Facebook
Google
GitHub
Linkedin
Gallery of board shots:
It's a board for a Windstream VoIP phone.
The other side is almost all button pads (for the front of the phone), so I didn't include any shots of that.
I have an identical phone that is Allworx brand (Allworx is a subsidiary of Windstream). You can even see that "Allworx" is printed on the PCB - but the external plastic housing and the boot up screen both say "Windstream".
Basically I want to connect this phone to an Allworx server (my local Allworx server on my LAN). It refuses to do so. It does negotiate with the server enough to download a "software" update for the phone (proving again that they are essentially identical), but then fails to actually register.
I'm betting (but I could be wrong) that "software" and "firmware" on a device like this are both stored on the same chip, and that one piece "deeper" down is just "locked".
That "locked" bit is what throws up an "Allworx" logo or a "Windstream" logo on the loading screen, and it's what determines whether the server accepts or rejects the registration attempt, but otherwise they are the same phone.
What I'd like to do is somehow read the entire onboard memory from an identical Allworx phone, and then overwrite the same chip on the Windstream phone.
Just by looking at the board, can anyone tell me if that seems like a plausible tasks, and where I might go about doing it?
I see what I assume is a 20-pin JTAG header at the top left. But maybe I could clamp something to the memory chip directly?
I tried googling several of the chips:
* OWTR MS00731NL - lots of sellers but I couldn't actually figure out what it is
* OWTR-A0138 - No idea
* T1309 3236 - No idea
* R172A AA W74C - No idea
* TG111-S12NYN - Halo, something related to PoE isolation
* AC3106I - no exact match but seems to be TLV320AIC3106? Texas Instruments Stereo Audio Codex for Telephony
* TPS23753A - Texas Instruments PoE Interface and Converter
* AM3352(BZCZ60) - Texas Instruments ARM Cortex-A8 32-bit processor 600MHz
* TPS65217D - Texas Instruments Power Management IC (PMIC) for the AM335x ARM Cortex-A8 line
* D9SFT - Micron 1GB DDR3 RAM
* 88E6320-NAZ2 - Marvell Ethernet Switch (Ethernet Controller)
* MX30LF1G18AC-T1 - MXIC 1GB Flash NAND Memory
I kept looking at chips even after I found the NAND flash because I though *maybe* there was a lower-level "BIOS" chip that precedes the flash memory, but I couldn't find anything. Unfortunately the pins on that NAND flash look way too small for a clamp, so I assume I'd either need to go through the JTAG port or desolder the chips to read them.
So presuming I want to copy the contents of that Flash chip from one board to the same chip on another board, is it feasible? Or is it going to be encrypted and tied to some key on the CPU or something?
I don't mind if I kill this thing. It's no use to me now and this might be a fun project.
It's a board for a Windstream VoIP phone.
The other side is almost all button pads (for the front of the phone), so I didn't include any shots of that.
I have an identical phone that is Allworx brand (Allworx is a subsidiary of Windstream). You can even see that "Allworx" is printed on the PCB - but the external plastic housing and the boot up screen both say "Windstream".
Basically I want to connect this phone to an Allworx server (my local Allworx server on my LAN). It refuses to do so. It does negotiate with the server enough to download a "software" update for the phone (proving again that they are essentially identical), but then fails to actually register.
I'm betting (but I could be wrong) that "software" and "firmware" on a device like this are both stored on the same chip, and that one piece "deeper" down is just "locked".
That "locked" bit is what throws up an "Allworx" logo or a "Windstream" logo on the loading screen, and it's what determines whether the server accepts or rejects the registration attempt, but otherwise they are the same phone.
What I'd like to do is somehow read the entire onboard memory from an identical Allworx phone, and then overwrite the same chip on the Windstream phone.
Just by looking at the board, can anyone tell me if that seems like a plausible tasks, and where I might go about doing it?
I see what I assume is a 20-pin JTAG header at the top left. But maybe I could clamp something to the memory chip directly?
I tried googling several of the chips:
* OWTR MS00731NL - lots of sellers but I couldn't actually figure out what it is
* OWTR-A0138 - No idea
* T1309 3236 - No idea
* R172A AA W74C - No idea
* TG111-S12NYN - Halo, something related to PoE isolation
* AC3106I - no exact match but seems to be TLV320AIC3106? Texas Instruments Stereo Audio Codex for Telephony
* TPS23753A - Texas Instruments PoE Interface and Converter
* AM3352(BZCZ60) - Texas Instruments ARM Cortex-A8 32-bit processor 600MHz
* TPS65217D - Texas Instruments Power Management IC (PMIC) for the AM335x ARM Cortex-A8 line
* D9SFT - Micron 1GB DDR3 RAM
* 88E6320-NAZ2 - Marvell Ethernet Switch (Ethernet Controller)
* MX30LF1G18AC-T1 - MXIC 1GB Flash NAND Memory
I kept looking at chips even after I found the NAND flash because I though *maybe* there was a lower-level "BIOS" chip that precedes the flash memory, but I couldn't find anything. Unfortunately the pins on that NAND flash look way too small for a clamp, so I assume I'd either need to go through the JTAG port or desolder the chips to read them.
So presuming I want to copy the contents of that Flash chip from one board to the same chip on another board, is it feasible? Or is it going to be encrypted and tied to some key on the CPU or something?
I don't mind if I kill this thing. It's no use to me now and this might be a fun project.
