Spot the EEPROM? - Page 1
Forum section: electronics / beginners

author: kujina
author_rank: Newbie
timestamp: March 16, 2016, 04:51:12 pm
content: Hello allQuestionI have looked over the board in the photo below and searched the codes on google but I cant locate the eeprom on this board, I appreciate any help.BackgroundBasically I bought a couple ofcisco spa502gvoIP phones cheap on eBay and unfortunately they are password protected (this often is the case with these phones second hand), the problem I have is these phones have strong security and I cant factory reset these phones (tried tftp provisioning).The idea now is to remove the EEPROM and swap in an un-programmed one, and perhaps the phone would go in SOS (recovery) mode and then I could re-flash using the 'Cisco SPA Device Firmware Upgrade Utility'.ThanksClick for much larger image

author: Kjelt
author_rank: Super Contributor
timestamp: March 16, 2016, 05:02:23 pm
content: Which foto?

author: kujina
author_rank: Newbie
timestamp: March 16, 2016, 05:08:45 pm
content: Quote from: Kjelt on March 16, 2016, 05:02:23 pmSorry was faffing with image

author: Kjelt
author_rank: Super Contributor
timestamp: March 16, 2016, 05:12:20 pm
content: The 29lv64 is a huge flash rom, why would they not store it in there?I would first try a factory reset and the factory passwords if you can get them.

author: Kilrah
author_rank: Unknown
timestamp: March 16, 2016, 05:14:45 pm
content: If there's one it would most likely be the little 8-pin chip on top right (U16), but it's likely there is none and everything's stored in the flash with a small partition of it being mounted read/write.

author: andtfoot
author_rank: Unknown
timestamp: March 16, 2016, 05:22:29 pm
content: In the firmware download from the Cisco site there is a recovery .exe.I haven't tried it (I've only worked with the Call Manager connected stuff), but does that maybe work without having to reset the phone first?

author: tszaboo
author_rank: Super Contributor
timestamp: March 16, 2016, 05:45:19 pm
content: Quote from: Kilrah on March 16, 2016, 05:14:45 pmdoubt it, it goes to J23 so it is power.I think it might be one of the small SOT23 devices. U9 is either a reset IC or a one wire eeprom.

author: kujina
author_rank: Newbie
timestamp: March 16, 2016, 06:19:48 pm
content: Thanks guys really appreciate all the replies, I'm trying to get those working to give to my brother in law to use with his new business. The eBay seller sells lot of general commercial & industrial items and has no clue about these phones. I've tried all the standard avenues of reseting the phone including trying to "provision" the phone via TFTP on boot. I did actually get the provisioning via TFTP (as a test) to work on my spa504g I already have. So these spa502G's probably have provisioning disabled and the web (admin) interface is also disabled so they have been really locked down!Quote from: NANDBlog on March 16, 2016, 05:45:19 pmThe U9 component has written on it AM034orAMO34.The followinglinkis where I got the idea about the eeprom (unfortunately the thread is closed as it's old).

author: daqq
author_rank: Super Contributor
timestamp: March 16, 2016, 06:33:05 pm
content: Try contacting CISCO for a reset procedure maybe? Other than that there's still the possibility that any configuration data is stored either in the main ASIC or in the main FLASH memory... maybe if you have access to a scope you could scope out the communication in and out of the U9 to see/guess what it does?Also, I'm guessing that there is a fair amount of stuff to configure on such a phone - it'll probably run some kind of linux/obscure OS with a lot of networking settings. As such 1-2kB is the bare minimum value for such a configuration, probably more. As such it's a good bet that they won't be storing it in a small 1 wire memory. My best guess would be that it's stored in the main FLASH.

author: Kjelt
author_rank: Super Contributor
timestamp: March 16, 2016, 09:39:08 pm
content: You could desolder the flash chip, solder it on a breakoutboard and read out its contents.However looking in the manual that this thing can do real time 256 bits encryption/decryption, if I was the SW engineer I would encrypt the entire external flash and sign it.Still it could be unencrypted in which case the flash might give clues about configuration or passwords etc.

author: kujina
author_rank: Newbie
timestamp: March 16, 2016, 10:33:20 pm
content: Sorry guys you'll have to forgive me, my knowledge of electronics is very very basic. Re-reading the responses I've realised that the answer is probably the large 29LV640ETTI-70G - "The 29lv64 is a huge flash rom, why would they not store it in there?" comments fromKjeltmade the penny drop.As I wrote before, I got the idea from thisthreadto remove theEEPROMflash memory and swap in an un-programmed one, hopfully making the phone go intoSOS mode recoveryand then I could re-flash using the 'Cisco SPA Device Firmware Upgrade Utility'.Is this making more sense now?

author: ade
author_rank: Unknown
timestamp: March 16, 2016, 10:56:51 pm
content: If you attempt to replace the flash memory you'll probably just damage the phone permanently.It sounds like your phone is provider locked. Your best bet is to find out which company was the service provider (maybe there's a message on boot), call them up and kindly ask them if they would unlock the phone for you ("pretty please").

author: ve7xen
author_rank: Super Contributor
timestamp: March 17, 2016, 01:39:47 am
content: You can also try hooking the phone up to a network you control and monitor its traffic. Chances are that it reaches out for a provisioning file. Set up a server to respond on whatever address it is reaching out to (maybe you can just set a local DNS entry to override it) and I believe you should be able to re-provision the phone. I'm not too familiar with the provisioning files for these phones, but you should be able to set the front-panel password that way, then do a factory reset.Pretty sure Cisco didn't use encryption anywhere inside the box. They are stuck in the 90s when it comes to software development, and this series of phones is no exception. The software quality is quite horrible.

author: kujina
author_rank: Newbie
timestamp: March 17, 2016, 02:31:56 am
content: ve7xenI actually just did that before refreshing this page and reading your post! Earlier I readade'sreply and I knew trying to get the password from the original supplies of the phones would be a long shot but I decided to look through the phone's menu's once again for any details and I saw the provisioning server url in the Status menu so I set everything up DNS wise etc and a correctly named .xml file with a password of 0000, the phone provisioned and voilàfactory reseted them both!Thanks everybody for your responses, these phones will be off to my brother in-law now. I will pick up one or two more of these spa50XG series phones for myself and if provisioning doesn't work (these phones are almost always password protected coming from business environments) I will attempt removing the flash memory as a last resort.Thanks!