-rc2 (hgong@dspg) (gcc version 4.6.4 20120303 (prerelease) (GCC) ) #8 PREEMPT RT Tue Nov 22 10:22:42 PST 2016
[ 0.000000] CPU: ARM926EJ-S [41069265] revision 5 (ARMv5TEJ), cr=00053177
[ 0.000000] CPU: VIVT data cache, VIVT instruction cache
[ 0.000000] Machine: DSPG DVF99, model: DVF99 on EVB

[ 902.753188] usb 2-1: USB disconnect, device number 2
[ 914.903125] usb 1-1: new full-speed USB device number 2 using musb-fdrc
[ 915.043680] usb 1-1: not running at top speed; connect to a high speed hub
[ 915.052277] usb 1-1: New USB device found, idVendor=7392, idProduct=7811
[ 915.059068] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[ 915.066310] usb 1-1: Product: 802.11n WLAN Adapter
[ 915.071173] usb 1-1: Manufacturer: Realtek
[ 915.075329] usb 1-1: SerialNumber: 00e04c000001
[ 1058.913191] Indeed it is in host mode hprt0 = 00021501
[ 1059.103136] usb 2-1: new high-speed USB device number 3 using dwc_otg
[ 1059.110420] Indeed it is in host mode hprt0 = 00001101
[ 1059.317813] usb 2-1: New USB device found, idVendor=090c, idProduct=1000
[ 1059.324606] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[ 1059.332182] usb 2-1: Product: Flash Disk
[ 1059.336161] usb 2-1: Manufacturer: USB 2.0
[ 1059.340318] usb 2-1: SerialNumber: REDACTED
[ 1059.352819] scsi1 : usb-storage 2-1:1.0
[ 1060.365693] scsi 1:0:0:0: Direct-Access USB 2.0 Flash Disk 1100 PQ: 0 ANSI: 0 CCS
[ 1060.387435] sd 1:0:0:0: [sda] 1981440 512-byte logical blocks: (1.01 GB/967 MiB)
[ 1060.414215] sd 1:0:0:0: [sda] Write Protect is off
[ 1060.419068] sd 1:0:0:0: [sda] Mode Sense: 43 00 00 00
[ 1060.420254] sd 1:0:0:0: [sda] No Caching mode page present
[ 1060.425803] sd 1:0:0:0: [sda] Assuming drive cache: write through
[ 1060.442350] sd 1:0:0:0: [sda] No Caching mode page present
[ 1060.447900] sd 1:0:0:0: [sda] Assuming drive cache: write through
[ 1060.585323] sda: sda1
[ 1060.599829] sd 1:0:0:0: [sda] No Caching mode page present
[ 1060.608492] sd 1:0:0:0: [sda] Assuming drive cache: write through
[ 1060.615053] sd 1:0:0:0: [sda] Attached SCSI removable disk
[ 1211.443141] compat: version magic '2.6.30.10 preempt mod_unload ARMv5 ' should be '3.4.20-rt31-dvf-v1.2.4-rc2 preempt mod_unload ARMv5 p2v8 '
[ 1235.081591] compat_firmware_class: version magic '2.6.30.10 preempt mod_unload ARMv5 ' should be '3.4.20-rt31-dvf-v1.2.4-rc2 preempt mod_unload ARMv5 p2v8 '
root@OBiPhone:~#

The obi 202 I have is not rooted. So, I couldn't do much with that. So I tried it on the Obi 1032, which also does not have a wifi. I suppose the toolchain is completely different.

I can confirm the firmware mod works on the Obi1022/1032/1062. With the limitation that Obi1022 possibly has only 5 physical buttons so the lines may not map one to one.

Also on the obi 1032 i have a wired issue. SP1 is configured to the obi number of the device and it lets me make calls??? How do i disable obi number or make it a secondary number?

Second, on all three devices these settings are lost on a reboot. Google voice continues to work.

Under ITSP Provisioning, set these:
Method: System Start
ConfigURL: »fw.obifirmware.com/Enabl ··· TALK.xml

ha. ya, that kmod is only for the kernel in the obi2xx.

that particular wifi driver actually comes with the stock 3.4.20 kernel so it should be possible to build it for the obiphone kernel as well, but this requires guessing the kernel .config params for that also. you must be new to this thread. thats kind of what we do here as designed, it only needs to get set once, so that xml configures itself to un-configure itself after it takes the setting the first time.

Off topic... @naf, let me guess, you prefer android?

i guess by default, yes, but thats just because ive never had an ios device (or for that matter *any* device besides an old samsung sph-l300 that i picked up when sprint briefly forgot to restrict their "sign up for service get a free smartphone" promo to exclude pay-as-you-go plans with no etf).

but im guessing ios apps aren't as easy to mod as apks?

I can't answer that. There's never been any Iproducts in this household. Not being able to root a phone would be a deal breaker for me. It's top on my list of features a device must have.

ok the modules load but the device still says, "OBiWiFi Dongle Not Found!

Please connect an OBiWiFi Dongle to the USB Port and try again."

after the drivers are loaded, anything look promising in:
# /usr/sbin/iwconfig
# cat /proc/net/wireless

if that realtek is listed, you should be able to obi-ize it like this:
# /obi/usbwifi.sh plug

If no realtek appears, maybe try reloading the driver with debugging mode on?
# /sbin/rmmod rtl8192cu.ko
# /sbin/insmod rtl8192cu.ko debug=5
# dmesg

ah shit. i forgot it needs firmware to load. and /lib/firmware doesn't exist to mount-bind over... hmm...

If it helps, I will be getting the ObiWifi as well soon. So we can look at that chipset. Identify cheaper alternatives with the same chipset and patch the vendor, id. So, folks can go out and buy a cheaper ObiWifi as well.

I will do all this and post back a little later in the day.

The ObiWifi has two usb ids of some realtek chip:
3823:6249
6249:3823

And the ObiBT is this:
6242:8202

i dont know how you would buy something with those (or any specific) ids though.

debug should just comfirm that it cant load firmware, i think.

what would be nice would be if both /lib/modules and /lib/firmware (and modules.dep and some udev rule) were symlinked to the jffs2 on /scratch, so we can just insert drivers on the fly and theyll just autoload next reboot... maybe ill try that later.

Well my distracted brainwave pattern:
Realtek chip is used by many manufacturers including Obi. If we find the chip used in the ObiHai, we can find other vendor usb devices with the same chip. Often it's on github or elsewhere. Buy the devices with the same chip. Change Obi's firmware to recognize these usb devices as Obiwifi devices and that possibly works. It may work because most manufacturers use the reference design from Realtech without any changes. So, the drivers written for the ObiHai should also work for devices that use the same chip from some other manufacturer, provided Obihai used the reference design and the other manufacturer used the same reference design.

One of those id's is for the chip they use in Obi 1062, the inbuilt version. Obi also has a 5G/2.4G version and an older 2.4G version of their USB device. Those must be the three USB ids.

So, we add entries to Obi or replace the entries with the entries we want ...

# /usb/sbin/iwconfig
-sh: /usb/sbin/iwconfig: not found
# /usr/s
/usr/sbin/ /usr/share/
# /usr/sbin/iwconfig
lo no wireless extensions.

unm no wireless extensions.

eth1 no wireless extensions.

eth0 no wireless extensions.

br0 no wireless extensions.

# cat /proc/net/wireless
Inter-| sta-| Quality | Discarded packets | Missed | WE
face | tus | link level noise | nwid crypt frag retry misc | beacon | 22
# /obi/usbwifi.sh plug
# /sbin/rmmod rtl8192cu.ko
# /sbin/rmmod rtl8192cu.ko debug=5
rmmod: can't unload 'rtl8192cu': unknown symbol in module, or unknown parameter
# /sbin/insmod rtl8192cu.ko debug=5
insmod: can't insert 'rtl8192cu.ko': No such file or directory
# /sbin/insmod /mnt/hdd/rt18192/rtl8192cu.ko debug=5
insmod: can't insert '/mnt/hdd/rt18192/rtl8192cu.ko': No such file or directory

# /sbin/insmod /mnt/hdd/rtl8192/
/mnt/hdd/rtl8192/cfg80211.ko /mnt/hdd/rtl8192/rtl8192c-common.ko
/mnt/hdd/rtl8192/compat.ko /mnt/hdd/rtl8192/rtl8192cu.ko
/mnt/hdd/rtl8192/compat_firmware_class.ko /mnt/hdd/rtl8192/rtl_usb.ko
/mnt/hdd/rtl8192/mac80211.ko /mnt/hdd/rtl8192/rtlwifi.ko
# /sbin/insmod /mnt/hdd/rtl8192/rtl8192cu.ko debug=5
# /usr/sbin/iwconfig
lo no wireless extensions.

unm no wireless extensions.

eth1 no wireless extensions.

eth0 no wireless extensions.

br0 no wireless extensions.

# /obi/usbwifi.sh plug
# cat /proc/net/wireless
Inter-| sta-| Quality | Discarded packets | Missed | WE
face | tus | link level noise | nwid crypt frag retry misc | beacon | 22
#

I think you're overcomplicating this. The only thing special about the ObiWifi dongle is that it happens to have a driver preinstalled in the obi firmware. If we can install arbitrary drivers of our choosing in the firmware, it doesn't matter if the device is similar to the ObiWifi one or not.

well, not so fast. on the obi2xx the jffs2 on /scratch is only ~500k, and even just the rtl8192cu driver without the firmware weighs in at ~944k. (and since i dont even have a wifi dongle that works with that kernel...)

more possibilities on an obiphone though: plenty of [rw-mounted!] flash, and a recent enough kernel to support lots of devices. just going to take some work getting the kernel .config worked out to compile modules with the right symbols.

What about using external usb for storage for extra space? Albeit a hub would be needed for multiple usb devices (flash drive, wifi dongle, etc). Or is that a bigger headache than its worth....

Today I signed up for OBiEXTRAS, added my OBi1032 to OBiTALK, and imported my Google Contacts.

The contacts were pushed to the phone by OBiTALK. It's not a LIDB-style lookup. The traffic was encrypted and I did not know how to read it.

I then installed olisom4 and ran param_dump. This did not display any contact-related data.

On a whim, I grepped /data for the name of one of my contacts, but that did not turn up anything.

I also did a user data and configuration backup, but that did not contain the contacts either.

I then added some more contacts and did a param_dump again. They were nearly identical except for 52b4f6ce 06000004: cef6b452 (???) = "false" in 00020000.

So essentially I'm not intelligent enough to figure out where the contact data is stored. Any suggestions would be welcome.

EDIT:

I found a file called /scratch/contacts.csv which contained some but not all of my contacts. Before I could investigate further, the phone changed its firmware to the official Obihai firmware. Reinstalling olisom4 now.

So now the phone's factory reset itself, and the /scratch/contacts.csv file is gone. I recreated it, but that didn't seem to do anything.

According to Obitalk the Obi Phones don't need ObiExtras to have contacts added to them:

Ok, done. Nothing seems to have happened. How do I make it import the csv file?

Find that “Import Google Contacts” button.

can you post the syslog output during the obitalk contact import? (not the normal phone contacts import, cause im more interested in recreating on a obi2xx)

[Mar 23 14:00:02][192.168.1.107]<7> capp gui post cnt 0
[Mar 23 14:00:03][192.168.1.107]<7> SMON:Init:20
[Mar 23 14:00:35][192.168.1.107]<7> TCP:Connect OK(lhttpc)61
[Mar 23 14:00:35][192.168.1.107]<7> Trying to connect ssl
[Mar 23 14:00:36][192.168.1.107]<7> TC:ssl connected
[Mar 23 14:00:36][192.168.1.107]<7> LHC:Response OK
[Mar 23 14:00:36][192.168.1.107]<7> CAPP:SkipWidgetRefresh:2
[Mar 23 14:00:40][192.168.1.107]<14> [CWMP] vdm_default buildtime: 1471482862
[Mar 23 14:00:40][192.168.1.107]<14> [CWMP] vdm_min buildtime: 1471482788
[Mar 23 14:00:49][192.168.1.107]<6> Saving /scratch/contacts.xml
[Mar 23 14:00:49][192.168.1.107]<7> +++++ Stopping Lua.
[Mar 23 14:00:49][192.168.1.107]<7> +++++ (re)start Lua.
[Mar 23 14:00:50][192.168.1.107]<6> ASR status: starting     
[Mar 23 14:00:50][192.168.1.107]<6> +++++++++++ ASR status set to 1
[Mar 23 14:00:50][192.168.1.107]<5> IPC PARAM GET X_DeviceManagement.Syslog.Server
[Mar 23 14:00:50][192.168.1.107]<5> IPC PARAM GET X_DeviceManagement.Syslog.Port
[Mar 23 14:00:50][192.168.1.107]<14> [CWMP] vdm_default buildtime: 1471482862
[Mar 23 14:00:50][192.168.1.107]<14> [CWMP] vdm_min buildtime: 1471482788
[Mar 23 14:00:50][192.168.1.107]<14> [CWMP] vdm build: 1471482862
[Mar 23 14:00:50][192.168.1.107]<14> [CWMP] Lua memory allocation: 681.8359375KB
[Mar 23 14:00:50][192.168.1.107]<14> [CWMP] Looking for and parsing contacts.xml...
[Mar 23 14:00:50][192.168.1.107]<14> [CWMP] contacts.xml found...
[Mar 23 14:00:50][192.168.1.107]<14> [CWMP] ASR/TTS: Precomputing phonetic map for 3 names/numbers
[Mar 23 14:00:50][192.168.1.107]<14> [CWMP] ASR/TTS: Using leading 3 word(s) for singles/pairs
[Mar 23 14:00:50][192.168.1.107]<14> [CWMP] ASR/TTS: Phonetic map complete
[Mar 23 14:00:50][192.168.1.107]<14> [CWMP] Lua memory allocation: 705.9658203125KB
[Mar 23 14:00:50][192.168.1.107]<14> [CWMP] Starting contact match server at 127.0.0.1:14641...
[Mar 23 14:00:50][192.168.1.107]<14> [CWMP] Starting business match server at 127.0.0.1:14241...
[Mar 23 14:00:50][192.168.1.107]<14> [CWMP] Starting gtts server at 127.0.0.1:12421...
[Mar 23 14:00:50][192.168.1.107]<6> ASR status: up     
[Mar 23 14:00:50][192.168.1.107]<6> +++++++++++ ASR status set to 2
 

so it looks like the obitalk import procedure is:
1) send contacts.csv to device through ???, notify device
2) device reads contacts.csv, converts to contacts.xml, deletes csv
3) device invokes a lua server that processes contacts.xml

seems like we need to just write the .xml and restart the lua server...